Let your AI work in your WhatsApp support

Connect in a minute

{
  "mcpServers": {
    "raabta": {
      "type": "http",
      "url": "https://raabta.komyosys.ai/mcp"
    }
  }
}

Only owners and managers of a business can connect an AI. Prefer a key for your own scripts or bots? Create one on Menu → AI access and send it asAuthorization: Bearer ak_….

You decide what it may do

Safe by default

• Each connection only sees one business, with the permissions you ticked. Reading is always on; everything else is opt-in.
• Limits per connection: 60 calls a minute and, if it may message customers, 200 messages a day. Access ends when you choose (30 days to never).
• Every action is in the AI audit log, and shows on the ticket with 🤖 and the AI's name. Revoke it on AI access and it stops at once.
• When a team member takes over a chat, nothing from an AI reaches that customer until the chat is handed back.
• Standard MCP sign-in (OAuth 2.1 with PKCE): short-lived tokens (1 hour), rotating refresh tokens, only hashes stored. Raabta never sees your AI app's password, and the AI app never sees yours.

What an AI can do (21 tools)

Ready-made prompts

Your AI app lists these in its prompt menu (in Claude Code type /mcp__raabta__). Each shows only if the connection has its permissions.

Live alerts for your own agent (webhooks)

Chat apps like Claude act when you ask. To have your own agent react by itself, add a webhook on Menu → AI access: Raabta POSTs JSON to your https address on a new chat, a customer message, the AI handing a chat to the teamor a missed reply deadline. The event has the ticket number; your agent then calls get_ticket and acts through MCP. Works with n8n, Make, Zapier or a Claude Agent SDK app.

• Headers: Raabta-Event, Raabta-Delivery (unique id — ignore repeats), Raabta-Signature: t=…,v1=…
• Answer with any 2xx within 10 seconds. Otherwise Raabta retries 5 more times over about 15 minutes; 50 failures in a row switch the webhook off.
• Body: type, created_at, delivery_id, ticket (number, status, priority, channel, summary, customer_name, …) and message (text) when there is one.

Check the signature (Node.js)

import crypto from "node:crypto";

// rawBody: the request body exactly as received (a string), header: req.headers["raabta-signature"]
export function fromRaabta(rawBody, header, secret) {
  const { t, v1 } = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false; // older than 5 minutes
  const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}

Python

import hmac, hashlib, time

def from_raabta(raw_body: bytes, header: str, secret: str) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    if abs(time.time() - int(parts["t"])) > 300:
        return False
    expected = hmac.new(secret.encode(), f"{parts['t']}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts["v1"])

For developers

Server

https://raabta.komyosys.ai/mcp — streamable HTTP (JSON-RPC over POST, stateless), MCP 2025-06-18

Sign-in

OAuth 2.1 authorization code + PKCE (S256), dynamic client registration, refresh tokens. Metadata: https://raabta.komyosys.ai/.well-known/oauth-protected-resource/mcp and https://raabta.komyosys.ai/.well-known/oauth-authorization-server

Keys

Authorization: Bearer ak_… from AI access (for scripts and your own agents)

Capabilities

tools and prompts (no resources yet); every request is logged per connection and shown to the business on AI access → Usage

Events

signed webhooks — see Live alerts

Tool list

https://raabta.komyosys.ai/mcp/tools (JSON, public)

Errors

401 with a WWW-Authenticate header pointing to the sign-in metadata; tool errors come back as isError results