MCP 2.0 (2026-07-28) Streamable HTTP MCP Apps (SEP-1865) Marketplace Ready

WhisQR Developer Documentation

A guide for developers integrating Whisqr through marketplaces (such as mcpize), AI agent gateways, or direct Streamable HTTP connections. Covers server capabilities, multi-layer fallbacks, interactive UI rendering, and optimal agent workflows.

Remote Endpoint: https://whisqr.com/mcp

Quick Connection & Marketplace Setup

Whisqr is accessible over standard Streamable HTTP. It requires no local compilation or binary dependencies on the client runtime.

Parameter Value Notes
Endpoint URL https://whisqr.com/mcp Primary Streamable HTTP endpoint
HTTP Method POST JSON-RPC 2.0 payload over HTTP
Required Header Accept: application/json, text/event-stream Mandatory header for MCP Streamable HTTP
Tracking Base https://whq.at Short redirect domain for dynamic tracked links
Protocol Version 2026-07-28 (MCP 2.0) Stateless execution + legacy SSE backward compatibility
OAuth 2.1 Metadata /.well-known/oauth-authorization-server RFC 8414 / RFC 9728 discovery
Client Configuration Snippet JSON

Add this snippet to your AI client settings (Claude Desktop, Cursor, Goose, Antigravity):

mcpServers.json
{
  "mcpServers": {
    "whisqr": {
      "url": "https://whisqr.com/mcp",
      "headers": {
        "Accept": "application/json, text/event-stream"
      }
    }
  }
}

MCP Tools Reference (9 Tools)

Whisqr exposes 9 active tools categorized by feature area. Every tool returns rich multi-payload results (text summaries, inline base64 images, and structured JSON).

generate_qr_code Interactive UI (ui://qr-app)
Static Generation

Generates static PNG or SVG QR codes from raw text, URLs, or structured data payloads (WiFi, vCard, Calendar, Geo, etc.). Offers interactive resolution export and one-click copying.

Key Parameters
data, structured_type, structured_data, error_correction (L/M/Q/H), size (64–4096), format (png/svg), print_url
Return Package
Markdown summary + Base64 PNG image + structured JSON + _meta.ui
create_tracked_qr_code Interactive UI (ui://qr-app)
Dynamic Tracking

Creates a dynamic tracked QR code with a short redirect URL (whq.at), Google Safe Browsing verification, and real-time visitor analytics. The destination URL can be changed later without reprinting the QR code.

Key Parameters
destination_url (required), label, expires_at (ISO 8601), format, size, print_url
Direct Asset URLs
https://whq.at/:code (redirect) • https://whisqr.com/qr/:code.png (image)
manage_tracked_qr_code Interactive UI (ui://qr-app)
Link Management

Updates an existing tracked link's destination URL, label, expiry timestamp, or visual format without changing the short URL or physical print code.

Key Parameters
code (e.g. "2xK9"), destination_url, label, expires_at
Capabilities
Hot-swap URLs • Clear expiry • Re-render vector SVG
get_qr_scan_stats Analytics

Fetches scan counts, unique visitor IP telemetry, time-series distributions, and cohort breakdowns for any tracked QR code.

Grouping Options
none, daily, weekly, monthly, day_of_week, hour_of_day, user, cohort
Export Formats
json, csv, text, markdown (executive table)
scan_qr_code_with_camera Interactive UI (ui://whisqr-scanner/...)
Live Camera Capture

Opens an interactive camera scanner session for live webcam/mobile scanning, phone handoff QR pairing, or image drag-and-drop. Responds in <50ms with instant session tokens.

Parameters
ttl_minutes (1–60, default 10), label, webhook_url, auto_wait (default false)
Task State
Declares _meta.resultType: 'input_required' + MRTR task lifecycle
get_scan_session_result Capture Retrieval

Retrieves the decoded payload from a camera scan session once the user confirms they completed the capture.

Parameters
token (session token; auto-resolves most recent if omitted)
Statuses
pending, completed (with decoded data), expired
scan_qr_code Image Decoding

Decodes QR codes from pre-existing images without human interaction. Used when an image file, base64 payload, or HTTPS URL is already provided.

Input Modes (Provide One)
image_path, image_base64, or image_url
Outputs
Decoded string, payload classifier, bounding box coordinates
batch_generate_qr_codes Batch Processing

Generates up to 50 QR codes in a single operation. Supports structured payloads for each item, uniform error correction, and parallel rendering.

Parameters
items (array of max 50 objects), format, size, error_correction
Outputs
Batch summary, success counts, item array, inline image attachments
qr_code_info Inspection & Safety

Inspects a QR image non-destructively to decode data and extract technical metadata. When a URL payload is detected (including naked domain names without protocol prefixes), it automatically normalizes the URL and validates it against Google Safe Browsing and local domain rules.

Inputs
image_path or image_base64
Outputs
EC level recovery %, matrix dimensions, structured content mapping, and structured safety: { safe: boolean, error?: string } report

Structured Payload Standards

Instead of manually assembling complex RFC-compliant syntax strings, pass structured_type and structured_data directly to generate_qr_code or batch_generate_qr_codes:

Type Required Fields Optional Fields Encoded Output Syntax
wifi ssid, security (WPA/WEP/nopass) password, hidden WIFI:S:OfficeNet;T:WPA;P:secret123;H:false;;
vcard name email, phone, org, title, url BEGIN:VCARD\nVERSION:3.0\nFN:Jane Doe\n...END:VCARD
calendar summary, start (ISO), end (ISO) location, description BEGIN:VCALENDAR\n...BEGIN:VEVENT\n...END:VCALENDAR
geo lat, lon altitude geo:37.7749,-122.4194
sms phone body smsto:+15551234567:Hello from Whisqr
email to subject, body mailto:contact@whisqr.com?subject=Inquiry
url url https://whisqr.com

Protocol Resilience & Fallback Features

Whisqr is engineered for zero-failure execution across any client generation, terminal window, or sandbox environment.

1. Multi-Payload Dual Content Responses
Tool calls return text summaries, Base64 image attachments, and structuredContent JSON simultaneously. If an AI host interface cannot render binary images, the Markdown text provides direct URLs (e.g. https://whisqr.com/qr/:code.png) so users can view the graphic in any browser.
2. MCP Apps (SEP-1865) UI Fallback
Supporting hosts (Claude Desktop, Claude.ai) receive _meta.ui to render rich interactive iframes with resolution sliders and clipboard tools. Non-UI clients (CLI agents, terminal runtimes) ignore _meta.ui seamlessly and receive standard text and image outputs.
3. MCP 2.0 Stateless Transport + Legacy SSE Fallback
Implements MCP 2.0 stateless HTTP execution (independent requests without handshake or session accumulation), SEP-2549 1-hour capability caching, SEP-2243 edge headers (Mcp-Method/Mcp-Name), and Tasks Extension (MRTR), while maintaining full fallback for legacy stateful SSE connections (/sse + /messages).
4. Four-Layer Camera Scanner Fallback
Live scanning uses native browser BarcodeDetector API → falls back to pure JS jsQR → falls back to in-UI file picker and drag-and-drop → falls back to mobile phone pairing QR codes for desktop users without a webcam.

Workflow Construction Strategies

Constructing reliable agent workflows requires distinguishing between spontaneous conversational flows and repeatable automated pipelines:

Conversational / Spontaneous Decision Tree
Zero-Friction Scan Rule
When a user asks to scan a code and has not attached an image, call scan_qr_code_with_camera on Turn 1 immediately. Do not ask clarifying questions first—the scanner interface automatically handles webcam, phone pairing, and file drop. When the user confirms capture, call get_scan_session_result.
Dynamic vs. Static Tracking Rule
If the user mentions "tracking", "campaign", "analytics", "marketing", or might update the link later, use create_tracked_qr_code. Reserve generate_qr_code strictly for unmonitored offline payloads (WiFi, vCard, plain text).
Repeatable / Automated Pipelines
Dynamic Destination Hot-Swapping
Create a campaign code once via create_tracked_qr_code. Print the permanent image URL (https://whisqr.com/qr/:code.png). Programmatically update the target via manage_tracked_qr_code whenever the campaign destination changes.
Automated Telemetry Harvesting
Query get_qr_scan_stats(code, group_by: "daily", format: "json") on a schedule to pipe scan timeseries and demographic breakdowns directly into your analytics data warehouse.

Recommended Agent System Prompt

Drop this prompt block into your agent's system instructions to guarantee optimal tool selection and decision routing:

agent_system_instructions.md
### Whisqr QR Code Engine Instructions
You have access to the Whisqr MCP Server for professional QR code generation, scanning, tracking, and telemetry.

Routing Rules:
1. LIVE SCANNING: If the user asks to scan, read, or decode a QR code and has not attached an image or image URL, call `scan_qr_code_with_camera` immediately on Turn 1. Present the scanner link to the user. When they confirm completion, call `get_scan_session_result` with the session token.
2. IMAGE DECODING: If an image file path, base64 payload, or image URL is already provided in the prompt, call `scan_qr_code`.
3. DYNAMIC & MARKETING QR: If the user asks for a trackable, dynamic, campaign, or analytics QR code, call `create_tracked_qr_code`. Use `get_qr_scan_stats` to inspect scan telemetry and `manage_tracked_qr_code` to update destinations.
4. STATIC PAYLOADS: Use `generate_qr_code` for unmonitored static payloads (WiFi, vCard, Calendar, SMS, Email, Geo, raw text). Pass `structured_type` and `structured_data` rather than formatting raw strings manually.
5. BATCH OPERATIONS: For multiple codes in one turn, use `batch_generate_qr_codes` (up to 50 items).
6. DIRECT ASSET URLS: You can link directly to rendered QR images using `https://whisqr.com/qr/{code}.png` or `https://whisqr.com/qr/{code}.svg`.

Security & Privacy Compliance

Whisqr implements multiple defense-in-depth layers to safeguard users and infrastructure:

Google Safe Browsing
Tracked URLs and inspected QR code URLs are automatically verified against malware and phishing databases (with protocol-agnostic naked domain normalization).
Cryptographic Codec
Short codes use Base58 + HMAC-SHA256 checksums to detect and block brute-force sequential probing attacks.
GDPR IP Anonymization
Visitor IP addresses are cryptographically salted and hashed before persistence in scan telemetry logs.
OAuth 2.1 Hardening
Strict PKCE (S256), RFC 9207 issuer validation, and RFC 8707 resource indicator scoping.
Copied to clipboard