Navis Ops MCP Server reference

The Navis Ops MCP server lets AI assistants read and write your workspace data using the Model Context Protocol. It implements the MCP specification version 2025-06-18 over Streamable HTTP transport, and supports both API key and OAuth 2.1 authentication. Everything the server exposes — tools, resources, and prompts — is scoped to the authenticated user via row-level security. No cross-user data access is possible.

Base URL

https://<your-supabase-project>.supabase.co/functions/v1/mcp-server-v2

Replace <your-supabase-project> with your Supabase project reference. You can find the full URL in Settings → Connected Apps when you create an API key or connect an OAuth client.

Authentication

Pass your API key or OAuth access token as a bearer credential in the Authorization header on every request:

Authorization: Bearer nops_your_api_key_here

For OAuth access tokens, the format is the same — replace the value with your OAuth token. If authentication fails, the server returns 401 Unauthorized with a WWW-Authenticate header pointing at the discovery document. See the authentication overview for details on both methods.

What the server exposes

Category	Count	Details
Tools	52	Across 12 domains — see Tools reference
Resources	5	4 static + 1 templated — see Resources reference
Prompts	4	Named prompt templates — see Prompts reference

Request format

The MCP server uses JSON-RPC 2.0. Every request is an HTTP POST with a Content-Type: application/json body:

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/list",
  "params": {}
}

The server also accepts Accept: text/event-stream to receive responses as Server-Sent Events (SSE). Most MCP clients handle this negotiation automatically.

Supported JSON-RPC methods

Method	Description
`initialize`	Start a session. Allowed before authentication.
`tools/list`	List all available tools.
`tools/call`	Call a specific tool by name.
`resources/list`	List all static resources.
`resources/read`	Fetch a resource by URI.
`resources/templates/list`	List URI templates for templated resources.
`prompts/list`	List all named prompt templates.
`prompts/get`	Fetch a rendered prompt by name.
`ping`	Check that the connection is alive.

Session management

The server maintains DB-backed sessions. After a successful initialize call, the server returns a Mcp-Session-Id header. Include this header in subsequent requests. Sessions idle out after one hour.

curl https://<your-supabase-project>.supabase.co/functions/v1/mcp-server-v2 \
  -H "Authorization: Bearer nops_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2025-06-18",
      "capabilities": {},
      "clientInfo": {
        "name": "my-client",
        "version": "1.0.0"
      }
    }
  }'

Most MCP client libraries handle session initialization automatically.

Data scoping and security

All tools and resources are scoped to the authenticated user. The server enforces row-level security on every database query — there is no way for an AI assistant to read or modify another user’s data, even if it tries. The only access control knob available is scope: mcp:read grants every read tool, and mcp:write grants reads plus all write tools. There is no per-tool ACL.

Next steps

Tools

All 52 tools organized by domain with scope requirements.

Resources

5 read-only resources for workspace overview, projects, tasks, and calendar.

Prompts

4 named prompt templates for planning, standups, and retrospectives.

​Base URL

​Authentication

​What the server exposes

​Request format

​Supported JSON-RPC methods

​Session management

​Data scoping and security

​Next steps