# Nas.com MCP For AI Agents

Canonical URLs:
- Human guide: https://nas.com/mcp
- Markdown guide: https://nas.com/mcp.md
- MCP endpoint: https://mcp.nas.com/mcp
- Protected-resource metadata: https://mcp.nas.com/.well-known/oauth-protected-resource
- Authorization server: https://auth.nas.com
- Authorization-server metadata: https://auth.nas.com/.well-known/oauth-authorization-server

Connection workflow:
- Configure Streamable HTTP at https://mcp.nas.com/mcp.
- Call initialize, send notifications/initialized, then call tools/list.
- Connection, ping, tools/list, and the supported onboarding tools do not require authentication.
- When a protected tool returns an OAuth 401 challenge, authenticate and retry that tool.
- Treat live tools/list as the exhaustive current catalog.

Anonymous tools:
- create_image_asset_upload only with useCase onboarding
- create_onboarded_business
- get_onboarding_plan_options
- generate_plan_checkout_link

Protected payment tools:
- prepare_plan_payment
- confirm_plan_payment

Supported scopes:
- nas.communities.read
- nas.communities.write
- nas.members.read
- nas.products.read
- nas.products.write
- nas.orders.read

Stateless onboarding:
- Carry onboardingSessionObjectId from create_onboarded_business.
- Call get_onboarding_plan_options without a community or onboarding-session ID.
- Carry the selected priceId unchanged.
- Record an explicit discount-code decision.
- Display the complete paymentSummary before exposing a checkout URL.

Saved-card guardrails:
- prepare_plan_payment and confirm_plan_payment require an authenticated community.
- Display the complete payment summary and masked card before requesting approval.
- Only an explicit yes to that summary authorizes confirm_plan_payment.
- Trial purchases use hosted checkout.

OAuth details:
- Proxy endpoints are /register, /authorize, /token, and /revoke on https://mcp.nas.com.
- X-NAS-Refresh-Token may be used for credential refresh.
- Persist refreshed credential headers returned by the server.
- Never expose, log, or commit bearer or refresh tokens.

Boundary:
- https://nas.com/api/agent/page-context and nas-page:// resources are read-only public-page context.
- They do not grant authenticated business access or MCP write permissions.
- Do not invent tools or schemas; use live tools/list.