claude mcp add --transport http zambo https://zambo.dev/mcp

curl -fsS -X POST https://zambo.dev/mcp -H 'Content-Type: application/json' --data '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | grep -q '"tools"'

Claude Code supports HTTP headers for remote MCP servers. Replace the placeholder locally; never commit a real key or paste it into this page. Official Claude Code MCP docs.

claude mcp add --transport http zambo https://zambo.dev/mcp --header "X-Zambo-Key: YOUR_DAY_PASS_KEY"

If your installed version does not accept this header option, use the direct API request in the Generic MCP guide.

Gemini CLI documents custom HTTP headers on HTTP MCP server entries. Replace the placeholder only in your private local settings; never commit a real key. Official Gemini CLI MCP docs.

{"mcpServers":{"zambo":{"httpUrl":"https://zambo.dev/mcp","headers":{"X-Zambo-Key":"YOUR_DAY_PASS_KEY"}}}}

Settings location: ~/.gemini/settings.json.

{"mcpServers":{"zambo":{"httpUrl":"https://zambo.dev/mcp"}}}

curl -fsS -X POST https://zambo.dev/mcp -H 'Content-Type: application/json' --data '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | grep -q '"tools"'

Cursor's MCP configuration supports HTTP headers. Replace the placeholder in your private settings; do not commit a real key. Official Cursor MCP docs.

{"mcpServers":{"zambo":{"url":"https://zambo.dev/mcp","headers":{"X-Zambo-Key":"YOUR_DAY_PASS_KEY"}}}}

Settings location: .cursor/mcp.json.

{"mcpServers":{"zambo":{"url":"https://zambo.dev/mcp"}}}

curl -fsS -X POST https://zambo.dev/mcp -H 'Content-Type: application/json' --data '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | grep -q '"tools"'

VS Code's remote MCP config supports a headers object. Replace the placeholder only in private settings and do not commit a real key. Official VS Code MCP configuration reference.

{"servers":{"zambo":{"type":"http","url":"https://zambo.dev/mcp","headers":{"X-Zambo-Key":"YOUR_DAY_PASS_KEY"}}}}

Settings location: .vscode/mcp.json.

{"servers":{"zambo":{"type":"http","url":"https://zambo.dev/mcp"}}}

curl -fsS -X POST https://zambo.dev/mcp -H 'Content-Type: application/json' --data '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | grep -q '"tools"'

The official Windsurf page documents a headers field for the legacy Cascade remote HTTP config; that page does not describe the newer Devin Local agent. Replace the placeholder in private config only; never commit a real key. Official Windsurf MCP docs.

{"mcpServers":{"zambo":{"serverUrl":"https://zambo.dev/mcp","headers":{"X-Zambo-Key":"YOUR_DAY_PASS_KEY"}}}}

Settings location: ~/.codeium/windsurf/mcp_config.json.

{"mcpServers":{"zambo":{"serverUrl":"https://zambo.dev/mcp"}}}

curl -fsS -X POST https://zambo.dev/mcp -H 'Content-Type: application/json' --data '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | grep -q '"tools"'

MCP itself does not guarantee that every client can add custom HTTP headers. If yours supports header configuration, add X-Zambo-Key with your key in its private local settings; never commit it. Otherwise, use this direct API request. It prompts for the key without putting it in shell history, then clears the temporary environment value.

read -rsp 'Day Pass key: ' ZAMBO_DAY_PASS_KEY; echo
  curl -i -X POST https://zambo.dev/mcp \
  -H 'Content-Type: application/json' \
  -H "X-Zambo-Key: ${ZAMBO_DAY_PASS_KEY}" \
  --data '{"jsonrpc":"2.0","id":"key-test","method":"tools/call","params":{"name":"zambo_universal","arguments":{"need":"What is the current price of Bitcoin in USD?"}}}'
unset ZAMBO_DAY_PASS_KEY

Inspect the response for the result and a verifiable receipt URL.

{"mcpServers":{"zambo":{"url":"https://zambo.dev/mcp"}}}

curl -fsS -X POST https://zambo.dev/mcp -H 'Content-Type: application/json' --data '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | grep -q '"tools"'

The bridge reads one header per line from a local file. Use an absolute file path in Claude's config; protect the file so only your account can read it. Do not put the key in the config JSON, command arguments, shell history, or this webpage.

macOS/Linux example: this prompts without echoing the key or adding it to shell history, creates a private directory/file, then clears the temporary shell variable:

mkdir -p "$HOME/.config/zambo" && chmod 700 "$HOME/.config/zambo"
umask 077
read -rsp 'Day Pass key: ' ZAMBO_DAY_PASS_KEY; echo
printf 'X-Zambo-Key: %s\n' "$ZAMBO_DAY_PASS_KEY" > "$HOME/.config/zambo/headers.txt"
chmod 600 "$HOME/.config/zambo/headers.txt"
unset ZAMBO_DAY_PASS_KEY

The file content is exactly one header line:

X-Zambo-Key: YOUR_DAY_PASS_KEY

On Windows, create the same one-line file at a private absolute path, restrict its file permissions to your Windows account, and use a path without spaces in the config (the mcp-remote docs note an argument-parsing issue for Claude Desktop on Windows).

This local MCP entry invokes the third-party mcp-remote bridge through npx. Replace only the header-file path with its absolute path on your computer. The bridge keeps the secret out of process arguments and fails closed if that file cannot be read. Install/trust the third-party package before enabling this config.

{
  "mcpServers": {
    "zambo": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://zambo.dev/mcp",
        "--header-file",
        "/absolute/path/to/headers.txt"
      ]
    }
  }
}

If the local bridge cannot be used, this sends a direct call with the key prompted at runtime and then clears the temporary shell value.

read -rsp 'Day Pass key: ' ZAMBO_DAY_PASS_KEY; echo
  curl -i -X POST https://zambo.dev/mcp \
  -H 'Content-Type: application/json' \
  -H "X-Zambo-Key: ${ZAMBO_DAY_PASS_KEY}" \
  --data '{"jsonrpc":"2.0","id":"claude-desktop-key-test","method":"tools/call","params":{"name":"zambo_universal","arguments":{"need":"What is the current price of Bitcoin in USD?"}}}'
unset ZAMBO_DAY_PASS_KEY

Look for the tool result and its verifiable /run/ receipt URL.

This prompts for the key without placing it in shell history, then removes it from the shell environment. The key is not saved by this page.

read -rsp 'Day Pass key: ' ZAMBO_DAY_PASS_KEY; echo
  curl -i -X POST https://zambo.dev/mcp \
  -H 'Content-Type: application/json' \
  -H "X-Zambo-Key: ${ZAMBO_DAY_PASS_KEY}" \
  --data '{"jsonrpc":"2.0","id":"chatgpt-key-test","method":"tools/call","params":{"name":"zambo_universal","arguments":{"need":"What is the current price of Bitcoin in USD?"}}}'
unset ZAMBO_DAY_PASS_KEY

Look for the tool result and its verifiable /run/ receipt URL.