MCP server

WebPinch ships an MCP  server (@webpinch/mcp) that exposes your tasks, projects, site audits, and stats to Claude Code, Cursor, and any other MCP client.

It’s a thin client over the REST API — same auth, same authorization, same response data. Where the REST API gives you raw HTTP endpoints, MCP gives you tools the model can call directly.

What you get

• 13 tools for reading and writing tasks, projects, audits, and stats
• 4 resources for browseable, mention-able data (projects, tasks, audit reports)
• 3 prompts for common workflows (triage, audit summary, weekly status)
• Pre-flight scope checks so write attempts fail fast with a clear message instead of an HTTP 403

Install

You’ll need:

1. A WebPinch personal access token. Mint at Dashboard → API Tokens.
2. Node 18+ on the machine running the MCP client.

{
  "mcpServers": {
    "webpinch": {
      "command": "npx",
      "args": ["-y", "@webpinch/mcp"],
      "env": {
        "WEBPINCH_TOKEN": "wp_pat_...",
        "WEBPINCH_API_URL": "https://www.webpinch.com"
      }
    }
  }
}

{
  "webpinch": {
    "command": "npx",
    "args": ["-y", "@webpinch/mcp"],
    "env": {
      "WEBPINCH_TOKEN": "wp_pat_...",
      "WEBPINCH_API_URL": "https://www.webpinch.com"
    }
  }
}

Environment variables

The token is read at server startup and never logged or echoed in tool output. Network errors redact it explicitly.

Tools

Read

Write

Output is pruned for token efficiency. List tools never include descriptionHtml or full activity logs — call the matching get_* tool when you need detail.

Scope pre-flight

Write tools fetch your scopes once via whoami and cache them. If you ask the model to do something your token can’t do, the tool throws before any HTTP request:

This action requires the “tasks:write” scope. Your token does not have it. Mint a new token with that scope at /dashboard/settings/api.

Server-side scope enforcement still runs as the source of truth — pre-flight is purely a UX optimization to give the model a useful error message instead of an opaque HTTP 403.

Resources

Resources are URIs the model can pull without you naming a tool. In Claude Code’s resource picker / Cursor’s @-mention:

The Markdown audit report is the friendliest way to feed audit results into a chat — it’s pre-formatted, prioritized, and short.

Prompts

Prompts are saved instructions that compose tools. They show up as slash commands or prompt picks in your client.

triage_new_tasks

Args: projectId?, sinceHours? (default 24).

Pulls tasks created in the last N hours, walks each for context (description, screenshot, reporter), and proposes priority + assignee + a one-sentence rationale as a markdown table. Doesn’t mutate anything — review before applying.

summarize_audit

Args: projectId.

Fetches the latest audit for the project, categorizes findings (Critical / High / Medium / Low), and writes a fix list with affected URLs and one-sentence fixes. Ends with a “Top 3 actions for this week” section.

weekly_status

Args: orgSlug?.

Pulls stats and recent activity, drafts a < 200-word status note in Markdown — what’s new, what’s at risk, per-project progress, what’s coming due.

Hosted HTTP transport

The MCP spec supports both stdio (process-per-client) and Streamable HTTP (hosted) transports. WebPinch runs both, and they expose the same tools, resources and prompts — pick whichever your client supports.

Use ours (no install)

WebPinch hosts an MCP endpoint at https://www.webpinch.com/api/mcp. Nothing to install and nothing to keep running — useful for clients that accept a remote MCP URL, such as the Claude.ai and ChatGPT connectors.

{
  "mcpServers": {
    "webpinch": {
      "url": "https://www.webpinch.com/api/mcp",
      "headers": { "Authorization": "Bearer wp_pat_..." }
    }
  }
}

Authentication is per request via the Authorization header rather than an environment variable, so the same endpoint serves every user — the token decides what you can see. The endpoint is stateless and CORS-enabled.

A GET returns a small discovery document, which is a quick way to confirm reachability:

curl https://www.webpinch.com/api/mcp
# {"ok":true,"name":"webpinch-mcp","version":"0.2.1","transport":"http","endpoint":"/api/mcp"}

Self-host it

If you’d rather run it inside your own network, the same server speaks HTTP:

WEBPINCH_TRANSPORT=http PORT=8787 WEBPINCH_TOKEN=wp_pat_... npx -y @webpinch/mcp

It listens on POST /mcp (and /v1/mcp for compatibility).

Troubleshooting

See also