- Transport: streamable HTTP (the standard MCP HTTP transport). This is not SSE-only and not a stdio server — connect with any MCP client that supports HTTP transports.
- Auth: the same partner API key as the REST API, sent as
Authorization: Bearer whk_…. Unauthenticated requests get401 {"error":"unauthorized"}. - Tools: 20 tools mirroring the REST API’s 20 resource operations (
whistle_list_leagues,whistle_create_games,whistle_assign_official, …) — everything except theGET /api/v1index, which has no tool. Tool results are the REST response’sdatapayload; REST errors surface as tool errors with the sameerrorcode. - Scoping: the server forwards your bearer token to the REST API, so every tool call runs as you — the same source scope and attribution as direct REST calls.
Connect from Claude Code
Use an environment variable — don’t paste the key into the command history:list Whistle leagues to verify the connection with a read-only tool.
Connect from a generic MCP client
Any MCP client configuration that supports HTTP servers with custom headers works. For clients using the common JSON config shape:Check your client’s documentation for how it interpolates environment variables into headers — the goal is that the literal key never lands in a config file you might commit.
The 20 tools
Tools marked ⚠️ are destructive — agents should summarize and get human confirmation before calling them. See Errors & agent safety for the full rules, and Task recipes for end-to-end flows (each recipe notes its MCP tool equivalents).

