ZapZap API
Sign up

AI editor (Cascade) with MCP

WhatsApp in Windsurf: the ZapZap MCP server in Cascade

Windsurf is an editor with an AI agent called Cascade, which supports MCP servers through an mcp_config.json file. ZapZap offers an open-source MCP server (github.com/zapzapapi/zapzap-mcp) that Cascade can use to look up instances, check numbers, read history and, if you allow it, send messages.

Updated on

Create free accountRead the documentation

Why connect

If you are building a CRM, a support bot or a lead dashboard inside Windsurf, connecting the MCP lets Cascade test WhatsApp for real while it writes code: check that the instance is connected, look at the last webhook deliveries and validate test numbers. ZapZap connects numbers through an unofficial channel: WhatsApp may limit or block any number, so pacing, consent and warm-up matter. It costs R$15 per active number per month, prepaid, with no per-message fee, and you start with a welcome credit when you verify your phone, subject to the current campaign.

Step by step

  1. 1

    Get the keys and export them in the environment

    In the dashboard (app.zapzapapi.com), Settings > API: copy the API Key and API Secret. Export ZAPZAP_API_KEY, ZAPZAP_API_SECRET and, if you want a default instance, ZAPZAP_INSTANCE_ID.

  2. 2

    Build the server

    git clone https://github.com/zapzapapi/zapzap-mcp.git, npm install and npm run build, with Node.js 18 or newer. The repository README mentions npx -y zapzap-mcp, but on 2026-11-11 the package is not yet published on npm (the registry returns 404). The route that works today is to clone, build and point the command at dist/src/index.js.

  3. 3

    Open the config file from Cascade itself

    Windsurf's documentation (now at docs.devin.ai, read on 2026-11-11) describes Cascade's Open MCP config file action, which opens mcp_config.json at the right path for your version. Use that action instead of typing the path, because the file's location has changed between versions.

  4. 4

    Add the server with interpolation

    The format is mcpServers with command, args and env. The documentation says environment variables are interpolated in command, args, env, url and headers with the ${env:NAME} syntax. Write the three names as in the example and do not paste the values into the file.

  5. 5

    Refresh and test with read tools

    After adding a server, the documentation says to use the refresh button so it shows up. Ask Cascade: "check my instance status and the latest webhook deliveries". Windsurf asks for approval before calling an MCP tool by default.

Example

{
  "mcpServers": {
    "zapzap": {
      "command": "node",
      "args": ["/absolute/path/to/zapzap-mcp/dist/src/index.js"],
      "env": {
        "ZAPZAP_API_KEY": "${env:ZAPZAP_API_KEY}",
        "ZAPZAP_API_SECRET": "${env:ZAPZAP_API_SECRET}",
        "ZAPZAP_INSTANCE_ID": "${env:ZAPZAP_INSTANCE_ID}",
        "ZAPZAP_READ_ONLY": "true"
      }
    }
  }
}

Illustrative. The exact fields and endpoints are in the documentation.

What Windsurf's documentation does not say

  • The page I read does not mention a limit of tools per server; if your client applies one, ZAPZAP_READ_ONLY=true shortens the list.
  • The exact path of mcp_config.json depends on the version: use the Open MCP config file action.
  • ZapZap does not offer its own Windsurf extension today: the route is the MCP server and the OpenAPI.

Keep going

WhatsApp API

The guide to connecting and scaling.

View

WhatsApp webhook

Receive events in your system.

View

All integrations

See the supported tools.

View

Frequently asked questions

Does Windsurf support MCP?

Yes. The documentation read on 2026-11-11 describes MCP servers configured in mcp_config.json in Cascade, with approval before calling tools by default.

How do I keep the key out of the file?

Use ${env:ZAPZAP_API_KEY} in the env field. Interpolation works in command, args, env, url and headers.

Can I use npx -y zapzap-mcp?

Not yet: the package is not published on npm as of 2026-11-11. Build the repository and use node with the absolute path of dist/src/index.js.

Can I block sending?

Yes. With ZAPZAP_READ_ONLY=true the server exposes no send tool.

Is ZapZap official WhatsApp?

No. It is an unofficial solution based on instances connected by QR code, and WhatsApp may limit or block numbers.

Start now

Create your account, connect a number in minutes and test the API with warm-up and anti-ban. R$15 per active number/month, prepaid, no lock-in.

Create free accountView the documentation