Wispu for agents

Wispu developer resources: MCP and OAuth

Connect an AI client to the governed Brand Context used inside Wispu. Choose Brands and product permissions first, then complete OAuth from the MCP client.

MCP discovery

Wispu publishes llms.txt, this portal, and OAuth protected-resource metadata for its canonical remote MCP server.

curl https://mcp.wispu.app/.well-known/oauth-protected-resource/mcp

MCP quickstart

The remote server uses Streamable HTTP at mcp.wispu.app/mcp. Every request requires OAuth. OAuth clients use authorization code with S256 PKCE and request the mcp scope. That scope opens transport only. Every tool call rechecks the current user, workspace, Brand, and product permissions.

Claude, ChatGPT, and Codex

Use the remote endpoint in a client that supports MCP. Claude-compatible JSON clients use the first example. ChatGPT connects through its MCP interface. Codex uses the TOML example. The client completes OAuth; do not paste a customer token into a prompt.

{
  "mcpServers": {
    "wispu": { "url": "https://mcp.wispu.app/mcp" }
  }
}

[mcp_servers.wispu]
url = "https://mcp.wispu.app/mcp"

OAuth with PKCE

Read the protected-resource metadata first. ChatGPT and Codex use client ID metadata discovery. Claude-compatible clients can use restricted dynamic client registration. All clients use authorization code with an S256 code challenge. The mcp scope does not grant workspace or Brand access.

curl https://mcp.wispu.app/.well-known/oauth-protected-resource/mcp

Access profiles and least privilege

Personal API tokens are not used. Create a named access profile with only the Brands and capabilities an agent needs. Revoking the profile stops its OAuth access and refresh-token family. The dark launch is limited to Brands the user can access in Kyba Ventures LLC. Workspace Guests can read only. Context writes require a workspace Owner or Admin, or a workspace Member with explicit Brand Admin access. The client must prepare one element, show the complete before and after draft in chat, wait for a later explicit confirmation, commit that exact payload, and read it back. New chat confirmations do not open a Wispu review page; older prepared changes keep their ten-minute review link.

Manage agent access

Rate limits

Unauthenticated MCP and OAuth requests are limited to 30 per minute per IP. Reads allow 120 per minute per user and client; Knowledge fetches and prepared Context changes allow 20; Context commits allow 10. Responses include RateLimit and RateLimit-Policy. HTTP 429 also includes Retry-After. Tool failures return a typed code, message, resolution, and retryable flag.

Machine-readable resources

Questions about an integration? team@wispu.app