AI assistants (MCP)

Connect ChatGPT, Claude, Cursor or your own agent to Engage. Ask in plain language — “who wrote to us today?”, “how did the Diwali campaign do?”, “send Jane her order update” — and the assistant uses Engage on your behalf, limited to the permissions you approve and your plan.

Server URL

https://engage.swastik.ai/v1/mcp — one URL for every assistant. It uses the Model Context Protocol (MCP) over Streamable HTTP.

How it works

You choose the access. When an assistant connects, you sign in to Engage, pick the organization and tick what it may do. It can never do more than your own role allows, and if your role changes or you leave the organization, the connection shrinks or stops immediately.
Your plan applies. Tools only appear when your plan includes the feature (for example, campaign tools need Campaigns). Message quotas and API rate limits are the same as for the REST API.
WhatsApp rules apply. Free-form messages only reach people who wrote to you in the last 24 hours; otherwise the assistant must use an approved template. Marketing templates never reach opted-out contacts.
You stay in control. Assistants are instructed to show you the recipient and exact message and get your confirmation before sending or launching anything. Every action is recorded in the audit log.

Connect Claude

Works in claude.ai, Claude Desktop and the Claude mobile apps on plans that support custom connectors.

Open Settings → Connectors. On Team and Enterprise plans, an owner adds connectors in the organization settings.
Click Add custom connector, enter the name Engage and the server URL https://engage.swastik.ai/v1/mcp.
Click Connect. Sign in to Engage, choose the organization and permissions, and click Allow access.
In a chat, enable Engage from the tools menu and ask, for example: “Show my unread WhatsApp conversations.”

Connect ChatGPT

Available on ChatGPT plans that allow custom MCP apps. In Business and Enterprise workspaces an admin may need to allow custom apps first.

In ChatGPT, open Settings → Apps (in some workspaces Apps & Connectors or Plugins) and choose to add a custom MCP server.
Enter the name Engage and the server URL, and choose OAuth for authentication.
Sign in to Engage when prompted, choose the organization and permissions, and click Allow access.

Engage provides the read-only search and fetch tools that ChatGPT's deep research uses, so it can cite your contacts, templates and conversations with links back to the dashboard.

Use an API key

Tools that let you set request headers — Claude Code, Cursor, VS Code, the Claude and OpenAI APIs, your own agents — can authenticate with an Engage API key instead of signing in. The assistant then has exactly that key's permissions. Create a dedicated key with only what the assistant needs.

Connect with an API key

claude mcp add --transport http engage https://engage.swastik.ai/v1/mcp \
  --header "Authorization: Bearer $ENGAGE_API_KEY"

Keys are secrets

Claude Code can store the header per project; use the user or local scope rather than committing a key to a shared .mcp.json. Claude's API passes the key as authorization_token (with the MCP connector beta header); OpenAI's Responses API passes it as authorization.

Tools

An assistant only sees the tools its connection is allowed to use.

Tool	What it does	Needs	Kind
`get_account`	Organization, plan, this connection's permissions and your WhatsApp numbers	—	Read
`search`	Find contacts, templates and conversations (also powers ChatGPT deep research)	any read permission	Read
`fetch`	Full record for a search result	any read permission	Read
`list_templates`	Templates with status, category and text	templates:read or messages:send	Read
`create_template`	Create a template and submit it to Meta	templates:write	Write
`send_message`	Send text, a template or media to one person	messages:send	Sends
`get_message`	Delivery status of a message	messages:send or inbox:read_all	Read
`search_contacts`	List or search contacts	contacts:read	Read
`create_contact / update_contact`	Add or edit contacts, tags, attributes, opt-in	contacts:write	Write
`list_audiences`	Tags, lists and segments with their ids	contacts:read	Read
`list_conversations`	Inbox conversations and unread counts	inbox:read_all	Read
`get_conversation_messages`	Read a conversation's history	inbox:read_all	Read
`reply_to_conversation`	Reply inside an open 24-hour window	inbox:reply	Sends
`update_conversation`	Resolve, snooze, reopen or assign	inbox:reply or inbox:assign	Write
`list_campaigns / get_campaign_report`	Campaigns and their delivery funnel	campaigns:read + Campaigns in plan	Read
`estimate_campaign`	Audience size, exclusions and indicative cost	campaigns:read	Read
`create_campaign`	Create a campaign as a draft (nothing is sent)	campaigns:write	Write
`control_campaign`	Launch, pause, resume or cancel a campaign	campaigns:launch	Sends
`get_analytics`	Totals, rates, daily series and estimated cost	analytics:read	Read

Permissions and plans

Connections use the same permissions as API keys. On the consent screen, read permissions are ticked by default; sensitive ones — launching campaigns, exporting or importing contacts, managing webhooks and keys — stay off unless the app asks for them or you tick them.

The MCP server is included in every plan, including the free trial. Platform administrators can switch it off per plan or per organization.
Rate limits follow your plan's per-key limit (each connection is its own key). A 429 tells the assistant how long to wait.
If an organization requires two-factor authentication, turn it on before connecting.

Manage connections

See every connected assistant in Developers → AI assistants: which app, who connected it, its permissions and when it was last used. Click Disconnect to revoke it instantly. Members see their own connections; people with developers:manage see everyone's.

Security

OAuth 2.1 with PKCE (S256), exact redirect matching and a consent screen that names the app and where it will return. Apps identified by a client metadata document show a verified domain.
Access tokens last one hour and only work on the MCP server — never on the REST API. Refresh tokens rotate on every use; if an old one is replayed, the whole connection is revoked.
Tokens are stored only as hashes. Disconnecting, removing a member, or deleting the organization stops access immediately.
The server is stateless and validates the Origin header; requests are limited to 1 MB and tool calls time out after 25 seconds.

Troubleshooting

Problem	What to do
The assistant says a tool needs a permission	Disconnect it and connect again, ticking that permission — or use an API key that has it.
“isn't included in this organization's plan”	An owner can upgrade in Settings → Billing, or ask support to enable it.
Messages are refused outside 24 hours	WhatsApp only allows approved templates then. Ask the assistant to send a template instead.
“Turn on two-factor authentication first”	Enable 2FA in Settings → Security, then connect again.
Connected, but no tools appear	Check the connection's permissions in Developers → AI assistants; a connection with no usable permission has no tools.
Claude Code shows an auth error with an API key	A manually set Authorization header turns off sign-in; check the key is active and starts with egk_live_ or egk_test_.

Technical reference

EndpointsKey permission

POST/v1/mcpJSON-RPC over Streamable HTTP (application/json responses)
GET/.well-known/oauth-protected-resource/v1/mcpProtected resource metadata (RFC 9728)
GET/.well-known/oauth-authorization-serverAuthorization server metadata (RFC 8414)
POST/v1/oauth/registerDynamic client registration (RFC 7591)
POST/v1/oauth/tokenAuthorization code (PKCE) and refresh token grants
POST/v1/oauth/revokeToken revocation (RFC 7009)

Protocol

Protocol versions 2026-07-28, 2025-11-25, 2025-06-18 and 2025-03-26. Older clients use initialize; newer ones send per-request metadata and may call server/discover.
Stateless: no Mcp-Session-Id, no server-to-client streams. GET returns 405.
Clients register with a Client ID Metadata Document (an https client_id) or dynamic registration. Public clients only (token_endpoint_auth_method: none).
An unauthenticated request returns 401 with WWW-Authenticate: Bearer resource_metadata="…" so clients can discover the authorization server.

Check the server

Shell

curl -s https://engage.swastik.ai/v1/mcp \
  -H "Authorization: Bearer $ENGAGE_API_KEY" \
  -H "Content-Type: application/json" \
  -H "MCP-Protocol-Version: 2025-11-25" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Something unclear or missing on this page? Tell us at contact@swastik.ai