# Give Your AI Agent WhatsApp Superpowers with MCP (Official Business API)

> Source: <https://dev.to/rustam335/give-your-ai-agent-whatsapp-superpowers-with-mcp-official-business-api-3f9l>
> Published: 2026-09-18 16:05:26+00:00

What if your AI assistant could check your store's WhatsApp inbox, look up an order, and send the customer a reply — by itself?

That's what the [Model Context Protocol](https://modelcontextprotocol.io) (MCP) makes possible. MCP is now supported across the LLM ecosystem — claude.ai, ChatGPT, Gemini, Cursor, Windsurf, VS Code Copilot, and most agent frameworks speak it — and in this post I'll show you how to wire **any** MCP-capable client to a live WhatsApp Business platform in under two minutes. No SDKs, no servers to host — it's a remote MCP server.

[Tokolaku](https://tokolaku.id/developers) is a WhatsApp business platform for Indonesian SMBs built on Meta's **official** WhatsApp Business API (Cloud API — so no gray-market gateways, no ban roulette). It exposes a hosted MCP server:

```
https://api.tokolaku.id/mcp
```

Any modern MCP client with OAuth discovery (claude.ai, ChatGPT, Gemini, LibreChat, and most hosted assistants) needs nothing but the URL:

`https://api.tokolaku.id/mcp`
`list_channels`, `list_conversations`, `get_conversation`, `list_products`, `list_orders`, `get_order`.
Behind the scenes this uses PKCE, dynamic client registration (RFC 7591), and standard discovery metadata (RFC 8414/9728) — tokens are minted per user, short-lived, and revocable from the dashboard.

Try prompts like:

"Any unpaid orders from this week? Summarize who I should follow up with."

"Which products got asked about most in yesterday's chats?"

For write access (actually sending messages), use a **secret API key** from the developer dashboard. Most coding agents and frameworks (Claude Code, Cursor, Windsurf, Cline, VS Code, OpenAI Agents SDK, LangChain, and friends) share the same `mcpServers` config convention:

```
{
  "mcpServers": {
    "tokolaku": {
      "type": "http",
      "url": "https://api.tokolaku.id/mcp",
      "headers": { "x-api-key": "tk_live_sk_xxx" }
    }
  }
}
```

Building your own agent instead? Point any MCP client SDK at the Streamable HTTP URL and pass the key as an `x-api-key` (or `Authorization: Bearer`) header — that's the whole integration.

Tools follow your key's scopes (`tools/list` reflects them), and write tools like `send_message` go through the exact same billing, quota, and rate-limit path as the REST API — your agent can't do anything your key can't.

A fun one to try in your coding agent of choice:

"A customer at +62812xxxx asked about their order this morning. Check the conversation, find the order status, and send them a polite update."

Most "AI + WhatsApp" setups either screen-scrape the desktop app (fragile, ToS-risky) or make you build a bot pipeline first. A remote MCP server flips it: the *platform* speaks MCP natively, and any agent — today's or next year's — gets structured, permissioned access to real business state: conversations, catalog, orders.

The same endpoint also serves classic REST (`POST /api/v1/messages`, webhooks with HMAC signatures) and official SDKs on [npm](https://www.npmjs.com/package/tokolaku-sdk), [PyPI](https://pypi.org/project/tokolaku/), and [Packagist](https://packagist.org/packages/tokolaku/sdk) — so the MCP layer is a first-class citizen, not a demo.

Questions or weird edge cases? I'd love to hear what your agents do with a WhatsApp inbox. 👇