Rewalto MCP in Claude Code

Get an API key

1. Create an API key for your organisation, as the API keys guide explains. Its secret is shown once, when the key is created; copy it then.
2. For an agent that only reads, give the key data:read and usage:read. Add tools:run only for an agent allowed to propose and approve spending.
3. Every request to the MCP server needs the key, the free catalogue tools included. Put it in the placeholder below (rwk_your_key, or the environment variable the snippet names).

See API keys for how to create, list and revoke a key.

Add Rewalto to Claude Code

Add the server with one command. It is saved for you in this project; add --scope user to use it in every project, or --scope project to share it through the project's .mcp.json.

claude mcp add --transport http rewalto https://mcp.rewalto.com/mcp \
  --header "Authorization: Bearer $REWALTO_API_KEY"

{
  "mcpServers": {
    "rewalto": {
      "type": "http",
      "url": "https://mcp.rewalto.com/mcp",
      "headers": { "Authorization": "Bearer ${REWALTO_API_KEY}" }
    }
  }
}

In the command, your shell puts the key in place of $REWALTO_API_KEY. In .mcp.json, Claude Code fills in ${REWALTO_API_KEY} from the environment when it starts, so the key is never committed.

Check the connection

1. Reach the server. Run claude mcp list, or /mcp inside Claude Code: rewalto is listed as connected. Rewalto's live tool list has 102 tools; the ones marked for a signed-in dashboard only are refused to an API key. If it shows an error, the key is missing or not accepted: the server answers 401 to a request without a valid key.
2. Call a free tool. Ask the agent: "Use Rewalto's list_catalogue_categories tool and list the categories." The tool is free and spends no credits.
3. Read a result. The answer lists Rewalto's catalogue categories. They match the public list at https://api.rewalto.com/v1/catalogue/categories, which needs no key.

Check the key from a terminal

curl -sS https://mcp.rewalto.com/mcp \
  -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \
  -H "authorization: Bearer $REWALTO_API_KEY" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"whoami","arguments":{}}}'

The answer names your organisation, with credential kind api_key and the key's permissions. It spends nothing.