Rewalto MCP in Windsurf

Get an API key

1. Create an API key for your organisation, as the API keys guide explains. Its secret is shown once, when the key is created; copy it then.
2. For an agent that only reads, give the key data:read and usage:read. Add tools:run only for an agent allowed to propose and approve spending.
3. Every request to the MCP server needs the key, the free catalogue tools included. Put it in the placeholder below (rwk_your_key, or the environment variable the snippet names).

See API keys for how to create, list and revoke a key.

Add Rewalto to Windsurf

In Cascade's MCP menu, choose Open MCP config file and add the server to mcp_config.json. A remote server takes its address under serverUrl.

{
  "mcpServers": {
    "rewalto": {
      "serverUrl": "https://mcp.rewalto.com/mcp",
      "headers": { "Authorization": "Bearer ${env:REWALTO_API_KEY}" }
    }
  }
}

Windsurf fills in ${env:REWALTO_API_KEY} from your environment, so the key stays out of the file. Press the refresh button in Cascade's MCP menu after saving.

Check the connection

1. Reach the server. Open Cascade's MCP menu: rewalto is listed with its tools. Rewalto's live tool list has 102 tools; the ones marked for a signed-in dashboard only are refused to an API key. If it shows an error, the key is missing or not accepted: the server answers 401 to a request without a valid key.
2. Call a free tool. Ask the agent: "Use Rewalto's list_catalogue_categories tool and list the categories." The tool is free and spends no credits.
3. Read a result. The answer lists Rewalto's catalogue categories. They match the public list at https://api.rewalto.com/v1/catalogue/categories, which needs no key.

Check the key from a terminal

curl -sS https://mcp.rewalto.com/mcp \
  -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \
  -H "authorization: Bearer $REWALTO_API_KEY" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"whoami","arguments":{}}}'

The answer names your organisation, with credential kind api_key and the key's permissions. It spends nothing.