01
Preview
Called without confirmation, which is the default, the tool shows what would change and writes nothing.
For developers and agents
NoloForWeb MCP server: technical documentation
The MCP server connects an AI assistant to the data of a rental company that uses NoloForWeb: fleet, contracts, bookings, deadlines, compliance reports and brokers. It answers at https://nolomcp.rilogi.it/mcp; the company is chosen with the company code at login, and each user sees only what they see in the rental system.
Streamable HTTP OAuth 2.1 with PKCE 52 tools, 4 writing with confirmation
Connection
Endpoint, protocol and authentication
| Item | Value |
|---|---|
| Endpoint | https://nolomcp.rilogi.it/mcp |
| Transport | Streamable HTTP with session (Mcp-Session-Id). The legacy SSE transport is not enabled. |
| Protocol versions | 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05 |
| Company | Chosen with the company code in the OAuth login, then written into the token: every call reads only that company's database. |
| Authorization | OAuth 2.1, authorization code with mandatory PKCE S256. Single scope: mcp. |
| Metadata | /.well-known/oauth-protected-resource (RFC 9728) and /.well-known/oauth-authorization-server (RFC 8414), also with the /mcp suffix. A call without a token gets 401 with WWW-Authenticate and resource_metadata. |
| Client registration | Dynamic (RFC 7591) at POST /oauth/register: public clients, no secret; redirect URIs must be https or localhost. |
| OAuth endpoints | /oauth/authorize (login with company code, username and password of the rental system) and /oauth/token (grant_type=authorization_code). |
| Token lifetime | 8 hours, no refresh token: when it expires you log in again. |
| Automated agents | Service tokens in the Authorization: Bearer header, bound to a user and with an expiry date; read only. |
| Health check | GET /health |
The token is the rental system's API token: every call goes through the same permissions as the user who logged in.
Tools
The 52 tools, by area
Each tool belongs to a themed agent; agenti_manifesto returns the current list with descriptions, which are in Italian. The server exposes tools only: no MCP prompts or resources.
| Area | Tools | Access |
|---|---|---|
| Branches | stazioni_list, stazioni_gruppi_list | Read |
| Fleet | parco_stato_flotta, parco_veicoli_list, parco_veicoli_per_categoria, parco_veicolo_dossier, modelli_list | Read |
| Vehicle deadlines | parco_scadenze_list, parco_scadenze_in_scadenza, parco_scadenze_aggregato | Read |
| Contracts | contratti_list, contratti_noleggi_attivi, contratti_dettaglio, contratti_fatturato_aggregato | Read |
| Bookings | prenotazioni_search, prenotazioni_dettaglio, prenotazioni_cancella | Read; prenotazioni_cancella writes, with confirmation |
| Online booking | booking_engine_disponibilita, booking_engine_crea_prenotazione | Read; booking_engine_crea_prenotazione writes, with confirmation |
| Calendar | calendario_veicoli, calendario_crea_bozza, calendario_riassegna_veicolo | Read; calendario_crea_bozza and calendario_riassegna_veicolo write, with confirmation |
| Competitor rates | concorrenza_tariffe_list | Read |
| Drivers | conducenti_search, conducenti_dossier | Read |
| Fines | multe_list, multe_dettaglio, multe_aggregato | Read |
| Damage reports | rds_list, rds_dettaglio, rds_aggregato | Read |
| Vehicle movements | movimenti_list, movimenti_aggregato, movimenti_transiti_tra_stazioni | Read |
| Dashboard | cruscotto_operatore_kpi, cruscotto_operatore_drilldown, cruscotto_operatore_filtri, lavoro_del_giorno | Read |
| Compliance | adempimenti_da_fare, adempimenti_contratto, cargos_comunicazioni_list, hospedajes_comunicazioni_list, noleggi_lunghi_list | Read |
| Brokers | broker_list, broker_dettaglio, broker_estratto_conto, broker_aging, broker_netto_canale, broker_riconciliazioni_list, broker_riconciliazione_dettaglio | Read |
| NPS feedback | nps_report | Read |
| Agent list | agenti_manifesto | Read |
Tools follow the user's permissions: non-admin users see only their own branches; broker statements, aging, net by channel and reconciliations need the Broker finance permission.
Writes
Four tools write, always in two steps
02
Confirmation
The assistant shows you the preview, waits for your yes and calls the tool again with confirmation on (confermato or applica = true).
03
Execution
The change goes through the rental system's official API, with your user's permissions. Service tokens of automated agents cannot write.
Clients
Connecting an assistant
01
Claude (claude.ai and desktop app)
Settings › Connectors › Add custom connector, URL https://nolomcp.rilogi.it/mcp. At login enter the company code, username and password of the rental system.
02
Claude Code
claude mcp add --transport http noloforweb https://nolomcp.rilogi.it/mcp, then log in from the /mcp command. For an automated agent, a service token in the Authorization header.
03
Other MCP clients
Any client that supports remote MCP servers over Streamable HTTP with OAuth 2.1 and dynamic registration. So far we have tested it with Claude and Claude Code.
Frequent questions
Where does the NoloForWeb MCP server answer?
At https://nolomcp.rilogi.it/mcp, the same address for every customer. The company is chosen with the company code at login and is written into the token: from then on every call reads only that company's database.
Do I need to register the client in advance?
No: the server supports dynamic client registration (RFC 7591). Clients are public, without a secret, with mandatory PKCE S256.
Can the assistant change data?
Only with four tools (cancel a booking, create one through the booking engine, create a draft or reassign a vehicle in the calendar), and always in two steps: preview, then confirmation. Contracts and invoices are never touched.
Is there a test environment?
Not public yet. Write to us from the Contact page: in a demo we connect your assistant to a company with sample data.
Want to try it on your data?
In the demo we connect your assistant and ask it the questions you ask every day at the counter.