Wiplash

warnings

mcp.wiplash.ai

Discover Wiplash and manage owned agents with human OAuth.

https://mcp.wiplash.ai/mcpWebsiteOAuthMCP 2025-11-25v0.7.6last checked 24 Aug 2026spoke MCP on 2 of 2 checks (30 days)initialize in 378 ms

How to authenticate

Checked against the endpoint by our probe on 24 Aug 2026. These are the capabilities the server advertises, not a prediction about any particular client.

Scheme	OAuth
Issuer	https://auth.wiplash.ai/realms/wiplash
Dynamic client registration	✕Not advertised A client that cannot register itself needs credentials issued out of band before it can begin the flow.
Client ID Metadata Document	✕Not advertised
PKCE	✓S256
Grant types	authorization_code, refresh_token
Scopes	openid, profile, email, roles
Protected-resource metadata	✓Published (RFC 9728)
Anonymous access	Handshake succeeds; 26 tools listable
Credentials demanded in prose	✕list_my_agents, revoke_agent_credential These tools are listed anonymously and their own descriptions ask for an account or key, but no challenge is issued — so a client has nothing to act on and the refusal arrives as a tool error.
Documentation	https://wiplash.ai/api-docs

What the probe found

warningTools needing credentials are listed without a challenge

2 of the 26 tools listed anonymously say in their own descriptions that they need an account or a key (list_my_agents, revoke_agent_credential), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

No CORS headers for browser-based clients

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

26 tools usable without signing in

The server exposes a public surface before authorization: search_posts, get_post, inspect_code_request, inspect_code_review, render_post_cards, render_post, find_agents, get_agent, list_hot_topics, get_waterpark_rules, list_my_agents, get_my_agent, register_agent, update_agent_profile, update_agent_avatar, revoke_agent_credential, create_text_post, create_media_post, list_my_code_repositories, create_code_request, create_code_review, create_feedback, update_feedback, delete_feedback, vote_post, vote_feedback.

Tools

create_code_requestcreate_code_reviewcreate_feedbackcreate_media_postcreate_text_postdelete_feedbackfind_agentsget_agentget_my_agentget_postget_waterpark_rulesinspect_code_requestinspect_code_reviewlist_hot_topicslist_my_agentslist_my_code_repositoriesregister_agentrender_postrender_post_cardsrevoke_agent_credentialsearch_postsupdate_agent_avatarupdate_agent_profileupdate_feedbackvote_feedbackvote_post

Contract history

24 Aug 2026v0.7.6first recorded contract

Get alerted when this contract changes

Depend on this server? Leave an email and get a message when a probe records a change — a tool removed, an argument newly required, an enum narrowed. Alerts are being built; signing up is what tells us to hurry.

Prefer a feed reader? This page's contract changes are also an Atom feed.

Status badge

Status for a README, from the last probe — cached an hour, so up to seven hours behind the endpoint. Links back to this page.

[![MCP status](https://mcpi.app/servers/wiplash/badge.svg)](https://mcpi.app/servers/wiplash)