Connect any MCP client

Any MCP client can connect to Whippy if it supports all of these:

Requirement	Whippy's value
Remote server over Streamable HTTP	`https://api.whippy.co/mcp`
OAuth discovery from the server's `401` response	`WWW-Authenticate: Bearer resource_metadata="https://api.whippy.co/.well-known/oauth-protected-resource"`
Dynamic client registration	`https://api.whippy.co/oauth/register`
Authorization code flow with PKCE	`S256` only, public client, no client secret
A sign-in callback Whippy accepts	`http://localhost:8787/callback` for local clients (see below)

Clients that only run local servers (command / stdio) can't connect directly.

The callback requirement

Whippy only sends sign-in results to approved callback URLs. For a local client, that means exactly:

http://localhost:8787/callback

If your client lets you set the OAuth callback port or redirect URI, set it to port 8787 with the path /callback. If your client picks a random port, or uses its own website as the callback, sign-in fails with invalid_redirect_uri. Contact [email protected] with the client name and the callback URL from the error.

The full allow-list is in How sign-in works.

Generic configuration

Most clients accept a JSON entry like this:

{
  "mcpServers": {
    "whippy": {
      "url": "https://api.whippy.co/mcp"
    }
  }
}

Some clients call the key servers, serverUrl, or httpUrl, or need "type": "http" (or "streamable-http"). Check your client's documentation for its remote-server format. Never put a Whippy API key in an MCP configuration; the server rejects it.

Check the server from a terminal

This should return 401 with a WWW-Authenticate header, which proves the server is reachable and tells your client where to sign in:

curl -i -X POST https://api.whippy.co/mcp \
  -H "Content-Type: application/json" \
  -d '{}'

To see the sign-in settings your client discovers:

curl https://api.whippy.co/.well-known/oauth-authorization-server

Too many tools?

If your client limits how many tools it loads, see Tool limits.