Kallfi ACR Documentation

Give your AI client access to Kallfi with your Account's ACR key.

Get your credentials

Copy your Account ACR key from Settings.

Choose your agent

Select your client, then choose your configuration scope and transport. Manus uses guided cloud setup.

Client (1:claude-code, 2:codex, 3:cursor, 4:manus; cancel): 2

Enter your credentials

Paste your ACR key without a Bearer prefix. Your input stays hidden. Review and confirm the changes, then restart your client.

Account ACR key (hidden):

Manual setup

Use the client-specific configuration below if you prefer to configure the connection yourself.

User configuration: ~/.claude.json. Project configuration: <project>/.mcp.json.

{
  "mcpServers": {
    "kallfi-com": {
      "type": "http",
      "url": "https://mcp.kallfi.com/mcp",
      "headers": {
        "Authorization": "Bearer ${KALLFI_COM_ACR_KEY}"
      }
    }
  }
}

For Remote HTTP, use https://mcp.kallfi.com/mcp with a client that supports Streamable HTTP and a Bearer API key or custom Authorization header.

API key authentication

Kallfi MCP uses an Account API key, not OAuth. OAuth-only connectors are unsupported. Keep the key out of URLs, chat messages, tool arguments and shared configuration.

Native installation and credential storage

The bootstrap keeps a verified official Node.js runtime and the published MCP package privately under ~/.local/share/kallfi/mcp, without sudo or preinstalled Node/npm. Choose the same COM or RED surface as your key, then select Remote HTTP (the default) or Local stdio. Local configuration uses the exact absolute private launcher, so desktop clients do not need Node/npm on their PATH. Keep this directory while a Local stdio connection uses it. Rerun setup or remove a native-managed connection with ~/.local/share/kallfi/mcp/bin/mcp setup or ~/.local/share/kallfi/mcp/bin/mcp remove.

In user scope, setup can save the key in your client's private configuration. Values are masked during entry and saved as plaintext in private user files and backups with mode 0600. Keep both private. Setup refuses private key storage inside a project or Git checkout; project scope uses environment references.

For environment-reference configuration, make KALLFI_COM_ACR_KEY available to the process that launches your client. A desktop app may need its own environment configuration and a restart.

Run setup again after key rotation and choose Replace. Setup preserves unrelated settings, asks before changes, and leaves the original file unchanged if you cancel before confirmation. It does not create, rotate or validate keys through a server call.

Restart your client after changing its configuration. To remove an installer-managed connection, run npx @kallfi/mcp@latest remove and select that connection.

Check your connection

List the tools, then try a permitted read. See Tools and capabilities for available actions. Tool discovery does not grant permissions or establish that every business operation succeeds.

Personal and Team access

Omit workspace selection for Personal and Account tools. Explicit Team workspace execution is currently unsupported and returns workspace_capability_unsupported; do not retry it as Personal.

Paid actions and mutations still require their normal permissions and confirmations. Retain the original idempotency key when retrying an action; a timeout or cancellation does not roll it back.

Troubleshooting

Problem	What to check
Local process does not start	For native setup, check that the private runtime/package directory and absolute launcher remain present. Manual npx recipes require Node.js 22+ on the client PATH.
Authentication is rejected	Check the key is current, unrevoked and issued for this surface.
Configuration changes have no effect	Save the private configuration and restart the client.
The connector offers only OAuth	Use a client with API-key Bearer support.
Remote transport is rejected	Use stateless POST Streamable HTTP; GET streams, resumable sessions and subscriptions are unsupported.

Product entry and exact tool catalog

The product MCP entry and this developer-docs setup page present four steps: get credentials, run setup, choose an agent, then enter credentials. Its macOS/Linux command uses the same-host bootstrap; Windows uses the published npx setup command with an explicit surface and links official npm installation instructions. Terminal examples explain agent selection and masked key entry; manual configuration follows below. The command provides a copy control and screen-reader status; failed clipboard access offers manual selection instead of claiming success. Client marks identify Claude Code, Codex, Cursor and guided Manus setup; they do not certify every client transport or grant access.

The proposed presentation rounds its marketing count down to a multiple of ten (for example, thirty-eight published tools appears as “30+”). The exact list/count remains the published versioned catalog in Tools and the API reference. Marketing copy and metadata are not a capability-admission signal.

Following workspace implementation

The following ACR overhaul preserves this published package setup and the verified hosted Personal reads. Its optional X-Kallfi-Workspace-ID selector identifies an intended workspace only; the shared SDK requires same-origin protocol support before sending an explicitly scoped business request, then canonical owners require current membership, surface and grants. The shared SDK rejects an explicit configured workspace for Account-scoped tools, including a Personal UUID; keep those tools on the unscoped Personal connection. Current hosted Team requests remain workspace_capability_unsupported without fallback until the matching schema and runtime are installed. Restricted Personal browser metadata does not grant API-key, Team or tool execution. No new OAuth support is implied.

Setup

On this page