MCP Quickstart

Connect an MCP client to NexumAPI.

NexumAPI can expose a protected Model Context Protocol server for agent-based SymXchange workflows. The MCP server lets an AI client discover the NaaS environment, inspect available SymXchange services, and call approved tools without hand-crafting raw REST requests.

Use the standard Quickstart when you want to call NexumAPI directly over REST. Use this guide when you want an MCP-compatible client or agent to call NexumAPI tools for you.

Get access

Email [e-mail] to request MCP access. Include your credit union, NaaS environment, and agent use case.

We'll work with you to define which services and operations the agent can use. See MCP Policies for policy options and examples.

You'll need these values:

• NEXUM_BASE_URL - your NaaS base URL, such as https://naas.ymcu.libum.io

• NEXUM_API_KEY - your NexumAPI bearer token

• SymXchange credentials for the tools you want to call

Do not put API keys or SymXchange passwords in prompts. Configure them as MCP client secrets, environment variables, an MCP HTTP header, or a secure tool argument supplied by your application.

Connect your MCP client

The MCP endpoint is hosted at:

https://your-naas-host/mcp/

Every MCP request must include your NexumAPI bearer token:

Authorization: Bearer NEXUM_API_KEY

Clients that support remote HTTP MCP servers can point directly at the MCP URL and attach the authorization header. Adapt the exact configuration shape to your client:

{
  "mcpServers": {
    "nexumapi": {
      "type": "http",
      "url": "https://naas.ymcu.libum.io/mcp/",
      "headers": {
        "Authorization": "Bearer ${NEXUM_API_KEY}"
      }
    }
  }
}

If your client only supports local command or stdio MCP servers, use your client's preferred remote-MCP bridge and configure the same URL and authorization header through that bridge.

Add SymXchange credentials

SymXchange credentials are separate from the NexumAPI bearer token. MCP tools that call SymXchange accept credentials in either of these places:

• X-NaaS-SymX-Credentials HTTP header

• The tool's credentials argument

The credential value should be one selected SymXchange credential shape. Do not include a top-level Credentials object inside the tool's request body.

For example, an administrative credential header would contain this JSON value:

{
  "AdministrativeCredentials": {
    "Password": "suwn37834b91&"
  }
}

The same credential can be supplied as a tool argument:

{
  "credentials": {
    "AdministrativeCredentials": {
      "Password": "suwn37834b91&"
    }
  }
}

See Credentials for the supported SymXchange credential types.

Discover the environment

Start with discovery tools before asking an agent to read or change SymXchange data.

1. Call list_capabilities to confirm the configured Syms and available MCP tools.

2. Call list_supported_services or list_symx_services to inspect the exposed SymXchange services, versions, and record types.

3. Call describe_operation before a new workflow to confirm the exact request fields and available read variants.

Typical discovery results include tools such as:

• get_naas_health, keep_naas_alive, list_host_configs, and get_connection_status

• get_record, list_records, search_records, and find_accounts

• run_poweron, post_transaction, reverse_transaction, and transaction_lookup

• Domain tools for user management, ECAA authentication, file upload/download, batch jobs, balancing, credit reports, cash machines, and check verification when those services are enabled

Make your first read

After discovery, make a narrow read request. This example reads a single Account record from the Account service:

{
  "service": "account",
  "record_type": "Account",
  "sym": "627",
  "version": "2022.01",
  "request": {
    "AccountNumber": "0000013824"
  },
  "fields": {
    "IncludeAllAccountFields": false,
    "AccountFields": {
      "Number": true,
      "Type": true,
      "OpenDate": true,
      "CloseDate": true
    }
  },
  "credentials": {
    "AdministrativeCredentials": {
      "Password": "suwn37834b91&"
    }
  }
}

Use fields or the operation's selectable-fields object when you only need a subset of a record. Narrow reads keep agent responses easier to inspect and reduce accidental exposure of unnecessary member data.

Use find_accounts before get_record for broad account lookups by last name, SSN, MICR, card, lookup value, or home banking user. Use the returned account numbers with get_record for follow-up reads.

Write tools

Write tools are disabled by default and must be explicitly allowed by your MCP policy. If writes are enabled, call describe_operation before using a new write workflow.

Troubleshooting

Problem	Check
The MCP server does not connect	Confirm the URL ends in /mcp/ and the client sends Authorization: Bearer ....
Discovery tools are missing services	Confirm the service and version are enabled for the NaaS deployment. MCP honors the same configured service exposure as the REST API.
A read tool reports missing credentials	Supply one SymXchange credential through X-NaaS-SymX-Credentials or the tool's credentials argument.
A write tool is not available	Ask Libum to confirm MCP write access is enabled for the deployment. Write tools only register when explicitly allowed.
A request field is rejected	Use describe_operation to inspect the expected schema for that service, record type, version, and operation.

Next steps

• Use Capabilities for a broader MCP feature overview.

• Use MCP Policies to define the services, operations, credentials, and identities an agent can use.

• Use NaaS Endpoints to compare MCP utility tools with direct REST utility endpoints.

• Use the SymXchange API reference when you need the underlying REST operation shape.