**FastAF is a remote MCP server at `https://api.fastaf.co/mcp` (Streamable HTTP, POST only).** Any client can connect and list its tools without credentials; running a tool needs your FastAF API key, sent as `Authorization: Bearer <key>`, or an OAuth sign-in. The commands below were checked against the official Claude Code, Codex and Cursor documentation on 28 October 2026.

> **For AI agents:** add the server `https://api.fastaf.co/mcp` with the header `Authorization: Bearer $FASTAF_API_KEY`. `initialize` and `tools/list` work without a key; `tools/call` without one returns HTTP 401. x402 is not accepted on `/mcp`: for keyless pay-per-call use the REST routes under `https://api.fastaf.co/x402/v1/`.

## 1\. Get a FastAF API key into FASTAF\_API\_KEY

[Register with FastAF](/signup/). Your first API key arrives by email together with the confirmation link; confirm the email before the first tool call. FastAF stores only a hash of the key, so save it when it arrives. Keys start with `faf_live_`. Additional or replacement keys are created in the [dashboard](/dashboard/) and shown once.

Each account gets 500 free credits every month after email confirmation, shared between REST and MCP and between all its keys. They reset to 500 at 00:00 UTC on the 1st of each month and unused free credits do not carry over. Tool calls spend the free credits first and, once those run out, prepaid credits from the same balance as the REST API.

Keep the key out of prompts, URLs and repositories. All three clients below can read it from an environment variable, so load it once in the shell that starts the client:

```
export FASTAF_API_KEY="$(tr -d '\r\n' < "$HOME/.secrets/fastaf_key")"
```

Do not echo the variable or paste the key into the configuration files below: each one stores a reference to `FASTAF_API_KEY`, not its value.

## 2\. Add FastAF to Claude Code

```
claude mcp add --transport http --scope user fastaf https://api.fastaf.co/mcp \
  --header 'Authorization: Bearer ${FASTAF_API_KEY}'
claude mcp list
```

The single quotes keep `${FASTAF_API_KEY}` as a literal reference; Claude Code expands it when it connects. `--scope user` makes the server available in every project; leave it out for the default `local` scope (current project only), or use `--scope project` to write a shared `.mcp.json`:

```
{
  "mcpServers": {
    "fastaf": {
      "type": "http",
      "url": "https://api.fastaf.co/mcp",
      "headers": { "Authorization": "Bearer ${FASTAF_API_KEY}" }
    }
  }
}
```

Use a variable name of your own such as `FASTAF_API_KEY`: Claude Code deliberately reads its own credential variables (for example `ANTHROPIC_API_KEY`) as empty in a remote server’s headers. Inside Claude Code, `/mcp` shows the server status. Source: [Claude Code MCP documentation](https://code.claude.com/docs/en/mcp). For user scope versus a shared project `.mcp.json`, see [FastAF for Claude Code](/integrations/claude-code/).

## 3\. Add FastAF to Codex

```
codex mcp add fastaf --url https://api.fastaf.co/mcp \
  --bearer-token-env-var FASTAF_API_KEY
codex mcp list
```

The same server written by hand in `~/.codex/config.toml`:

```
[mcp_servers.fastaf]
url = "https://api.fastaf.co/mcp"
bearer_token_env_var = "FASTAF_API_KEY"
```

`bearer_token_env_var` takes the **name** of the variable; Codex adds `Bearer` and sends the header. Start Codex from a shell where the variable is set, then type `/mcp` to see the FastAF tools. Sources: [Codex MCP documentation](https://learn.chatgpt.com/docs/extend/mcp), [configuration reference](https://learn.chatgpt.com/docs/config-file/config-reference) and [command-line options](https://learn.chatgpt.com/docs/developer-commands?surface=cli).

## 4\. Add FastAF to Cursor

Cursor reads `~/.cursor/mcp.json` for servers available in every project, and `.cursor/mcp.json` inside a project for that project only:

```
{
  "mcpServers": {
    "fastaf": {
      "url": "https://api.fastaf.co/mcp",
      "headers": { "Authorization": "Bearer ${env:FASTAF_API_KEY}" }
    }
  }
}
```

Cursor resolves `${env:NAME}` in `url` and `headers`. Remote servers do not support `envFile`, so the variable has to be in the environment Cursor starts from (your shell profile or system environment). The Cursor CLI uses the same file: `agent mcp list` and `agent mcp list-tools fastaf` check the connection. Sources: [Cursor MCP documentation](https://cursor.com/docs/mcp) and [Cursor CLI MCP](https://cursor.com/docs/cli/mcp). The full Cursor setup, with project and global files, is on [FastAF for Cursor](/integrations/cursor/).

## 5\. Try an example prompt

Once the server shows as connected, ask the agent something that needs live data:

```
Use the FastAF google_search tool to find the top 5 results for
"standing desk under $300" in the US. List title, URL and snippet,
then tell me how many credits the call used.
```

The agent calls `google_search` with arguments like `{"query": "standing desk under $300", "country": "us", "results": 5}`. The tool returns `results` (each with `title`, `url`, `snippet`, `position`) plus `credits_used` and `credits_remaining`. A Google search costs 5 credits, so the 500 free monthly credits cover about 100 searches. The other tools (Amazon, Maps, News, YouTube, scrape and more) are listed by `tools/list` and on the [APIs page](/apis/). If the agent needs only a few of them, see [too many MCP tools?](/how-to/mcp-tool-schema-bloat/).

## How authentication works on /mcp

What the server does, read from its code:

Request

Without credentials

With a valid key or OAuth token

`initialize`, `tools/list`, `ping`, `resources/list`, `prompts/list`

200, public

200 (credentials are ignored)

`tools/call` and every other method

401, `WWW-Authenticate: Bearer resource_metadata=...`

Runs and spends credits (free monthly credits first)

GET, DELETE or any method other than POST and OPTIONS

405, `Allow: POST, OPTIONS`

405

*   **API key:** `Authorization: Bearer faf_live_...` or `X-API-Key: faf_live_...`. When both are present, `Authorization` wins and an invalid Bearer value does not fall back to `X-API-Key`. Write `Bearer` with a capital B.
*   **OAuth:** a Bearer value that is not an API key is checked as an OAuth access token for `/mcp`. The metadata is public at `https://api.fastaf.co/.well-known/oauth-protected-resource`; the consent page asks you to paste an existing FastAF API key, so you still need an account. The setups above send the key directly and skip OAuth.
*   **OAuth metadata:** the protected-resource metadata is published at both `https://api.fastaf.co/.well-known/oauth-protected-resource` and `.../oauth-protected-resource/mcp` ([RFC 9728](https://www.rfc-editor.org/rfc/rfc9728.html)). The authorization server metadata at `https://api.fastaf.co/.well-known/oauth-authorization-server` advertises PKCE (S256), dynamic client registration, client ID metadata documents, refresh and revocation. The key you paste at consent is checked by FastAF and never handed to the client; revoking it in the dashboard disables every OAuth connection made with it. Whether a client starts OAuth by itself after a 401 depends on the client: use its explicit login command if it does not.
*   **x402:** not accepted on `/mcp`. Keyless pay-per-call is the REST mirror, `GET https://api.fastaf.co/x402/v1/serp` from $0.003 per call. See [x402 in the docs](/docs/#x402).
*   **Unverified email:** tool calls return an error until the account email is confirmed; nothing is charged.

## Install the FastAF agent skill

FastAF also publishes an agent skill, listed on skills.sh as [fastaf-web-data](https://skills.sh/fastaf-co/fastaf-skills/fastaf-web-data) (checked 28 October 2026). It tells an agent which endpoint fits which task and points it at the same MCP server:

```
npx skills add https://github.com/fastaf-co/fastaf-skills --skill fastaf-web-data
```

## FAQ

### Why does tools/list work but every tool call returns 401?

Discovery is public on purpose. A 401 on `tools/call` means the client sent no key, an empty one or a wrong one: check that the process that started the client can read a nonempty `FASTAF_API_KEY`, and that the header is `Authorization: Bearer <key>`. If both `Authorization` and `X-API-Key` are set, `Authorization` wins, and a revoked key is not repaired by discovery: create a replacement in the [dashboard](/dashboard/).

### Does connecting spend credits?

No. `initialize`, `tools/list` and the other discovery methods are free and do not use credits. Only a tool call that returns data spends credits (free monthly credits first); a failed call is refunded.

### Can an agent pay per call over MCP without an account?

No. MCP tool calls need an API key or OAuth. An agent without an account can pay per call with x402 on the REST routes, from $0.003 per call in USDC on Base.

### Is there a local or npm MCP server to install?

You do not need one: all three clients connect to the hosted server over HTTP. Nothing runs on your machine besides the client.

## Reference

*   [MCP server documentation](/docs/#mcp): every parameter and response field
*   [Docs](/docs/): authentication, errors, MCP and [x402](/docs/#x402)
*   [Pricing](/pricing/): credit packs from $10, without expiry

## Other sources

*   [How to read public Amazon data when your requests fail](/how-to/read-amazon-data/)
*   [How to read public Google Search data when your requests fail](/how-to/read-google-data/)
*   [How to read public Walmart data when your requests fail](/how-to/read-walmart-data/)
*   [How to read LinkedIn data with an API](/how-to/read-linkedin-data/)
*   [How to read public eBay data when your requests fail](/how-to/read-ebay-data/)
*   [How to read public Booking.com data when your requests fail](/how-to/read-booking-data/)
*   [How to read X profile data with an API](/how-to/read-x-data/)
*   [How to read public Zillow data when your requests fail](/how-to/read-zillow-data/)
*   [Pay-per-call web scraping for AI agents with x402](/how-to/x402-pay-per-call-web-scraping/)
*   [MCP servers for Amazon, SERP and web scraping](/how-to/best-mcp-servers-amazon-serp-scraping/)
*   [Cost per agent: monthly SaaS vs x402 pay-per-call](/how-to/cost-per-agent-saas-vs-x402/)
*   [How FastAF handles heavy pages and timeouts](/how-to/heavy-pages-timeouts/)
*   [x402 endpoint discovery checklist: how agents find a paid API (and how FastAF passes it)](/how-to/x402-discovery-checklist/)
*   [How to detect poisoned or incomplete SERP results in AI agents](/how-to/detect-poisoned-incomplete-serp-results/)
*   [Cap agent spend per call with fixed x402 prices](/how-to/agent-spend-caps-per-call-pricing/)
*   [Use FastAF from the Cloudflare Agents SDK](/how-to/fastaf-cloudflare-agents-sdk/)
*   [FastAF as a fallback search provider](/how-to/search-api-fallback-provider/)
*   [Budget a scraping job before you run it](/how-to/budget-scraping-job-fixed-prices/)
*   [Try FastAF for free, no card](/how-to/free-search-api-for-agents/)
*   [Too many MCP tools? Keep agent context small](/how-to/mcp-tool-schema-bloat/)
*   [How agents find an API (and where FastAF is)](/how-to/agent-discovery-files/)
*   [Why agent retries cost more than you think](/how-to/agent-tool-retry-cost/)
*   [All how-to guides](/how-to/)

## Compare

*   [FastAF vs SerpApi](/compare/serpapi/)
*   [FastAF vs Exa](/compare/exa/)
*   [FastAF vs Tavily](/compare/tavily/)
*   [FastAF vs Firecrawl](/compare/firecrawl/)
*   [FastAF vs Apify](/compare/apify/)
*   [FastAF vs toll402](/compare/toll402/)
*   [FastAF vs serp402](/compare/serp402/)
*   [FastAF vs AgentBIT](/compare/agentbit/)
*   [FastAF vs Amazon PA-API](/compare/amazon-pa-api/)
*   [FastAF vs Serper](/compare/serper/)
*   [FastAF vs ScrapingBee](/compare/scrapingbee/)
*   [FastAF vs ScraperAPI](/vs/scraperapi/)
*   [FastAF vs Bright Data](/vs/bright-data/)
*   [Benchmarks](/benchmarks/): latency and cost per 1,000 requests, measured

## Try it on your own request

500 free credits every month after email verification, no card.

[Start free](/signup/)[MCP server documentation](/docs/#mcp)

## Related

*   [MCP](/glossary/mcp/)
*   [How to read public Amazon data when your requests fail](/how-to/read-amazon-data/)
*   [How to read public Google Search data when your requests fail](/how-to/read-google-data/)