WebLineup MCP server documentation
WebLineup exposes its search, website generation and prospect-management features as a remote Model Context Protocol server for Claude, ChatGPT and other MCP clients.
Last updated
Endpoint
| Item | Value |
|---|---|
| MCP endpoint | https://weblineup.com/mcp |
| Transport | Streamable HTTP (POST, JSON responses; stateless - no session id) |
| Protocol versions | 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05 |
| Authentication | OAuth 2.1 authorization code + PKCE (S256), bearer access tokens |
| Protected resource metadata | https://weblineup.com/.well-known/oauth-protected-resource/mcp |
| Authorization server metadata | https://weblineup.com/.well-known/oauth-authorization-server |
| Client registration | Dynamic client registration (RFC 7591), public clients only |
| Scope | mcp |
GET and DELETE requests to the endpoint return 405: the server opens no server-initiated streams and keeps no sessions, which the Streamable HTTP specification allows.
Authentication
A request without a valid token receives 401 with a WWW-Authenticate header pointing at the protected resource metadata (RFC 9728). Clients follow it to the authorization server metadata (RFC 8414), register themselves, and send the user to the consent page at /oauth/authorize.
- Access tokens are opaque, expire after 1 hour, and are stored only as SHA-256 hashes.
- Refresh tokens last 30 days and rotate on every use. Reusing an old refresh token revokes the whole connection.
- Authorization codes are single-use, expire after 5 minutes and are bound to the client, redirect URI and PKCE challenge.
- A password change or account suspension invalidates every connection. Users can disconnect any time from Dashboard, then AI; the token endpoint also supports RFC 7009 revocation at /oauth/revoke.
- Redirect URIs must be https, loopback http, or an app-specific scheme; they are matched exactly.
Tools
| Tool | What it does | Uses quota |
|---|---|---|
| search_businesses | Find businesses by category and city and flag those with no website | Lead quota (confirmation required) |
| find_more_businesses | Fetch the next batch of results for an earlier search | Lead quota (confirmation required) |
| get_search_results | Fetch and page through a search's results | Nothing extra |
| list_searches | List recent searches | Nothing |
| get_business_details | Contact details, hours, social links, lead status and site for one business | Nothing |
| generate_website | Build an AI preview website for a business | One site credit (confirmation required) |
| get_website_status | Check whether a business's site is ready and get its preview link | Nothing |
| list_websites | List generated websites | Nothing |
| list_prospects | List saved prospects with CRM status and notes | Nothing |
| manage_prospect | Set a prospect's CRM status and append notes | Nothing |
| draft_outreach | Draft an email, SMS, WhatsApp message or call script (never sent) | Nothing (rate limited) |
| get_account_usage | Plan and remaining monthly quota | Nothing |
Every tool declares a title and the readOnlyHint, destructiveHint, idempotentHint and openWorldHint annotations. No tool deletes data or sends messages. Tool results are structured JSON (also mirrored as text), bounded in size, and carry a notice that business names and notes are untrusted third-party data.
Confirmation and idempotency
- search_businesses, find_more_businesses and generate_website take confirm (default false). With confirm false they return what the action would use and change nothing.
- search_businesses accepts an optional idempotencyKey; without one, an identical search within about ten minutes reuses the existing run. A retried call never starts a second billable search.
- generate_website is idempotent per business: an existing site is returned without using quota, and a failed generation releases its reservation.
Limits and errors
- Subscription and quotas are enforced exactly as in the dashboard. An account without an active plan gets a tool error with code SUBSCRIPTION_REQUIRED; exhausted quota returns QUOTA_EXCEEDED.
- Requests are rate limited per account (120 per minute overall, 20 per minute for paid actions and outreach drafts). Exceeding returns HTTP 429 or a RATE_LIMITED tool error.
- Request bodies are limited to 256 KB. Unknown ids and ids belonging to other accounts return the identical "not found" result.
- Validation problems come back as tool errors (isError true) listing the offending fields, so a model can correct and retry.
Try it
npx @modelcontextprotocol/inspector
# Transport: Streamable HTTP
# URL: https://weblineup.com/mcp
# Then use "Open Auth Settings" / Connect to sign in.Setup guides for specific assistants are on the Claude and ChatGPT integration pages. Support: support@weblineup.com.
Frequently asked questions
- Does the server support Streamable HTTP?
- Yes. Clients POST JSON-RPC messages to the endpoint and receive JSON responses. The server is stateless and does not use sessions.
- Which OAuth features does it support?
- Authorization code with PKCE S256, refresh token rotation, dynamic client registration, protected resource and authorization server metadata, and token revocation. It does not support client secrets or the implicit flow.
- Can tools delete data?
- No tool deletes anything. The only write operations are creating searches and sites (confirmed, quota-checked) and updating a prospect's status and notes.
Related
Find your first businesses without websites.
Get started