
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@open-short-url/mcp
Advanced tools
Model Context Protocol (MCP) Server for Open Short URL, enabling AI assistants to manage your short URL system.
Important: This MCP Server is a client tool for Open Short URL and requires connection to a deployed Open Short URL backend system.
This is not a standalone short URL service, but rather manages your existing short URL system through AI applications that support the MCP protocol.
You need to deploy the Open Short URL backend first:
https://your-backend.com)Don't have a backend system? Visit the main project repository first.
Obtain an API Key from your backend system:
ak_xxxxxxxxxxxxxx)curl -H "Authorization: Bearer YOUR_API_KEY" \
https://your-backend.com/api/urls
78 MCP Tools across 11 modules:
| Module | Tools | Description |
|---|---|---|
| URL Management | 10 | Create, list, update, delete, QR code, bulk operations |
| Bundle Management | 12 | Group URLs, reorder, archive/restore, statistics |
| Analytics | 10 | Click analysis, trends, bot detection, data export |
| A/B Testing | 5 | Create variants, traffic distribution, performance comparison |
| Smart Routing | 8 | Conditional routing rules, templates, geo/device targeting |
| Webhooks | 8 | Event notifications, delivery logs, webhook testing |
| User Management | 11 | Create/manage users, roles, 2FA, OIDC accounts |
| API Keys | 4 | Create, list, view, revoke API keys |
| OIDC/SSO | 5 | Manage OIDC/SSO identity providers |
| System Settings | 4 | View and manage system configuration |
| Audit Logs | 1 | Query system audit trail |
[DESTRUCTIVE] and include confirmation hints for the AI assistantThe MCP server supports two transport modes:
| Mode | Use Case | Protocol |
|---|---|---|
| stdio (default) | CLI and IDE integrations (Claude Desktop, VS Code, etc.) | Standard I/O |
| http | Remote access, containerized deployments, multi-client | Streamable HTTP |
npm install -g @open-short-url/mcp
npx @open-short-url/mcp
{
"mcpServers": {
"open-short-url": {
"command": "open-short-url-mcp",
"env": {
"API_URL": "https://your-backend.com",
"API_KEY": "ak_your_api_key_here"
}
}
}
}
docker run -p 3200:3200 \
-e API_URL=http://your-backend:4101 \
-e API_KEY=ak_your_api_key_here \
ghcr.io/supra126/open-short-url-mcp:latest
The server will be available at http://localhost:3200/mcp.
curl http://localhost:3200/health
Add the mcp profile to your existing Open Short URL deployment:
docker compose --profile mcp up -d
Set MCP_API_KEY in your .env.docker file. See the main project's docker-compose.yml for full configuration.
git clone https://github.com/supra126/open-short-url.git
cd open-short-url/packages/mcp
pnpm install && pnpm build
# stdio mode
API_URL=https://your-backend.com API_KEY=ak_xxx node dist/index.js
# HTTP mode
MCP_TRANSPORT=http API_URL=https://your-backend.com API_KEY=ak_xxx node dist/index.js
| Variable | Required | Default | Description |
|---|---|---|---|
API_URL | Yes | — | Open Short URL backend API URL |
API_KEY | Yes | — | API key for authentication |
MCP_TRANSPORT | No | stdio | Transport mode: stdio or http |
MCP_PORT | No | 3200 | HTTP server port (http mode only) |
MCP_HOST | No | 0.0.0.0 | HTTP bind address (http mode only) |
| Tool | Description |
|---|---|
create_short_url | Create short URL with custom slug, password, expiration, UTM |
list_short_urls | List all short URLs with pagination, search, filtering |
get_short_url | Get short URL details |
update_short_url | Update short URL settings |
delete_short_url | Delete short URL [DESTRUCTIVE] |
get_url_stats | Get URL dashboard statistics |
generate_qrcode | Generate QR code for a short URL |
bulk_create_urls | Bulk create short URLs (max 100) |
bulk_update_urls | Bulk update short URLs |
bulk_delete_urls | Bulk delete short URLs [DESTRUCTIVE] |
| Tool | Description |
|---|---|
create_bundle | Create new bundle |
list_bundles | List all bundles |
get_bundle | Get bundle details |
update_bundle | Update bundle information |
delete_bundle | Delete bundle [DESTRUCTIVE] |
add_url_to_bundle | Add single URL to bundle |
add_multiple_urls_to_bundle | Batch add URLs to bundle |
remove_url_from_bundle | Remove URL from bundle |
update_url_order_in_bundle | Reorder URLs in bundle |
get_bundle_stats | Get bundle statistics |
archive_bundle | Archive bundle |
restore_bundle | Restore archived bundle |
| Tool | Description |
|---|---|
get_url_analytics | URL click analytics (geo, device, browser) |
get_overview_analytics | Overview analytics dashboard |
get_top_performing_urls | Top performing URLs by clicks |
get_recent_clicks | Recent click records |
get_bot_analytics | Bot analysis for single URL |
get_user_bot_analytics | Global bot analysis |
get_ab_test_analytics | A/B test analytics |
get_routing_analytics | Smart routing statistics |
export_url_analytics | Export single URL analytics (CSV/JSON) |
export_all_analytics | Export all analytics data (CSV/JSON) |
| Tool | Description |
|---|---|
create_variant | Create test variant |
list_variants | List all variants |
get_variant | Get variant details |
update_variant | Update variant settings |
delete_variant | Delete variant [DESTRUCTIVE] |
| Tool | Description |
|---|---|
create_routing_rule | Create conditional routing rule |
create_routing_rule_from_template | Create rule from template (geo, device, etc.) |
list_routing_rules | List routing rules for a URL |
get_routing_rule | Get routing rule details |
update_routing_rule | Update routing rule |
delete_routing_rule | Delete routing rule [DESTRUCTIVE] |
update_smart_routing_settings | Update routing settings for a URL |
list_routing_templates | List available routing templates |
| Tool | Description |
|---|---|
create_webhook | Create webhook endpoint |
list_webhooks | List all webhooks |
get_webhook | Get webhook details |
update_webhook | Update webhook settings |
delete_webhook | Delete webhook [DESTRUCTIVE] |
get_webhook_logs | View webhook delivery logs |
test_webhook | Send test webhook event |
retry_webhook_delivery | Retry a failed webhook delivery |
| Tool | Description |
|---|---|
create_user | Create new user |
list_users | List all users |
get_user | Get user details |
update_user_role | Update user role |
update_user_status | Activate/deactivate user |
update_user_name | Update user display name |
delete_user | Delete user [DESTRUCTIVE] |
reset_user_password | Reset user password [DESTRUCTIVE] |
disable_user_2fa | Disable user 2FA [DESTRUCTIVE] |
get_user_oidc_accounts | List user's linked OIDC accounts |
unlink_user_oidc_account | Unlink OIDC account [DESTRUCTIVE] |
| Tool | Description |
|---|---|
create_api_key | Create new API key (shown once, then redacted) |
list_api_keys | List all API keys |
get_api_key | Get API key details |
delete_api_key | Revoke API key [DESTRUCTIVE] |
| Tool | Description |
|---|---|
list_oidc_providers | List OIDC providers |
create_oidc_provider | Create OIDC provider |
get_oidc_provider | Get OIDC provider details |
update_oidc_provider | Update OIDC provider |
delete_oidc_provider | Delete OIDC provider [DESTRUCTIVE] |
| Tool | Description |
|---|---|
get_system_settings | Get all system settings |
get_system_setting | Get a single setting by key |
update_system_setting | Update a system setting |
delete_system_setting | Delete a system setting [DESTRUCTIVE] |
| Tool | Description |
|---|---|
get_audit_logs | Query audit logs with filtering |
API_URL and API_KEY are setcurl -H "Authorization: Bearer YOUR_API_KEY" https://your-backend.com/api/urls
API_URL uses the Docker network hostname (e.g., http://backend:4101) not localhostdocker logs <container-id>curl http://localhost:3200/healthMIT License - see the LICENSE file for details.
FAQs
Model Context Protocol (MCP) Server for Open Short URL
We found that @open-short-url/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.