NetLicensing MCP Server

The official Labs64 NetLicensing MCP Server — a natural language interface that lets AI agents manage software licenses, customers, and entitlements through conversational commands.

Works with Claude Desktop, GitHub Copilot (Agent mode), VS Code, JetBrains / IntelliJ IDEA, and any other MCP-compatible client.

Why use this?

• Natural Language Licensing — Ask your AI assistant to create products, issue licenses, validate entitlements, and generate shop URLs without touching the NetLicensing UI or writing API calls.
• Full API coverage — Various tools spanning the entire NetLicensing REST API: products, modules, templates, licensees, licenses, bundles, tokens, transactions, and payment methods.
• Built-in audit prompts — Five ready-to-run prompt templates for account audits, expiry sweeps, anomaly detection, and cleanup workflows.
• Safe by default — All delete operations expose a force_cascade option; nothing is silently cascaded.
• Zero-dependency quick start — Run with uvx or Docker without a local Python install.

What can you ask?

Once connected, you can talk to NetLicensing in plain language:

• "List all products in my NetLicensing account."
• "Create a new licensee for customer@example.com under product PTEST."
• "Validate the license for licensee L001 — does it pass?"
• "Generate a shop URL for licensee L001 so they can self-serve their renewal."
• "Which licenses are expiring in the next 30 days?"
• "Find any licensees with no active licenses — flag them for cleanup."
• "Transfer all licenses from licensee L001 to L002."
• "Create an API key token scoped to read-only access."
• "Show me all transactions from the last month."

Features

Security defaults

The server is designed to be safe by default:

• No silent credential fallback — if NETLICENSING_API_KEY is not set and NETLICENSING_ALLOW_DEMO is not explicitly enabled, the server refuses to start (stdio) or returns 503 (HTTP) rather than silently using demo credentials.
• Redaction layer — every tool response passes through a redaction filter. Sensitive fields (apiKey, licenseeSecret, nodeSecret, password, secret) are masked to a partial form (e.g. s3c****ecret). The set is extendable via MCP_REDACT_FIELDS.
• One-time credentials — create_api_token and create_shop_token tag their response with "shown_once": true so clients know the credential will not be visible in full again. Subsequent get_token / list_tokens calls return masked values.
• Delete confirmation — all destructive operations require a two-step confirmation token flow; nothing is silently cascaded.

Quick Start

Option A — uvx (no install required)

NETLICENSING_API_KEY=your_key uvx netlicensing-mcp

Option B — pip

pip install netlicensing-mcp
NETLICENSING_API_KEY=your_key netlicensing-mcp

Option C — Docker

stdio (default) — for Claude Desktop / VS Code

docker run -i --rm \
  -e NETLICENSING_API_KEY=your_key \
  ghcr.io/labs64/netlicensing-mcp:latest

HTTP mode — for remote/shared deployments

docker run -d -p 8000:8000 \
  -e NETLICENSING_API_KEY=your_key \
  ghcr.io/labs64/netlicensing-mcp:latest http

Verbose logging (any mode)

# CLI flag
docker run -i --rm \
  -e NETLICENSING_API_KEY=your_key \
  ghcr.io/labs64/netlicensing-mcp:latest -v

# Or via env var
docker run -i --rm \
  -e NETLICENSING_API_KEY=your_key \
  -e MCP_VERBOSE=true \
  ghcr.io/labs64/netlicensing-mcp:latest

Demo / sandbox mode (no API key)

docker run -i --rm \
  -e NETLICENSING_ALLOW_DEMO=true \
  ghcr.io/labs64/netlicensing-mcp:latest

No API key? Set NETLICENSING_ALLOW_DEMO=true to run against NetLicensing's built-in sandbox with demo credentials — no account required. The server will tag every response with "demo_mode": true and emit a periodic warning so it is always clear you are not using a real account.

Configuration

Environment Variables

* NETLICENSING_API_KEY and demo mode: If neither NETLICENSING_API_KEY nor NETLICENSING_ALLOW_DEMO=true is set, the server will refuse to start (stdio mode) or return 503 Service Unavailable for all tool calls (HTTP mode). This prevents accidental use of demo credentials in production.

Note on HTTP deployments (e.g. AWS): When running in HTTP mode over a network, you can skip setting NETLICENSING_API_KEY on the server. The MCP server will automatically extract the key per-request if the connecting client provides it via the X-NetLicensing-API-Key HTTP header, Authorization: Bearer <key> header, or ?apikey=<key> query parameter.

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "netlicensing": {
      "command": "uvx",
      "args": ["netlicensing-mcp"],
      "env": {
        "NETLICENSING_API_KEY": "your_key_here"
      }
    }
  }
}

Or use the official Docker image:

stdio (default) — for Claude Desktop / VS Code

{
  "mcpServers": {
    "netlicensing": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "NETLICENSING_API_KEY=your_key_here",
        "ghcr.io/labs64/netlicensing-mcp:latest"
      ]
    }
  }
}

HTTP mode — for remote/shared deployments

{
  "mcpServers": {
    "netlicensing": {
      "command": "docker",
      "args": [
        "run", "-d",
        "-p", "8000:8000",
        "-e", "NETLICENSING_API_KEY=your_key_here",
        "ghcr.io/labs64/netlicensing-mcp:latest",
        "http"
      ]
    }
  }
}

VS Code / GitHub Copilot

The repo ships a .vscode/mcp.json that auto-configures Copilot Agent mode. Set NETLICENSING_API_KEY in your shell environment or a .env file, then click Start in the editor banner that appears above mcp.json.

JetBrains / IntelliJ IDEA

In Copilot Chat → Agent mode → Tools icon → Add More Tools… — paste the same JSON block shown in the Claude Desktop section above.

Audit Prompt Templates

Five built-in prompts accessible in Copilot Agent and Claude Desktop:

Troubleshooting

Check MCP server logs

# macOS / Claude Desktop
tail -f ~/Library/Logs/Claude/mcp-server-netlicensing.log
 
# Windows
Get-Content "$env:APPDATA\Claude\Logs\mcp-server-netlicensing.log" -Wait

Run the MCP Inspector (browser UI at http://localhost:5173)

mcp dev src/netlicensing_mcp/server.py

Common issues

Development

git clone https://github.com/Labs64/NetLicensing-MCP
cd NetLicensing-MCP

# Create a virtual environment
python -m venv .venv
source .venv/bin/activate       # Windows: .venv\Scripts\activate

# ... and install dependencies
pip install -e ".[dev]"
pip install hatch hatch-vcs

# Add your API key to a .env file (or export it in your shell)
cp .env.example .env
 
# Run the MCP Inspector
mcp dev src/netlicensing_mcp/server.py
 
# Run tests
pytest tests/ -v

# Clean previous builds
rm -rf dist/

# Build a wheel for local testing
hatch build --target wheel

# Build the Docker image locally
docker build -t ghcr.io/labs64/netlicensing-mcp:latest .

HTTP mode (for remote / shared deployments)

python -m netlicensing_mcp.server http
# Server listens on MCP_HOST:MCP_PORT (default: 127.0.0.1:8000)

Use ngrok or a reverse proxy to expose the HTTP endpoint to remote MCP clients:

ngrok http 8000
# Then point your client at the generated HTTPS URL

Cloud Deployment (AWS)

Deploy the MCP server to AWS for a public HTTPS endpoint that remote AI agents can connect to:

Quick deploy with the helper script

cd deploy/aws

# Option A — ECS Fargate
# Deploy (with optional HTTPS via ACM certificate)
./deploy.sh fargate \
    --certificate-arn arn:aws:acm:us-east-1:123456789:certificate/your-cert-id

# Option B — App Runner (mirror image to ECR first)
./deploy.sh mirror --ecr-repo 123456789.dkr.ecr.us-east-1.amazonaws.com/netlicensing-mcp
./deploy.sh apprunner \
    --ecr-image 123456789.dkr.ecr.us-east-1.amazonaws.com/netlicensing-mcp:latest

Connect MCP clients to the public URL

To use a shared, remote deployment, do not bake the NETLICENSING_API_KEY into the remote server settings. Instead, pass the API key from the client side using query parameters or HTTP headers.

For example, using the URL configuration in your MCP client with a query parameter:

{
  "mcpServers": {
    "netlicensing": {
      "url": "https://your-endpoint.us-east-1.elb.amazonaws.com/mcp?apikey=YOUR_API_KEY"
    }
  }
}

If you use a client or tool that supports passing HTTP headers directly, you can alternatively provide the key via X-NetLicensing-API-Key: YOUR_API_KEY or Authorization: Bearer YOUR_API_KEY.

📖 Full instructions, architecture diagrams, and cost estimates: deploy/aws/README.md

Contributing

Contributions are welcome! Please open an issue or pull request on GitHub.

For significant changes, open an issue first to discuss the approach.

License

Apache 2.0 — see LICENSE