MCP

The same operations are available to agents over the Model Context Protocol. The MCP endpoint is on the same service and uses the same key, the same rate limits and the same audit trail as REST.

Environment	MCP endpoint
Production	`https://api.velocifile.ai/v1/mcp`
Sandbox	`https://api.dev.velocifile.ai/v1/mcp`

The transport is streamable HTTP, stateless. Authenticate with Authorization: Bearer <key>, where <key> is your API key.

Config download

Download velocifile-mcp.json

{
  "mcpServers": {
    "velocifile": {
      "type": "http",
      "url": "https://api.velocifile.ai/v1/mcp",
      "headers": {
        "Authorization": "Bearer ${VELOCIFILE_API_KEY}"
      }
    }
  }
}

The config reads your key from the VELOCIFILE_API_KEY environment variable, so the file never holds a secret. Set the variable before you start your client. For sandbox, change the URL to https://api.dev.velocifile.ai/v1/mcp and use a vf_test_ key. Do not replace the placeholder with a real key in a file you commit.

Claude Code

export VELOCIFILE_API_KEY="vf_live_..."
claude mcp add --transport http velocifile https://api.velocifile.ai/v1/mcp --header "Authorization: Bearer $VELOCIFILE_API_KEY"

Check it with claude mcp list, or run /mcp inside a session.

Claude Desktop

Open Settings, then Developer, then Edit Config, and add the velocifile entry from the config above inside mcpServers. Save the file and restart Claude Desktop. If your version only supports local (stdio) servers in the config file, add the server as a custom connector in Settings instead, using the endpoint URL and an Authorization header with your key.

Cursor

Open Cursor Settings, then MCP, then add a new server, or edit ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project) and paste the same config. Reload the window, and the velocifile tools appear in the list.

Tools

One tool per API operation, named for intent. Inputs and outputs are the same schemas as the REST API.

Tool	REST operation
`list_taxonomies`	`GET /taxonomies`
`search_filings`	`POST /filings/search`
`get_filing`	`GET /filings/{filing_id}`
`list_filing_versions`	`GET /filings/{filing_id}/versions`
`get_filing_version`	`GET /filings/{filing_id}/versions/{filing_version_id}`
`get_manifest`	`GET .../manifest`
`get_document_download`	`GET .../documents/{document_id}/download`
`create_watcher`	`POST /watchers`
`list_watchers`	`GET /watchers`
`get_watcher`	`GET /watchers/{watcher_id}`
`update_watcher`	`PATCH /watchers/{watcher_id}`
`get_watcher_events`	`GET /watchers/{watcher_id}/events`

Two tools take an extra argument because an agent has no HTTP headers: create_watcher requires idempotency_key, so an agent can retry safely, and update_watcher requires if_match.

Failures come back as a tool error whose text is the standard error envelope. Calls count toward your rate limit like any request.