NCP Documentation — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited NCP Documentation (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- mcp-name: io.github.portel-dev/ncp -->
<div align="center">
<img src="./assets/ncp.svg" alt="NCP Logo" width="200" height="200">
1 MCP to rule them all
</div>
Your MCPs, supercharged. Discover tools, execute with code mode, run on schedule, find skills, and load Photons through common MCP clients. On-demand discovery keeps the initial tool surface focused.
Related Portel project: Photon turns TypeScript methods into reliable agent-facing capabilities: MCP tools, embedded app UIs, CLI commands, web routes, schedules, webhooks, retries, and Beam interfaces. NCP helps agents discover and operate tools; Photon helps developers build the tools and apps agents can trust.
Instead of your AI juggling 50+ tools scattered across different MCPs, NCP gives it a single, unified interface with code mode execution, scheduling, skills discovery, and custom Photons.
Most hosts see NCP's small gateway surface (find, run, and, when enabled, code). Hosts that support MCP Apps can also receive selected app callback tools so embedded interfaces keep working. NCP adds app tools selectively; it omits conflicting app groups rather than renaming callbacks that an app may call by name.
await github.create_issue({...}) (code mode, enabled by default)Behind the scenes, NCP manages all 50+ tools + skills + Photons: routing requests, discovering the right capability, executing code, scheduling tasks, managing health, and caching responses.
The host determines which optional features it can use. NCP advertises MCP Apps, Skills, and Tasks capabilities, while clients that do not support an extension continue with the core tools and existing request flows.
NCP Transformation Flow
Why this matters:
🚀 NEW: Project-level configuration - each project can define its own MCPs automatically
What's MCP? The Model Context Protocol by Anthropic lets AI assistants connect to external tools and data sources. Think of MCPs as "plugins" that give your AI superpowers like file access, web search, databases, and more.
You gave your AI assistant 50 tools to be more capable. Instead, you got desperation:
read_file or get_file_content?")Think about it like this:
A child with one toy → Treasures it, masters it, creates endless games with it A child with 50 toys → Can't hold them all, gets overwhelmed, stops playing entirely
Your AI is that child. MCPs are the toys. More isn't always better.
The most creative people thrive with constraints, not infinite options. A poet given "write about anything" faces writer's block. Given "write a haiku about rain"? Instant inspiration.
Your AI is the same. Give it one perfect tool → Instant action. Give it 50 tools → Cognitive overload. NCP provides just-in-time tool discovery so your AI gets exactly what it needs, when it needs it.
When your AI assistant manages 50 tools directly:
🤖 AI Assistant Context:
├── Filesystem MCP (12 tools)
├── Database MCP (8 tools)
├── Web Search MCP (6 tools)
├── Email MCP (15 tools)
├── Shell MCP (10 tools)
├── GitHub MCP (20 tools)
└── Slack MCP (9 tools)
💀 Total: 80 tool schemas compete for attention before useful work beginsWhat happens:
With NCP as Chief of Staff:
🤖 AI Assistant Context:
└── NCP gateway tools → discover and run the tools needed for this request
🎯 Behind the scenes: NCP manages all 80 tools
📈 Tool discovery happens on demand
🎪 AI behavior: Confident, focused, decisiveNCP reduces the need to load every downstream tool schema into the host up front. The amount of context saved and any effect on response time vary with the host, server catalog, and enabled features.
Choose your MCP client for setup instructions:
| Client | Description | Setup Guide |
|---|---|---|
| Claude Desktop | Anthropic's official desktop app. Best for NCP - one-click .dxt install with auto-sync | [→ Full Guide](docs/clients/claude-desktop.md) |
| Claude Code | Terminal-first AI workflow. Works out of the box! | Built-in support |
| VS Code | GitHub Copilot with Agent Mode. Use NCP for semantic tool discovery | [→ Setup](docs/clients/vscode.md) |
| Cursor | AI-first code editor with Composer. Popular VS Code alternative | [→ Setup](docs/clients/cursor.md) |
| Windsurf | Codeium's AI-native IDE with Cascade. Built on VS Code | [→ Setup](docs/clients/windsurf.md) |
| Cline | VS Code extension for AI-assisted development with MCP support | [→ Setup](docs/clients/cline.md) |
| Continue | VS Code AI assistant with Agent Mode and local LLM support | [→ Setup](docs/clients/continue.md) |
| Want more clients? | See the full list of MCP-compatible clients and tools | Official MCP Clients • Awesome MCP |
| Other Clients | Any MCP-compatible client via npm | Quick Start ↓ |
For advanced users or MCP clients not listed above:
Step 1: Install NCP
npm install -g @portel/ncpStep 2: Import existing MCPs (optional)
ncp config import # Paste your config JSON when promptedStep 3: Configure your MCP client
Add to your client's MCP configuration:
{
"mcpServers": {
"ncp": {
"command": "ncp"
}
}
}✅ Done! Your AI can discover and run tools through NCP. Hosts with MCP Apps support may also receive selected app callback tools.
NCP List Overview
Want to experience what your AI experiences? NCP has a human-friendly CLI:
# Ask like your AI would ask:
ncp find "I need to read a file"
ncp find "help me send an email"
ncp find "search for something online"NCP Find Command
Notice: NCP understands intent, not just keywords. Just like your AI needs.
# See your complete MCP ecosystem:
ncp list --depth 2
# Get help anytime:
ncp --helpNCP Help Command
# Test any tool safely:
ncp run filesystem read_file --path "/tmp/test.txt"Why this matters: You can debug and test tools directly, just like your AI would use them.
# 1. Check NCP is installed correctly
ncp --version
# 2. Confirm your MCPs are imported
ncp list
# 3. Test tool discovery
ncp find "file"
# 4. Test a simple tool (if you have filesystem MCP)
ncp run filesystem read_file --path "/tmp/test.txt" --dry-run✅ Success indicators:
ncp list shows your imported MCPsncp find returns relevant toolsYou've seen find (discover tools) and code (execute TypeScript). Individually, they're useful. Together with scheduling, they become an automation powerhouse.
We wanted to stay on top of MCP-related conferences and workshops for an upcoming release. Instead of manually checking websites daily, we asked Claude:
"Set up a daily scraper that finds MCP conferences and saves them to a CSV file"
What Claude did:
// Search the web for MCP conferences
const results = await web.search({
query: "Model Context Protocol conference 2025"
});
// Read each result and extract details
for (const url of results) {
const content = await web.read({ url });
// Extract title, deadline, description...
// Save to ~/.ncp/mcp-conferences.csv
} ncp schedule create code:run "every day at 9am" \
--name "MCP Conference Scraper" \
--catchup-missedHow to set this up yourself:
First, install the web photon (provides search and read capabilities):
# Install from the official photons repo
ncp photon add https://raw.githubusercontent.com/portel-dev/photons/main/web.photon.tsThen ask Claude to create the scraper - it will use the web photon automatically.
What happens now:
The insight: find and code let AI write automation. schedule makes it run forever. That's the powerhouse.
Bottom line: Your AI goes from desperate assistant to executive assistant.
Here's exactly how NCP empowers your MCPs:
| Feature | What It Does | Why It Matters |
|---|---|---|
| 🔍 Tool Discovery | Search tools by intent as well as keywords | Find relevant tools without exposing every downstream schema at once |
| 📦 On-Demand Loading | Discover downstream tools when needed | Keeps the initial tool surface focused; context savings vary by setup |
| ⏰ Automated Scheduling | Run any tool on cron schedules or natural language times | Background automation without keeping AI sessions open |
| 🔌 MCP Client Support | Works with common MCP clients, including Claude Desktop, Claude Code, Cursor, and VS Code | Core gateway behavior is available broadly; extension support depends on the host |
| 💾 Smart Caching | Intelligent caching of tool schemas and responses | Eliminates redundant indexing - energy efficient and fast |
The result: Your MCPs go from scattered tools to a unified, intelligent system that your AI can actually use effectively.
Prefer to build from scratch? Add MCPs manually:
# Add the most popular MCPs:
# AI reasoning and memory
ncp add sequential-thinking npx @modelcontextprotocol/server-sequential-thinking
ncp add memory npx @modelcontextprotocol/server-memory
# File and development tools
ncp add filesystem npx @modelcontextprotocol/server-filesystem ~/Documents # Path: directory to access
ncp add github npx @modelcontextprotocol/server-github # No path needed
# Search and productivity
ncp add brave-search npx @modelcontextprotocol/server-brave-search # No path neededNCP Add Command
💡 Pro tip: Browse Smithery.ai (2,200+ MCPs) or mcp.so to discover tools for your specific needs.
# Community favorites (download counts from Smithery.ai):
ncp add sequential-thinking npx @modelcontextprotocol/server-sequential-thinking # 5,550+ downloads
ncp add memory npx @modelcontextprotocol/server-memory # 4,200+ downloads
ncp add brave-search npx @modelcontextprotocol/server-brave-search # 680+ downloads# Popular dev tools:
ncp add filesystem npx @modelcontextprotocol/server-filesystem ~/code
ncp add github npx @modelcontextprotocol/server-github
ncp add shell npx @modelcontextprotocol/server-shell# Enterprise favorites:
ncp add gmail npx @mcptools/gmail-mcp
ncp add slack npx @modelcontextprotocol/server-slack
ncp add google-drive npx @modelcontextprotocol/server-gdrive
ncp add postgres npx @modelcontextprotocol/server-postgres
ncp add puppeteer npx @hisma/server-puppeteerNCP includes powerful internal MCPs that extend functionality beyond external tool orchestration:
Schedule any MCP tool to run automatically using cron or natural language schedules.
# Schedule a daily backup check
ncp run schedule:create --params '{
"name": "Daily Backup",
"schedule": "every day at 2am",
"tool": "filesystem:list_directory",
"parameters": {"path": "/backups"}
}'Features:
[→ Full Scheduler Guide](docs/SCHEDULER_USER_GUIDE.md)
Install and configure MCPs dynamically through natural language.
# AI can discover and install MCPs for you
ncp find "install mcp"
# Shows: mcp:add, mcp:remove, mcp:listFeatures:
Manage Anthropic Agent Skills - modular extensions that add specialized knowledge and tools to Claude.
// Discover skills using vector search
const results = await skills.find({ query: "canvas design" });
// Install a skill
await skills.add({ skill_name: "canvas-design" });
// List installed skills
const installed = await skills.list();
// Read skill resources
const template = await skills.read_resource({
skill_name: "canvas-design",
file_path: "resources/templates.md"
});Features:
[→ Full Skills Guide](./SKILLS.md)
View usage statistics, token savings, and performance metrics directly in your chat.
# View usage overview with ASCII charts
ncp run analytics:overview --params '{"period": 7}'Features:
Configuration: Internal MCPs are disabled by default. Enable in your profile settings:
{
"settings": {
"enable_schedule_mcp": true,
"enable_mcp_management": true,
"enable_skills": true,
"enable_analytics_mcp": true
}
}NCP automatically detects broken MCPs and routes around them:
ncp list --depth 1 # See health status
ncp config validate # Check configuration health🎯 Result: Your AI never gets stuck on broken tools.
Organize MCPs by project or environment:
# Development setup
ncp add --profile dev filesystem npx @modelcontextprotocol/server-filesystem ~/dev
# Production setup
ncp add --profile prod database npx production-db-server
# Use specific profile
ncp --profile dev find "file tools"New: Configure MCPs per project with automatic detection - perfect for teams and Cloud IDEs:
# In any project directory, create local MCP configuration:
mkdir .ncp
ncp add filesystem npx @modelcontextprotocol/server-filesystem ./
ncp add github npx @modelcontextprotocol/server-github
# NCP automatically detects and uses project-local configuration
ncp find "save file" # Uses only project MCPsHow it works:
~/.ncpall.jsonPerfect for:
.ncp folder with your repo)# Example project structures:
frontend-app/
.ncp/profiles/all.json # → playwright, lighthouse, browser-context
src/
api-backend/
.ncp/profiles/all.json # → postgres, redis, docker, kubernetes
server/NCP supports both stdio (local) and HTTP/SSE (remote) MCP servers:
Stdio Transport (Traditional):
# Local MCP servers running as processes
ncp add filesystem npx @modelcontextprotocol/server-filesystem ~/DocumentsStreamable HTTP (Remote):
{
"mcpServers": {
"remote-mcp": {
"url": "https://mcp.example.com/api",
"transport": "streamableHttp",
"auth": {
"type": "bearer",
"token": "your-token-here"
}
}
}
}For a legacy HTTP/SSE endpoint, set "transport": "sse". If an older profile has a URL and no transport, NCP continues to use its legacy SSE behavior. New registry imports select Streamable HTTP by default. Protocol-version negotiation is separate from transport selection and does not discover another endpoint automatically.
OAuth 2.1 with PKCE (MCP 2025-03-26 spec):
{
"mcpServers": {
"oauth-mcp": {
"url": "https://mcp.example.com/api",
"auth": {
"type": "oauth",
"oauth21": {
"scopes": ["read", "write"],
"callbackPort": 9876,
"clientId": "optional-pre-registered-client-id",
"clientSecret": "optional-client-secret"
}
}
}
}
}OAuth 2.1 Features:
~/.ncp/auth/ and refreshed automaticallyFirst-time setup flow:
http://localhost:9876)🔋 Hibernation-Enabled Servers:
NCP automatically supports hibernation-enabled MCP servers (like Cloudflare Durable Objects or Metorial):
How it works:
Perfect for:
Note: Hibernation is a server-side feature. NCP's remote MCP client works with both traditional and hibernation-enabled servers without special configuration.
NCP preserves downstream tool descriptors and native MCP results through discovery and run, including structured content, error state, metadata, and text, image, audio, resource, and resource-link blocks. If an integration previously parsed JSON text that encoded an array of result blocks, update it to consume the native MCP result fields.
When a host advertises MCP Apps support, NCP selectively exposes downstream app launch tools and app callbacks, and serves their ui:// resources. The host controls whether app-only callbacks are available to the model. Tool-name and UI-resource collisions cause the affected app groups to be omitted; their ordinary tools remain available through find and run.
The Skills extension exposes local and compatible remote skill manifests on demand, including SHA-256 digests for the manifest bytes. The Tasks extension gives compatible modern hosts durable handles for run and code, with tasks/get, tasks/update, and tasks/cancel. After a restart, unfinished work is reported as interrupted rather than replayed; cancellation is reported only when NCP can confirm the worker stopped. Hosts without Tasks support keep the existing synchronous or multi-round request flow.
Response caches are bounded, and private cached entries are partitioned by server configuration and credential identity. Server cache lifetimes and tool-list change notifications guide refreshes. For transport, SDK, registry, extension, and compatibility details, see the MCP compatibility notes.
The TypeScript Photon runtime is enabled by default, but the toggle lives in different places depending on how you run NCP:
~/.ncp/settings.json (or run ncp config) and set enablePhotonRuntime: true or false. You can also override ad‑hoc with NCP_ENABLE_PHOTON_RUNTIME=true ncp find "photon".~/.ncp/settings.json. Configure photons by setting the env var inside the client config:{
"mcpServers": {
"ncp": {
"command": "ncp",
"env": {
"NCP_ENABLE_PHOTON_RUNTIME": "true"
}
}
}
}If you disable the photon runtime, internal MCPs continue to work, but .photon.ts files are ignored until you re-enable the flag.
# From clipboard (any JSON config)
ncp config import
# From specific file
ncp config import "~/my-mcp-config.json"
# From Claude Desktop (auto-detected paths)
ncp config import# Check what was imported
ncp list
# Validate health of imported MCPs
ncp config validate
# See detailed import logs
DEBUG=ncp:* ncp config importncp list (should show your MCPs)ncp find "your query"ncp command# Check MCP health (unhealthy MCPs slow everything down)
ncp list --depth 1
# Clear cache if needed
rm -rf ~/.ncp/cache
# Monitor with debug logs
DEBUG=ncp:* ncp find "test"Like Yin and Yang, everything relies on the balance of things.
Compute gives us precision and certainty. AI gives us creativity and probability.
We believe breakthrough products emerge when you combine these forces in the right ratio.
How NCP embodies this balance:
| What NCP Does | AI (Creativity) | Compute (Precision) | The Balance |
|---|---|---|---|
| Tool Discovery | Understands "read a file" semantically | Routes to exact tool deterministically | Natural request → Precise execution |
| Orchestration | Flexible to your intent | Reliable tool execution | Natural flow → Certain outcomes |
| Health Monitoring | Adapts to patterns | Monitors connections, auto-failover | Smart adaptation → Reliable uptime |
Neither pure AI (too unpredictable) nor pure compute (too rigid).
Your AI stays creative. NCP handles the precision.
A reproducible gateway benchmark measures serialized payload sizes, local latency, workflow completion, and result fidelity. Run npm run benchmark:mcp; its byte-based token proxy is labeled separately from actual tokenizer measurements.
Want the technical details? Token analysis, architecture diagrams, and performance benchmarks:
📖 [Read the Technical Guide →](HOW-IT-WORKS.md)
Learn about:
Help make NCP even better:
Elastic License 2.0 - Full License
TLDR: Free for all use including commercial. Cannot be offered as a hosted service to third parties.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.