Wispu for agents

Wispu developer resources: MCP and OAuth

Connect an AI client to the Brand Context your team keeps in Wispu. Choose the Brands and product permissions first, then complete OAuth from the MCP client.

Wispu from your AIExample

Prepare the carousel for the 3-questions idea, in my voice.

Wispu · read Brain and your templates

Done: 7 slides in draft. I left it in Wispu so you can approve it before scheduling.

MCP discovery

Wispu publishes llms.txt, this portal and OAuth protected-resource metadata for its canonical remote MCP server.

Terminal

curl https://wispu.app/.well-known/oauth-protected-resource/api/mcp

MCP quickstart

The remote server uses Streamable HTTP at wispu.app/api/mcp. Every request requires OAuth. OAuth clients use authorization code with S256 PKCE and request the mcp scope. That scope opens transport only. Every tool call rechecks the current user, workspace, Brand and product permissions.

Claude, ChatGPT and Codex

Use the remote endpoint in a client that supports MCP. Claude-compatible JSON clients use the first example. ChatGPT connects through its MCP interface. Codex uses the TOML example. The client completes OAuth; do not paste a customer token into a prompt.

JSON

{
  "mcpServers": {
    "wispu": { "url": "https://wispu.app/api/mcp" }
  }
}

TOML · Codex

[mcp_servers.wispu]
url = "https://wispu.app/api/mcp"

OAuth with PKCE

Read the protected-resource metadata first. ChatGPT and Codex use client ID metadata discovery. Claude-compatible clients can use restricted dynamic client registration. All clients use authorization code with an S256 code challenge. The mcp scope does not grant workspace or Brand access.

Terminal

curl https://wispu.app/.well-known/oauth-protected-resource/api/mcp

Access profiles and least privilege

Your agent proposes one change

You approve it in Wispu

Wispu applies exactly what you saw

Personal API tokens are not used. Create a named access profile with only the Brands and capabilities an agent needs. Revoking the profile stops its OAuth access and refresh-token family. A profile belongs to one workspace and covers only Brands the user can access there, checked again on every request. Workspace Guests can read only. Context writes require a workspace Owner or Admin, or a workspace Member with explicit Brand Admin access. A reply in chat is not an approval. The agent prepares one change and shows the complete draft. A person with write access to the Brand then approves or rejects it in Approvals in Wispu. Approving applies exactly the payload the person saw; the agent cannot apply it. The same rule covers Context changes, publications and Vault templates. The agent reads the outcome with get_approval_status.

Manage agent access

Rate limits

Unauthenticated MCP and OAuth requests are limited to 30 per minute per IP. Reads allow 120 per minute per user and client; Knowledge reads, analyses and proposals allow 20; saves allow 10. Responses include RateLimit and RateLimit-Policy. HTTP 429 also includes Retry-After. Tool failures return a typed code, message, resolution and retryable flag.

Machine-readable resources

Questions about an integration? team@wispu.app