Setup

Once you have a Personal Access Token (PAT), connecting an AI client to Waafir is a matter of adding each server you want to your client's MCP configuration and supplying the token. This page gives the connection URLs and ready-to-paste configuration for Claude Desktop and Cursor.

Connection URLs

Each Waafir MCP server has its own URL — the server name is part of the path. Point your client at the specific server you want:

Replace https://app.waafir.io with your Waafir base URL if you are on a different deployment. There is no bare /api/mcp endpoint — the server name segment is required, and a request without it returns a 404. Add one configuration entry per server you intend to use; you do not have to add all of them. Note waafir-esign is a paid offering — without the E-Signatures add-on or an active subscription its URL answers with an ADDON_NOT_PURCHASED error.

Authentication

Every request carries your PAT as a bearer token in the Authorization header:

Authorization: Bearer waafir_pat_...

How you supply that depends on the client, as shown below. Never commit a real token to a shared file or repository — treat it like a password.

Claude Desktop

Add an mcpServers entry per server to your Claude Desktop configuration, passing the token in the Authorization header. Connecting all three servers looks like this:

{
  "mcpServers": {
    "waafir-dataroom": {
      "url": "https://app.waafir.io/api/mcp/waafir-dataroom",
      "headers": {
        "Authorization": "Bearer YOUR_WAAFIR_PAT"
      }
    },
    "waafir-redact": {
      "url": "https://app.waafir.io/api/mcp/waafir-redact",
      "headers": {
        "Authorization": "Bearer YOUR_WAAFIR_PAT"
      }
    },
    "waafir-translate": {
      "url": "https://app.waafir.io/api/mcp/waafir-translate",
      "headers": {
        "Authorization": "Bearer YOUR_WAAFIR_PAT"
      }
    }
  }
}

Replace YOUR_WAAFIR_PAT with the token you copied at issuance. Keep only the servers you need. Add-ons → Connect generates a copy-ready snippet for you when you issue a token.

Cursor

Cursor takes the token from an environment variable rather than a literal header. Add an mcpServers entry per server with the token under env:

{
  "mcpServers": {
    "waafir-dataroom": {
      "url": "https://app.waafir.io/api/mcp/waafir-dataroom",
      "env": {
        "WAAFIR_PAT": "YOUR_WAAFIR_PAT"
      }
    }
  }
}

Add the waafir-redact and waafir-translate entries the same way, changing only the server name in the URL.

Calling a tool

After connecting, your client lists the server's tools (an MCP tools/list) and calls them on your behalf. You do not call tools by hand — you ask the AI client to do something ("list the files in this data room", "translate this paragraph into French") and it selects and calls the right tool, passing the arguments documented in each server's reference. See the waafir-redact, waafir-translate, waafir-dataroom, and waafir-esign references for the tool contracts.

When something goes wrong

A request that cannot be served returns a JSON-RPC-shaped error with an HTTP status. The ones you are most likely to see:

• 404 — Unknown MCP server. The URL's server-name segment is not one of waafir-redact, waafir-translate, waafir-dataroom, or waafir-esign — most often a typo or a bare /api/mcp with no server name. Fix the URL.
• 402 — Add-on not purchased. The server is a paid offering (today: waafir-esign) and your organisation holds neither the add-on nor an active subscription. An org admin can purchase the add-on or a plan from the billing settings.
• 401 — Unauthenticated. The PAT is missing, malformed, revoked, or expired. Check that the Authorization header is present and that the token is still active in Add-ons → Connect; issue a fresh one if it has been revoked or has expired.
• 403 — Forbidden. The credential is valid but not permitted for what was attempted. The common causes: a logged-in browser session was used instead of a PAT (sessions are not accepted here); the token's scope is too low for the tool (for example a read token calling a write tool); or the token is restricted to specific data rooms and the call referenced one outside its allow-list. Issue a token with the right scope or data-room access.

A clear 4xx is the expected, safe outcome of an unauthorized call — Waafir fails the request rather than silently doing less than you asked.