Connect your AI to your affiliate program

Name: MCP
Brand: Rekomi

What's inside

4 modules. One mcp surface.

Each card jumps to the detailed section below. Every module ships today unless flagged otherwise in copy.

Works with Claude, Cursor, Continue, Zed, and anything else that speaks MCP.

Rekomi runs a hosted Streamable-HTTP MCP server at mcp.rekomi.com. Point your AI client at that URL with a connection token and the assistant gets 56 tools wired to your account: read billing state and pick the right install path, fetch deep platform-specific install recipes for 37 platforms, create campaigns, bulk-invite affiliates during migration from Rewardful or Tapfiliate, approve and reject applications, draft outreach, mint embed tokens, and more. Per-tool consent is handled by your AI client.

Jump to section

02 / 04

Available on every plan

Trial and Starter included. No upgrade gate.

Direct API access needs a Starter+ plan to mint keys, and the MCP path is open on every plan including Trial. The trade-off is that MCP tokens only work through the trusted relay at mcp.rekomi.com, never directly against the API. This keeps the abuse surface bounded without locking small brands out of AI workflows.

Jump to section

03 / 04

Audit-trailed by design

Every AI action lands in your audit log with actor_type = mcp.

MCP-initiated actions are first-class in the audit log. You can filter for actor_type=mcp to see exactly what the assistant did, when, from which IP, and which connection token. Revoke a token and any in-flight AI work for that client stops within 10 seconds. The same Postgres row-level-security policies that guard direct API access apply to MCP traffic.

Jump to section

04 / 04

Ft. Knox security

Token alone is useless. The relay signs and verifies every request.

An MCP connection token by itself does nothing. The Rekomi backend rejects any direct call with mcp_relay_required. The only valid path is through mcp.rekomi.com, which signs every outbound request over the method, path, body, and timestamp. Replay and tampering both fail validation.

Jump to section

By the numbers

What this surface delivers.

MCP at a glance

Hosted Model Context Protocol server at mcp.rekomi.com. 56 tools including a full install assistant and drop-in migration from 21 platforms. Every plan.

4

Modules in scope

Built into MCP

100%

Audit-log coverage

Every mutation, every actor

300s

Webhook replay window

HMAC-SHA256 verified

RLS

Tenant isolation

Enforced at the database

Built to MCP standard

Works with Claude, Cursor, Continue, Zed, and anything else that speaks MCP.

Rekomi runs a hosted Streamable-HTTP MCP server at mcp.rekomi.com. Point your AI client at that URL with a connection token and the assistant gets 56 tools wired to your account: read billing state and pick the right install path, fetch deep platform-specific install recipes for 37 platforms, create campaigns, bulk-invite affiliates during migration from Rewardful or Tapfiliate, approve and reject applications, draft outreach, mint embed tokens, and more. Per-tool consent is handled by your AI client.

Claude Desktop, Claude Code, Cursor, Continue, Zed
Streamable-HTTP transport (the modern MCP spec)
No software to install; mcp.rekomi.com is hosted by us
56 tools spanning reads, writes, and the install assistant

Module 01 of 04

Built to MCP standard

Real product screenshot lands before launch

Available on every plan

Trial and Starter included. No upgrade gate.

Direct API access needs a Starter+ plan to mint keys, and the MCP path is open on every plan including Trial. The trade-off is that MCP tokens only work through the trusted relay at mcp.rekomi.com, never directly against the API. This keeps the abuse surface bounded without locking small brands out of AI workflows.

Trial: yes
Starter: yes
Growth, Pro, Enterprise: yes
Direct rk_live_* API keys need Starter+ to mint

Module 02 of 04

Available on every plan

Real product screenshot lands before launch

Audit-trailed by design

Every AI action lands in your audit log with actor_type = mcp.

MCP-initiated actions are first-class in the audit log. You can filter for actor_type=mcp to see exactly what the assistant did, when, from which IP, and which connection token. Revoke a token and any in-flight AI work for that client stops within 10 seconds. The same Postgres row-level-security policies that guard direct API access apply to MCP traffic.

Audit log entries tagged actor_type = mcp
Per-token revocation, propagates within 10s
Row-level security pinned on every request
Suspension gate stops MCP traffic for paused accounts

Module 03 of 04

Audit-trailed by design

Real product screenshot lands before launch

Ft. Knox security

Token alone is useless. The relay signs and verifies every request.

An MCP connection token by itself does nothing. The Rekomi backend rejects any direct call with mcp_relay_required. The only valid path is through mcp.rekomi.com, which signs every outbound request over the method, path, body, and timestamp. Replay and tampering both fail validation.

256-bit token entropy, SHA-256 hashed at rest
HMAC-SHA256 relay binding (method + path + body sha256)
5-minute timestamp window blocks replays
Constant-time signature compare (no timing leaks)

Module 04 of 04

Ft. Knox security

Real product screenshot lands before launch

FAQ

Common questions.

What is MCP?

Model Context Protocol. An open standard that lets AI assistants call tools, read documents, and act on external systems. Originated at Anthropic; supported by Claude Desktop, Claude Code, Cursor, Continue, Zed, and others.

Do I need to write any code to use this?

No. Generate a token under Settings → AI assistant, paste it into your AI client's MCP server config, restart the client. That's the whole setup.

Can the assistant accidentally do something destructive?

Destructive tools (approve, reject) require you to confirm in your AI client before the call lands. Every action is logged and revocable. You can also generate a token and instruct the assistant to use it read-only, then audit later.

How does this differ from direct API access?

Direct API (rk_live_*) needs a Starter+ plan to mint keys and you call it from your own code. MCP (rk_mcp_*) works on every plan but only through an AI client; the token cannot be used directly. Same security model, different audience.

Where can I read the full docs?

/docs/developers/mcp covers setup for every major AI client, the full tool list, and the security model.

Also worth a look

Other parts of Rekomi.

MCP is one of eight surfaces. Each is built on the same primitives - Stripe, Postgres with RLS, Clerk, Anthropic - and ships with the same audit and security bar.