Give Your AI Agent WhatsApp Superpowers with MCP (Official Business API)

What if your AI assistant could check your store's WhatsApp inbox, look up an order, and send the customer a reply — by itself?

That's what the Model Context Protocol (MCP) makes possible. MCP is now supported across the LLM ecosystem — claude.ai, ChatGPT, Gemini, Cursor, Windsurf, VS Code Copilot, and most agent frameworks speak it — and in this post I'll show you how to wire any MCP-capable client to a live WhatsApp Business platform in under two minutes. No SDKs, no servers to host — it's a remote MCP server.

The server

Tokolaku is a WhatsApp business platform for Indonesian SMBs built on Meta's official WhatsApp Business API (Cloud API — so no gray-market gateways, no ban roulette). It exposes a hosted MCP server:

https://api.tokolaku.id/mcp

Transport: Streamable HTTP, stateless
Auth: OAuth 2.1 (interactive clients) or API key (programmatic)
Tools: send messages, browse inbox conversations, products, orders, manage webhooks

Option 1: OAuth-capable clients — just paste the URL

Any modern MCP client with OAuth discovery (claude.ai, ChatGPT, Gemini, LibreChat, and most hosted assistants) needs nothing but the URL:

Open your client's connector / MCP server settings (e.g. Settings → Connectors → Add custom connector)
Paste https://api.tokolaku.id/mcp
You'll be redirected to sign in with your Tokolaku account and approve access
Done. Your assistant now has 6 read-only tools scoped to your account: list_channels, list_conversations, get_conversation, list_products, list_orders, get_order.

Behind the scenes this uses PKCE, dynamic client registration (RFC 7591), and standard discovery metadata (RFC 8414/9728) — tokens are minted per user, short-lived, and revocable from the dashboard.

Try prompts like:

"Any unpaid orders from this week? Summarize who I should follow up with."

"Which products got asked about most in yesterday's chats?"

Option 2: Coding agents, CLIs & SDK frameworks — API key

For write access (actually sending messages), use a secret API key from the developer dashboard. Most coding agents and frameworks (Claude Code, Cursor, Windsurf, Cline, VS Code, OpenAI Agents SDK, LangChain, and friends) share the same mcpServers config convention:

{
  "mcpServers": {
    "tokolaku": {
      "type": "http",
      "url": "https://api.tokolaku.id/mcp",
      "headers": { "x-api-key": "tk_live_sk_xxx" }
    }
  }
}

Building your own agent instead? Point any MCP client SDK at the Streamable HTTP URL and pass the key as an x-api-key (or Authorization: Bearer) header — that's the whole integration.

Tools follow your key's scopes (tools/list reflects them), and write tools like send_message go through the exact same billing, quota, and rate-limit path as the REST API — your agent can't do anything your key can't.

A fun one to try in your coding agent of choice:

"A customer at +62812xxxx asked about their order this morning. Check the conversation, find the order status, and send them a polite update."

Why this pattern is interesting

Most "AI + WhatsApp" setups either screen-scrape the desktop app (fragile, ToS-risky) or make you build a bot pipeline first. A remote MCP server flips it: the platform speaks MCP natively, and any agent — today's or next year's — gets structured, permissioned access to real business state: conversations, catalog, orders.

The same endpoint also serves classic REST (POST /api/v1/messages, webhooks with HMAC signatures) and official SDKs on npm, PyPI, and Packagist — so the MCP layer is a first-class citizen, not a demo.