@nopeek/mcp

A Model Context Protocol (MCP) server for the NoPeek end-to-end-encrypted chat API. It lets an AI agent (Claude Desktop, Claude Code, or any MCP client) provision and operate NoPeek infrastructure — create orgs and apps, issue keys, and manage users, workspaces, channels and messages — using a single NoPeek API key.

The server speaks MCP over the stdio transport and wraps the NoPeek REST API.

Install

From npm (once published):

npx @nopeek/mcp

Or build from the monorepo:

pnpm install
pnpm --filter @nopeek/mcp build
node packages/mcp-server/dist/index.js

Configuration

The server is configured entirely through environment variables:

| Variable | Required | Description | | ---------------- | -------- | -------------------------------------------------------------------------------------------------------------- | | NOPEEK_API_KEY | yes* | Bearer token. An org key (org-admin scope) manages apps and keys; an app server key manages users, workspaces, channels and messages within one app. Both real key types share the npk_ prefix — scope is set by the key's role, not its prefix. | | NOPEEK_API_URL | no | API base URL. Defaults to https://d3qweh72vesa98.cloudfront.net. |

* create_org and get_app_config are public and work without a key. Every other tool requires a valid key and will return an UNAUTHENTICATED error otherwise. A typical bootstrap is: run create_org with no key, save the returned apiKey.secret, then restart with it set as NOPEEK_API_KEY.

Claude Desktop setup

Add an entry to your claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "nopeek": {
      "command": "npx",
      "args": ["@nopeek/mcp"],
      "env": {
        "NOPEEK_API_KEY": "npk_live_your_key_here",
        "NOPEEK_API_URL": "https://d3qweh72vesa98.cloudfront.net"
      }
    }
  }
}

Restart Claude Desktop; the NoPeek tools will appear in the tool picker.

Tools

| Tool | Key scope | Description | | ---------------------- | ---------------- | ---------------------------------------------------------------- | | create_org | none (public) | Create an org; returns a new org-admin key secret. | | create_app | org | Create an app (+ default channel types + a server key). | | list_apps | org | List apps in the org. | | get_app | org / server | Fetch one app. | | issue_api_key | org | Mint a new app server key. | | create_user | server | Create/upsert a core-API user (by externalId). | | list_users | server | List app users (paginated). | | create_workspace | server | Create a workspace (returns join/referral codes). | | list_workspaces | server | List workspaces. | | add_workspace_member | server | Add an app user to a workspace. | | create_channel | server | Create a channel of a channel type (memberIds for members). | | list_channels | server | List channels. | | send_message | server | Send a message as a user (via actAs); E2EE needs ciphertext. | | list_messages | server | List channel messages. | | get_audit_log | org / server | Fetch the app audit trail. | | get_app_config | none (public) | Force-update policy, session settings, server time. |

Notes on the message model

• Default channel types (direct, group, broadcast) are E2EE. On an E2EE channel send_message requires ciphertext (an opaque string the server cannot read); non-E2EE channels require plaintext (a JSON object).
• With a server key, the sender is set via the actAs query parameter, so the senderUserId you pass must already be a member of the channel.
• send_message is idempotent on clientMessageId (auto-generated if omitted).

Example agent prompts

• "Create a NoPeek org called Acme, then create a live app named Support, and show me the server key."
• "In app app_…, create two users (external ids alice and bob), create a group channel named General with both as members, and make alice an operator."
• "Create a workspace named Engineering in app app_…, add user usr_… as an admin, and list the workspace members."

Development

pnpm --filter @nopeek/mcp build      # tsc -> dist/
pnpm --filter @nopeek/mcp typecheck  # type-check only

The bin entry nopeek-mcp maps to dist/index.js.