Recruit affiliate partners from Claude, ChatGPT or Cursor with the GetAff MCP server

What you need

• A GetAff account with at least one site and its affiliate program: every partner-search tool works on one site, identified by its siteId.
• An MCP client: claude.ai, Claude Desktop, Claude Code, ChatGPT, Cursor, VS Code or any client that speaks Streamable HTTP.
• For paid steps (live creator-data searches, e-mail lookups): the Pro plan. The free sources — the GetAff creator index, lookalikes of your shortlist and the promoters of your competitors — work on every plan.
• For outreach: a Gmail mailbox connected in the app and complete sender settings (name, company, postal address).

The server lives at a single URL, https://www.getaff.org/api/mcp. Discovery (initialize, tools/list) answers without credentials so a client can show the tools; every tool call needs a credential.

Connect your assistant with OAuth

The simplest path is OAuth 2.1: nothing to copy, nothing to paste. In claude.ai, open Settings › Connectors › Add custom connector; in ChatGPT, add a connector (app). In both cases enter the server URL. The client receives a 401 from GetAff, follows the metadata it points to, and opens the GetAff consent screen.

1. Sign in to GetAff if you are not already.
2. Read the consent screen: it names the application, where it will send you back, and what it may do.
3. Tick the permissions (scopes) you want to give. spend is never ticked in advance.
4. Approve. The connector is ready; the token is bound to the MCP server and refused by the REST API.

Access tokens last one hour; refresh tokens last 30 days and rotate at every use. You can disconnect an application at any moment from Account settings › API › Connected applications.

With an API key instead

Clients without OAuth support — or scripts — authenticate with an API key (gaff_live_…) created on the API keys page. With Claude Code, one command is enough:

claude mcp add --transport http getaff https://www.getaff.org/api/mcp \
  --header "Authorization: Bearer $GETAFF_API_KEY"

In Cursor, declare the server in ~/.cursor/mcp.json; the key is read from your environment:

{
  "mcpServers": {
    "getaff": {
      "url": "https://www.getaff.org/api/mcp",
      "headers": { "Authorization": "Bearer ${env:GETAFF_API_KEY}" }
    }
  }
}

The MCP documentation has the configurations for Claude Desktop, VS Code and the OpenAI API. Keep the key in an environment variable or the client’s secret store, never in a shared configuration file.

Choose the scopes

Scopes decide what the assistant may do. They never imply one another, except read, which every credential carries.

• read — sites, criteria, results, shortlist, prospects, sequences.
• search — searches that spend no credit: free sources of the partner search, the creator index, lookalikes, competitor lookups, chat turns.
• write — changes to your data: criteria, shortlist, prospects, competitors, enrolment in a sequence.
• spend — provider credits: live searches and paid e-mail lookups, always behind a confirmation as well.

A sensible start is read search write: the assistant can search, rank and shortlist, but anything paid stays out of reach. If it later needs spend, an OAuth client receives a 403 insufficient_scope and can ask you to grant it — a step up you approve on the consent screen.

The flow, tool by tool

You do not have to name the tools: the assistant reads their descriptions and chooses. Knowing the sequence helps you write better prompts and check what it did.

1. list_sites — your sites and the program each one runs. The assistant calls it first, because every other tool needs a siteId.
2. get_criteria (optional) — the keywords, niches, platforms, countries, languages, audience bands and recency the next search will use, plus the topic terms the ranking matches. update_criteria changes them.
3. search_partners — one search across every source, merged and ranked for your program, each creator with a fit score from 0 to 100.
4. explain_ranking — why one creator ranks where it does: topic match, market, language, reach, recent activity, competitor evidence, similarity to your shortlist.
5. shortlist_add — keeps creators of the latest search by their key (for example instagram:1784140). The shortlist holds 100.
6. shortlist_to_prospects — turns shortlisted creators into private prospects. Free; it counts on the discovery quota of your plan.
7. find_emails — paid lookups at the creator-data providers for prospects without an address (Pro), with a cost confirmation.
8. enrol_in_sequence — schedules the three-step outreach sequence for one prospect from your connected mailbox, after a confirmation.

Prompts that work

Be specific about the market, the audience and the next action. A few prompts that map cleanly to the flow:

• “List my GetAff sites, then show me the criteria of the first one.”
• “For my wedding-planning site, search partners in France and Belgium, Instagram and YouTube, micro and mid-tier audiences. Free sources only.”
• “Why is the third creator ranked above the fifth? Explain both rankings.”
• “Add the five creators with the strongest topic match to my shortlist, then turn the shortlist into prospects.”
• “Find the e-mails of those prospects. Tell me the cost first.”
• “Prepare the outreach sequence for the first prospect and show me the summary before scheduling anything.”

If results look off-topic, say so: “mark the term budget as off-topic and search again” maps to correct_topic_term, and the next search ranks with your correction.

Costs and sends are always confirmed

Two kinds of tool act beyond your own data: those that spend provider credits (search_partners with includeLive, find_emails) and the one that schedules real e-mails (enrol_in_sequence). Both follow the same two steps.

1. The first call spends nothing and schedules nothing. It returns an estimate — credits, provider, what is left today — or a summary of the sequence (prospect, mailbox, draft), together with a confirmToken.
2. The assistant shows you the cost or the summary and waits for an explicit yes.
3. The same call, with the same arguments plus confirmToken, runs — spending at most the confirmed credits.

The token is bound to your credential, the tool and the exact arguments, and expires after 15 minutes. A retried confirmed call replays its first result instead of paying twice.

{ "name": "find_emails",
  "arguments": { "ids": ["kJ2p8wQxYb_ig_1784140"], "confirmToken": "gcf_…" } }

What the server will not do

• Spend credits without a confirmation token issued for that exact call.
• Send an e-mail directly: enrolment only schedules a sequence, after every check of the app — valid and unsuppressed address, the compliance regime of the recipient’s country, complete sender settings, a published program.
• Accept a browser session: only an API key or an OAuth token issued for this server authenticates.
• Return a key, a token or a network credential in any tool result.
• Pass creator text off as instructions: names, handles and bios come from public profiles and are labelled as third-party data in every result.

Your plan’s limits apply to the assistant exactly as they apply to you in the app: the same daily allowances, the same discovery quota, the same rate limits. An assistant is never a way around them.

Going further

The assistant learns that a search finished or a prospect replied only when it calls a tool again. For an integration that has to react on its own, register a webhook. For a scheduled job without an assistant, the same operations exist over the REST API.