Dashboard
EN
Start free
Updated

Add FastAF to Claude Code, Codex and Cursor

FastAF is a remote MCP server at https://api.fastaf.co/mcp (Streamable HTTP, POST only). Any client can connect and list its tools without credentials; running a tool needs your FastAF API key, sent as Authorization: Bearer <key>, or an OAuth sign-in. The commands below were checked against the official Claude Code, Codex and Cursor documentation on 28 October 2026.

For AI agents: add the server https://api.fastaf.co/mcp with the header Authorization: Bearer $FASTAF_API_KEY. initialize and tools/list work without a key; tools/call without one returns HTTP 401. x402 is not accepted on /mcp: for keyless pay-per-call use the REST routes under https://api.fastaf.co/x402/v1/.

1. Get a FastAF API key into FASTAF_API_KEY

Register with FastAF. Your first API key arrives by email together with the confirmation link; confirm the email before the first tool call. FastAF stores only a hash of the key, so save it when it arrives. Keys start with faf_live_. Additional or replacement keys are created in the dashboard and shown once.

Each account gets 500 free credits every month after email confirmation, shared between REST and MCP and between all its keys. They reset to 500 at 00:00 UTC on the 1st of each month and unused free credits do not carry over. Tool calls spend the free credits first and, once those run out, prepaid credits from the same balance as the REST API.

Keep the key out of prompts, URLs and repositories. All three clients below can read it from an environment variable, so load it once in the shell that starts the client:

export FASTAF_API_KEY="$(tr -d '\r\n' < "$HOME/.secrets/fastaf_key")"

Do not echo the variable or paste the key into the configuration files below: each one stores a reference to FASTAF_API_KEY, not its value.

2. Add FastAF to Claude Code

claude mcp add --transport http --scope user fastaf https://api.fastaf.co/mcp \
  --header 'Authorization: Bearer ${FASTAF_API_KEY}'
claude mcp list

The single quotes keep ${FASTAF_API_KEY} as a literal reference; Claude Code expands it when it connects. --scope user makes the server available in every project; leave it out for the default local scope (current project only), or use --scope project to write a shared .mcp.json:

{
  "mcpServers": {
    "fastaf": {
      "type": "http",
      "url": "https://api.fastaf.co/mcp",
      "headers": { "Authorization": "Bearer ${FASTAF_API_KEY}" }
    }
  }
}

Use a variable name of your own such as FASTAF_API_KEY: Claude Code deliberately reads its own credential variables (for example ANTHROPIC_API_KEY) as empty in a remote server’s headers. Inside Claude Code, /mcp shows the server status. Source: Claude Code MCP documentation. For user scope versus a shared project .mcp.json, see FastAF for Claude Code.

3. Add FastAF to Codex

codex mcp add fastaf --url https://api.fastaf.co/mcp \
  --bearer-token-env-var FASTAF_API_KEY
codex mcp list

The same server written by hand in ~/.codex/config.toml:

[mcp_servers.fastaf]
url = "https://api.fastaf.co/mcp"
bearer_token_env_var = "FASTAF_API_KEY"

bearer_token_env_var takes the name of the variable; Codex adds Bearer and sends the header. Start Codex from a shell where the variable is set, then type /mcp to see the FastAF tools. Sources: Codex MCP documentation, configuration reference and command-line options.

4. Add FastAF to Cursor

Cursor reads ~/.cursor/mcp.json for servers available in every project, and .cursor/mcp.json inside a project for that project only:

{
  "mcpServers": {
    "fastaf": {
      "url": "https://api.fastaf.co/mcp",
      "headers": { "Authorization": "Bearer ${env:FASTAF_API_KEY}" }
    }
  }
}

Cursor resolves ${env:NAME} in url and headers. Remote servers do not support envFile, so the variable has to be in the environment Cursor starts from (your shell profile or system environment). The Cursor CLI uses the same file: agent mcp list and agent mcp list-tools fastaf check the connection. Sources: Cursor MCP documentation and Cursor CLI MCP. The full Cursor setup, with project and global files, is on FastAF for Cursor.

5. Try an example prompt

Once the server shows as connected, ask the agent something that needs live data:

Use the FastAF google_search tool to find the top 5 results for
"standing desk under $300" in the US. List title, URL and snippet,
then tell me how many credits the call used.

The agent calls google_search with arguments like {"query": "standing desk under $300", "country": "us", "results": 5}. The tool returns results (each with title, url, snippet, position) plus credits_used and credits_remaining. A Google search costs 5 credits, so the 500 free monthly credits cover about 100 searches. The other tools (Amazon, Maps, News, YouTube, scrape and more) are listed by tools/list and on the APIs page. If the agent needs only a few of them, see too many MCP tools?.

How authentication works on /mcp

What the server does, read from its code:

Request Without credentials With a valid key or OAuth token
initialize, tools/list, ping, resources/list, prompts/list 200, public 200 (credentials are ignored)
tools/call and every other method 401, WWW-Authenticate: Bearer resource_metadata=... Runs and spends credits (free monthly credits first)
GET, DELETE or any method other than POST and OPTIONS 405, Allow: POST, OPTIONS 405
  • API key: Authorization: Bearer faf_live_... or X-API-Key: faf_live_.... When both are present, Authorization wins and an invalid Bearer value does not fall back to X-API-Key. Write Bearer with a capital B.
  • OAuth: a Bearer value that is not an API key is checked as an OAuth access token for /mcp. The metadata is public at https://api.fastaf.co/.well-known/oauth-protected-resource; the consent page asks you to paste an existing FastAF API key, so you still need an account. The setups above send the key directly and skip OAuth.
  • OAuth metadata: the protected-resource metadata is published at both https://api.fastaf.co/.well-known/oauth-protected-resource and .../oauth-protected-resource/mcp (RFC 9728). The authorization server metadata at https://api.fastaf.co/.well-known/oauth-authorization-server advertises PKCE (S256), dynamic client registration, client ID metadata documents, refresh and revocation. The key you paste at consent is checked by FastAF and never handed to the client; revoking it in the dashboard disables every OAuth connection made with it. Whether a client starts OAuth by itself after a 401 depends on the client: use its explicit login command if it does not.
  • x402: not accepted on /mcp. Keyless pay-per-call is the REST mirror, GET https://api.fastaf.co/x402/v1/serp from $0.003 per call. See x402 in the docs.
  • Unverified email: tool calls return an error until the account email is confirmed; nothing is charged.

Install the FastAF agent skill

FastAF also publishes an agent skill, listed on skills.sh as fastaf-web-data (checked 28 October 2026). It tells an agent which endpoint fits which task and points it at the same MCP server:

npx skills add https://github.com/fastaf-co/fastaf-skills --skill fastaf-web-data

FAQ

Why does tools/list work but every tool call returns 401?

Discovery is public on purpose. A 401 on tools/call means the client sent no key, an empty one or a wrong one: check that the process that started the client can read a nonempty FASTAF_API_KEY, and that the header is Authorization: Bearer <key>. If both Authorization and X-API-Key are set, Authorization wins, and a revoked key is not repaired by discovery: create a replacement in the dashboard.

Does connecting spend credits?

No. initialize, tools/list and the other discovery methods are free and do not use credits. Only a tool call that returns data spends credits (free monthly credits first); a failed call is refunded.

Can an agent pay per call over MCP without an account?

No. MCP tool calls need an API key or OAuth. An agent without an account can pay per call with x402 on the REST routes, from $0.003 per call in USDC on Base.

Is there a local or npm MCP server to install?

You do not need one: all three clients connect to the hosted server over HTTP. Nothing runs on your machine besides the client.

Reference

Other sources

Compare

Related