Technical Reference

nCino Mortgage exposes two remote MCP servers over Streamable HTTP. Clients authenticate with OAuth 2.0 (authorization code + PKCE S256) and dynamic client registration. End users sign in with their nCino Mortgage account. Tokens are user-scoped; tool results follow the same permissions as the nCino Mortgage web application.

This page is the integration contract. For a click-path setup guide, see Getting Started. For tool catalogs, see Admin MCP Server and LO MCP Server.

---

Servers

If the connector is not enabled for the company, the endpoint returns 404 Not Found even with a valid token.

Transport

• Remote MCP over Streamable HTTP
• Authenticated requests send Authorization: Bearer <access_token>
• JSON-RPC payloads; maximum request body 1 MB

Unauthenticated requests, including the first initialize, return 401 Unauthorized with a WWW-Authenticate header that points at protected resource metadata. Clients should follow that header and the authorization-server metadata it leads to. Do not hardcode authorize, token, or registration URLs.

Authentication

MCP connections use OAuth 2.0 with PKCE and dynamic client registration. The user signs in and approves access in the browser. You do not create OAuth clients by hand — a compliant MCP client registers itself.

• Tokens represent the signed-in user, not a shared service account.

• MCP does not use a client_credentials grant for user connections.

• Redirect URIs are restricted. Hosted Claude and native loopback clients (for example Claude Code) are supported. Other clients should use discovery; contact nCino if a redirect URI is rejected.

Starting points for discovery:

• Protected resource metadata (RFC 9728): served from well-known URLs on each MCP server

• Authorization server metadata (RFC 8414):
  https://ncinomortgage.com/.well-known/oauth-authorization-server

  Treat those documents as the source of truth for endpoints, PKCE, and registration

Access model

• User-scoped. The token identifies the person who signed in.
• Company-scoped. Results stay inside that user’s company.
• Same permissions as the UI. If they cannot open a record in nCino Mortgage, the connector cannot return it either.
• Audited. Tool calls are logged.

Use the connector that matches the user’s role (Admin vs loan officer).

Tools and responses

• Tool names are prefixed with ncino_mortgage_ in MCP clients (list_loans → ncino_mortgage_list_loans).

• Responses are JSON and match the nCino Mortgage API resource shapes.

• List tools are paginated (page, page_size where supported).

Catalogs: Admin MCP Server, LO MCP Server.

Example prompts

Admin

• “What can this connector do?”

• “List active loan officers in my company.”

• “Get my company, then list its regions.”

LO

• “What can this connector do?”
• “Show my active loans.”
• “Get details for loan [loan number].”

Troubleshooting

Support

• Feature access: nCino Customer Success
• Permissions: the organization’s nCino Mortgage administrator
• Integration issues: nCino Mortgage support. Include the MCP URL, approximate
  time, and the client error.

Related documentation

• Getting Started
• Admin MCP Server
• LO MCP Server
• nCino Mortgage API reference
• Authentication