# How to connect the PapaProxy.net MCP server in n8n

> Page: https://papaproxy.net/developers/mcp/n8n.php. In n8n, the PapaProxy.net MCP server (56 tools for a proxy account) works two ways: as tools for an AI Agent (MCP Client Tool node) and as a regular workflow step with no model (MCP Client node). Both use one endpoint, one API key, and one n8n credential.

- MCP endpoint: `https://papaproxy.net/account_new/api/v1/mcp`
- Transport: Streamable HTTP (n8n: Server Transport → HTTP Streamable)
- Authentication: n8n credential type Bearer Auth; Bearer Token = the key itself (`fb_...`), without the word `Bearer`
- Create a key: Dashboard → Settings → API keys (https://papaproxy.net/account_new/settings#api-keys). The full key is shown once.
- Cost: included with every account; you pay only for the proxies you order. The MCP Client node uses no model tokens.

## Which node to use

| Node | Who picks the tool | Best for |
|---|---|---|
| MCP Client Tool, on the Tool input of an AI Agent | The model | Chat bots, requests in plain English; uses model tokens |
| MCP Client, a regular step | You, when building the workflow | Scheduled reports and alerts; same tool and parameters every run |
| HTTP Request (not MCP) | You | REST API calls (https://papaproxy.net/developers/reference/), or routing a workflow's own traffic through your proxies |

`get_usage_overview` and `get_diagnostics` are MCP-only tools; use the MCP Client node to run them on a schedule without an agent.

## Step 1. Key and n8n credential

Give each workflow its own key, named after it, with only the scopes it needs.

| Workflow | Scopes |
|---|---|
| Usage and error reports | `services:read`, `usage:read` |
| Low-balance alert | `wallet:read` |
| Price-quote chat bot | `catalog:read` |
| Whitelisting the n8n server's IP | `services:read`, `services:write`, `customer:read` |
| Agent that orders and renews | the above plus `wallet:read`, `wallet:spend`, with human review |

1. In the MCP node, set Authentication → Bearer Auth, then Credential → Create new credential.
2. Paste the key (starts with `fb_`) into Bearer Token. Don't add `Bearer`; n8n adds it.
3. Save with a neutral name, for example "PapaProxy.net — reports".

Exported workflow JSON includes the credential's name and ID, not the key. Keep the key out of the credential name.

## Option 1. AI Agent with MCP Client Tool

Click + on the AI Agent's Tool input, add MCP Client Tool:

```
Endpoint:           https://papaproxy.net/account_new/api/v1/mcp
Server Transport:   HTTP Streamable
Authentication:     Bearer Auth
Credential:         PapaProxy.net — reports
Tools to Include:   Selected
```

Tools for a reporting agent: `list_services`, `get_service`, `get_usage_overview`, `get_usage_timeseries`, `get_top_destinations`, `get_diagnostics`, `get_recommendations`.

System message:

```
You manage proxies on a PapaProxy.net account through the PapaProxy.net tools.
Amounts from the tools are in US cents; show them in dollars, for example $12.50.
Before any paid action, get a quote first and show it.
If a tool returns an error, quote its short code and explain it in one sentence.
```

## Human review for paid tools

n8n can pause before an AI Agent runs specific tools and ask a person to approve or deny (Slack, Telegram, Microsoft Teams, Discord, Gmail, n8n chat, and others). Review applies to tools connected to the review step, so use two MCP Client Tool nodes with the same endpoint and credential:

- "PapaProxy.net — read", connected directly: `list_countries`, `quote_composite`, `list_services`, `get_service`, `get_usage_overview`, `get_diagnostics`, `wallet_balance`.
- "PapaProxy.net — orders", behind human review: `order_composite`, `add_ips`, `renew_service`, `purchase_addon`, `refresh_ips`, `add_whitelist_ip`, `remove_whitelist_ip`.

Setup: AI Agent Tool input → Tools panel → Human review → pick a channel; connect the "orders" node to the review step's tool input. In the message, `{{ $tool.name }}` is the node name and `{{ $tool.parameters }}` is what the agent wants to send. The real boundary is the key: without `wallet:spend` nothing can be paid; with it, only from the account balance.

## Option 2. MCP Client as a step, no model

```
Server Transport:   HTTP Streamable
MCP Endpoint URL:   https://papaproxy.net/account_new/api/v1/mcp
Authentication:     Bearer Auth
Credential:         PapaProxy.net — reports
Tool:               get_diagnostics
Input Mode:         Manual
```

The Tool list loads from the server; Manual mode shows the tool's parameters, JSON mode takes them from an expression. Tool results are exposed as `structuredContent`, for example `{{ $json.structuredContent.balance_cents }}` after `wallet_balance`.

## Workflow recipes

- Morning error digest: Schedule Trigger → MCP Client (`get_usage_overview`) → MCP Client (`get_diagnostics`) → Slack. Scopes: `services:read`, `usage:read`.
- Low-balance alert: Schedule Trigger → MCP Client (`wallet_balance`) → If `{{ $json.structuredContent.balance_cents }}` < `2000` ($20.00) → Telegram. Scope: `wallet:read`.
- Price-quote bot: Chat Trigger → AI Agent + MCP Client Tool with only `list_countries`, `get_pricing_info`, `quote_composite`. Scope: `catalog:read` (can't see services or buy).
- Whitelist a self-hosted n8n server: `get_my_ip` (returns the n8n server's public IP) → `add_whitelist_ip` with the service ID. Not on n8n Cloud (shared outbound IPs).

Rate limit: 60 requests per minute per account, shared by all API keys and the MCP server; add a Wait node inside Loop Over Items. `list_proxy_ips` returns the whole list in one response; call it from an MCP Client node, not an AI Agent, and process it with Split Out or Code.

All 56 tools: https://papaproxy.net/developers/reference/#mcp-tools

## Proxies in the HTTP Request node

HTTP Request → Add option → Proxy:

```
http://LOGIN:PASSWORD@IP:PORT
```

- Only `http://` and `https://` proxy URLs work. A `socks5://` URL is ignored with a log warning, and the request goes out without the proxy, from the n8n server's IP.
- URL-encode special characters in the password (`@` → `%40`).
- The node option overrides `HTTP_PROXY`, `HTTPS_PROXY`, and `ALL_PROXY` for that node.

| Where n8n runs | Use | Why |
|---|---|---|
| Self-hosted | IP whitelisting or username/password | The server's IP is yours; with whitelisting the URL is `http://IP:PORT` |
| n8n Cloud | Username/password only | Outbound IPs are shared by many instances; whitelisting them would let other n8n Cloud workflows use your proxies |

## Troubleshooting

| What you see | Cause and fix |
|---|---|
| `Missing or malformed Authorization header` | Authentication is None or no credential is selected; choose Bearer Auth |
| `Invalid or revoked API key` | The token includes `Bearer ` (header gets it twice), a typo, a space, or a revoked key |
| Tools to Include / Tool list empty or errors | The list loads with your credential; fix the endpoint and credential first |
| Connection errors with Server Sent Events | The server uses Streamable HTTP; choose HTTP Streamable |
| Node shows an SSE Endpoint field | First node version, SSE only; add the node again (update n8n if needed) |
| Self-hosted instance can't connect | Outbound HTTPS to papaproxy.net blocked; check the firewall, `HTTPS_PROXY`, `NO_PROXY` |
| Scope error | The key lacks the tool's scope; create a key with it and update the credential |
| Calls fail mid-loop | 60 requests per minute per account; add a Wait node |
| Target websites see the n8n server's IP | HTTP Request proxy URL uses `socks5://` or no scheme; use `http://` and the HTTP port |

Server errors: contact support@papaproxy.net with the time of the failed execution.

## Other MCP clients

Cursor: https://papaproxy.net/developers/mcp/cursor.md. Claude Code: https://papaproxy.net/developers/mcp/claude-code.md. VS Code, Windsurf, Cline, Codex CLI, Gemini CLI, Claude Desktop: https://papaproxy.net/developers.php#mcp