Developer Documentation & Technical Reference
Complete technical specifications, quickstart installation guides, and configuration references for integrating Neon's Model Context Protocol (MCP) servers and security gateways into your development environment.
Neon Innovation Lab Developer Documentation provides normative engineering references for deploying our 22+ Model Context Protocol (MCP) servers, zero-trust DLP proxies, and agentic infrastructure. Designed for software engineers, security architects, and CTOs, this documentation covers Stdio and SSE transports, configuration schemas, and SARIF 2.1.0 security compliance.
Architectural Specifications & Systems
Deterministic execution patterns, verified protocol compliance, and security controls built for production environments.
Claude Desktop Configuration Standard
Adding Neon zero-trust gateways and security auditors to your local Claude Desktop client via stdio.
{
"mcpServers": {
"neon-zero-trust-gateway": {
"command": "npx",
"args": ["-y", "@neon-innovation-lab/zero-trust-gateway"],
"env": {
"GATEWAY_ENFORCE_GDPR": "true",
"STRIP_API_KEYS": "true"
}
}
}
}- Config location (macOS): ~/Library/Application Support/Claude/claude_desktop_config.json
- Config location (Windows): %APPDATA%\Claude\claude_desktop_config.json
- Automatic environment variable validation and failover handling
Cursor IDE SSE Gateway Integration
Connecting Cursor IDE to cloud-multiplexed MCP servers to eliminate local context bloat and bypass tool count caps.
{
"mcp": {
"servers": [
{
"name": "neon-universal-hub",
"type": "sse",
"url": "https://neoninnovationlab.com/api/v1/mcp"
}
]
}
}- Config location: ~/.cursor/mcp.json
- Single multiplexed endpoint streaming tool definitions via Server-Sent Events
- Dynamic tool activation preserving IDE prompt token budgets
A2A Agent Card Security Scanning in CI/CD
Automating Agent2Agent manifest verification within GitHub Actions to prevent prompt injection and unauthorized capabilities.
# .github/workflows/a2a-audit.yml
- name: Audit Agent Card
run: npx -y a2a-audit scan ./.well-known/agent-card.json --sarif results.sarif- Offline Ed25519 digital signature validation
- SSRF defense against private network and cloud metadata leaks
- SARIF 2.1.0 output automatically displayed in GitHub Security tab
Environment Variables & DLP Secret Filters
Fine-tuning in-band DLP inspection policies to match your organization's specific data classification and privacy standards.
- BLOCK_DESTRUCTIVE_SQL: Intercepts unindexed DELETE, DROP, and TRUNCATE
- STRIP_API_KEYS: Redacts AWS, OpenAI, Stripe, and GitHub secret tokens
- GATEWAY_ENFORCE_GDPR: Masks emails, phone numbers, and government IDs
Integration Transport Comparison
Direct side-by-side evaluation against typical industry implementations.
| Feature | Stdio Transport (Local npx) | SSE Transport (Managed Cloud) |
|---|---|---|
| Execution Environment | Runs locally on developer machine via Node.js | Runs on high-availability cloud serverless clusters |
| Network Overhead | Zero network latency; runs via standard pipes | Sub-50ms P95 latency over encrypted HTTPS/WSS |
| Multi-Tool Multiplexing | Each server runs as an independent child process | Unified single endpoint multiplexing 50+ tools |
| Context Token Usage | Loads full schema for each active server | Dynamic tool routing saving up to 89% of tokens |
Four-Stage Engineering Pipeline
Every technical engagement follows rigorous architecture, sandboxed validation, and production rollout criteria.
Select Transport Mode
Choose between local stdio execution for offline privacy or managed SSE for team multiplexing.
Define DLP Policies
Configure environment variables for secret redaction, SQL circuit breakers, and privacy enforcement.
Test Tool Invocation
Trigger test commands in Claude or Cursor to verify tool parameter schemas and response handling.
Automate CI/CD Auditing
Incorporate static AST scanners and A2A card verifiers into pull request verification workflows.
Frequently Addressed Questions
Concrete answers covering architecture, integration protocols, security, and SLAs.
Where do I report documentation issues or suggest improvements?+
All developer documentation is maintained in our GitHub repository. Pull requests and issues are reviewed directly by our engineering principals.
What version of Node.js is required for local MCP servers?+
All Neon MCP tools require Node.js v18.0.0 or higher. Node.js v22 LTS is recommended for optimal performance.
Does the Zero-Trust Gateway log prompt contents?+
No. The gateway processes data entirely in-band and in-memory. Zero prompt text or tool outputs are logged to disk or sent to external servers in the open-source tier.
Ready to Deploy Production Architecture?
Connect with our principal engineering team in Dubai to discuss technical requirements, security boundaries, and delivery schedules.