WhatsApp in Cursor: mcp.json, environment variables and the ZapZap OpenAPI

Step by step

1. 1

   Keep the keys in environment variables

   In the dashboard, Settings > API, copy the API Key and API Secret and export them as ZAPZAP_API_KEY and ZAPZAP_API_SECRET in the environment where Cursor starts. The config file will reference the variable name, not the value.

2. 2

   Build the MCP server

   git clone https://github.com/zapzapapi/zapzap-mcp.git, then npm install and npm run build (Node.js 18 or newer). The repository README mentions npx -y zapzap-mcp, but on 2026-11-11 the package is not yet published on npm (the registry returns 404). The route that works today is to clone, build and point the command at dist/src/index.js.

3. 3

   Create mcp.json in the project or in your account

   According to Cursor's documentation (read on 2026-11-11), .cursor/mcp.json applies to the project and ~/.cursor/mcp.json applies everywhere. The format is mcpServers with command, args and env. Prefer the global file so the key does not land in a shared repository.

4. 4

   Use interpolation instead of writing the key

   Cursor resolves ${env:NAME} in command, args, env, url and headers (documentation read on 2026-11-11). Write "ZAPZAP_API_KEY": "${env:ZAPZAP_API_KEY}" and the value never appears in the file. Start with ZAPZAP_READ_ONLY=true.

5. 5

   See the tools and approve each use

   The tools appear under Available Tools and Cursor asks for approval before using an MCP tool by default, with expandable arguments and responses in the chat. Ask: list my instances and the status of each one.

6. 6

   Give the agent the OpenAPI and llms.txt

   To generate code, add https://zapzapapi.com/openapi/zapzap-openapi.en.json and https://zapzapapi.com/llms.txt to the project docs, and write in the project rules: base https://api.zapzapapi.com/api/v1, headers x-api-key and x-api-secret, use only endpoints in the specification.

{
  "mcpServers": {
    "zapzap": {
      "command": "node",
      "args": ["/absolute/path/to/zapzap-mcp/dist/src/index.js"],
      "env": {
        "ZAPZAP_API_KEY": "${env:ZAPZAP_API_KEY}",
        "ZAPZAP_API_SECRET": "${env:ZAPZAP_API_SECRET}",
        "ZAPZAP_READ_ONLY": "true"
      }
    }
  }
}