Protocol and limits
Transport, protocol versions, request headers, capabilities and rate limits of the Wigoo MCP server.
Transport
The server speaks the Streamable HTTP transport at a single URL:
https://api.getwigoo.com/api/mcp- It answers
POSTrequests. AGETor aDELETEreturns405, because there is no long-lived stream to open and no session to close. - It keeps no session. Every request stands on its own, and no
Mcp-Session-Idis issued. - Every request finishes within seconds. A call never leaves a stream open: the response ends when the single message has been sent, and the platform cuts anything still open after 30 seconds.
- It is public. No API key, no OAuth, no sign in.
- It sends no CORS headers, so browser JavaScript on another site cannot call it. Call it from a server, an agent runtime or an MCP client.
Request headers
Every POST needs these two headers:
| Header | Value |
|---|---|
content-type | application/json |
accept | application/json, text/event-stream |
Both values must be in accept. Without them the server answers 406, and with another content type it answers 415.
Protocol versions
The server answers two generations of the protocol at the same URL, and an MCP SDK picks the right one by itself.
The classic handshake: initialize, then the notifications/initialized notification, then requests. The reply is a single server-sent event.
curl https://api.getwigoo.com/api/mcp \
-H 'content-type: application/json' \
-H 'accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize",
"params":{"protocolVersion":"2025-06-18","capabilities":{},
"clientInfo":{"name":"my-agent","version":"1.0.0"}}}'curl https://api.getwigoo.com/api/mcp \
-H 'content-type: application/json' \
-H 'accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","method":"notifications/initialized"}'A notification gets 202 and no body. Because the server keeps no session, the handshake is a formality: a tools/list or tools/call request also works on its own.
Methods
| Method | 2025-06-18 | 2026-07-28 |
|---|---|---|
initialize | yes | not used |
notifications/initialized | yes | accepted, ignored |
server/discover | not used | yes |
ping | yes | removed from the protocol |
tools/list | yes | yes |
tools/call | yes | yes |
subscriptions/listen | not used | answered, closes at once |
Anything else, such as resources/list or prompts/list, returns the JSON-RPC error -32601: the server has tools and nothing else.
Capabilities
{ "tools": { "listChanged": false } }tools: the four tools. They are the same on every request.listChanged: false: the tool list never changes during a connection, so the server never sends a list-changed notification. A client that asks to be notified throughsubscriptions/listengets an acknowledgement with an empty filter and the stream ends immediately.- There are no resources, no prompts and no logging, and the server never asks the client for anything (no sampling, no elicitation).
Responses
A tools/call reply carries the tool's JSON as text in result.content[0].text. Parse it. Treat responses as open: new optional fields may appear, so ignore the ones you do not know.
Depending on the protocol version, the reply is plain JSON (application/json) or a single server-sent event (text/event-stream, one event: message frame with a data: line). A client that accepts both, as the accept header above says, handles either.
Rate limits
A per-IP limit of 300 requests per minute applies to the server. It is generous on purpose, because assistants call from a few addresses shared by all their users. A normal conversation makes a handful of calls. If you ever receive 429, wait a few seconds and retry.
Related
Checkout without an account
How a traveler, or an agent buying for them, completes a Wigoo purchase with an email and a payment, and the exact button labels in eight languages.
Errors
The three kinds of error the Wigoo MCP server returns, with the exact messages, and what a client should do about each.