
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
missinglinkz
Advanced tools
Campaign link infrastructure for AI agents. Validate destinations, build UTM-tracked links, and inspect landing pages for social sharing readiness. CLI, MCP server, and REST API.
Campaign link infrastructure for AI agents. Validate destinations, build UTM-tracked links, and inspect landing pages for social sharing readiness. CLI, MCP server, and REST API.
npm install -g missinglinkz
# 1. Register for a free account (1,000 links/month)
mlz auth register --email you@example.com
# 2. Preflight check — build link + validate + inspect landing page
mlz preflight --url "https://example.com/landing" --campaign "spring-launch" --source "linkedin" --medium "social"
# 3. Check your usage
mlz auth status
The hero command. Builds a UTM link, validates the destination, and inspects the landing page for social sharing readiness — all in one call:
mlz preflight \
--url "https://example.com/landing" \
--campaign "spring-launch" \
--source "linkedin" \
--medium "social"
Returns a comprehensive go/no-go report:
{
"ready": true,
"tracked_url": "https://example.com/landing?utm_source=linkedin&utm_medium=social&utm_campaign=spring-launch",
"checks": [
{ "check": "og_tags", "status": "pass", "message": "All essential Open Graph tags present." },
{ "check": "twitter_card", "status": "pass", "message": "Twitter Card tags configured." },
{ "check": "viewport", "status": "pass", "message": "Viewport meta tag present." },
{ "check": "ssl", "status": "pass", "message": "URL uses HTTPS." },
{ "check": "resolution", "status": "pass", "message": "Destination responded with 200." }
],
"summary": { "total": 12, "passed": 12, "warnings": 0, "failed": 0 },
"recommendation": "All checks passed. Campaign link is ready to publish."
}
mlz build \
--url "https://example.com/landing" \
--campaign "spring-launch" \
--source "linkedin" \
--medium "social" \
--term "ai-tools" \
--content "banner-a"
Add --validate to check the destination URL before building.
Check a URL for social sharing readiness without building a link:
mlz inspect https://example.com/landing
Checks: Open Graph tags, Twitter Cards, viewport, canonical URL, favicon, existing UTM parameters, page load time.
mlz check https://example.com/landing
Checks URL format, HTTPS, resolution, redirect chains, and response time.
mlz campaigns list
mlz campaigns suggest --source linkedin
mlz campaigns suggest --medium email
.mlzconfig.jsonKeep your own UTM values consistent for free with a local config. mlz taxonomy init scaffolds one:
{
"taxonomy": {
"source": ["linkedin", "google", "newsletter"],
"medium": ["social", "cpc", "email"],
"strict": false
}
}
mlz build / mlz preflight then warn on off-allowlist values (or fail with strict: true / --strict). It's self-enforced and local — a single-player taste of governance. The Team plan adds the shared, server-enforced dictionary below, which applies across every seat, CI run, and agent and can't be bypassed by editing a file.
mlz taxonomy allow --medium social email cpc # define allowed mediums
mlz taxonomy strict --on # reject off-dictionary values
mlz taxonomy list # view mode + dictionary
An account is a shared workspace. Each active API key is a seat — all seats share the same campaigns, links, and taxonomy. The owner can mint up to 5 seat keys on Team (1 on Free):
mlz seats list # seats + plan cap
mlz seats create --label "alice" # mint a seat key (shown once)
mlz seats revoke --id key_xxxxxxxx # revoke a seat
Add --share to publish a preflight result at a public, unguessable URL a teammate can open without an account:
mlz preflight --url "https://example.com/landing" \
--campaign "launch" --source "linkedin" --medium "social" --share
# → report: { id, url } → https://api.missinglinkz.io/r/<id>
mlz links list
mlz links list --campaign "spring-launch" --limit 10
# Register a new account
mlz auth register --email you@example.com
# Log in with an existing key
mlz auth login --key mlz_live_...
# Check plan, usage, and limits
mlz auth status
All commands output JSON by default. Add --format human for readable output:
mlz preflight --url "..." --campaign "..." --source "..." --medium "..." --format human
MissingLinkz exposes all functionality as MCP tools. Start the server:
mlz mcp
Add to your MCP config:
{
"mcpServers": {
"missinglinkz": {
"command": "mlz",
"args": ["mcp"],
"env": {
"MLZ_API_KEY": "mlz_live_..."
}
}
}
}
| Tool | Description |
|---|---|
mlz_preflight | Pre-publish campaign link check (build + validate + inspect) |
mlz_build_link | Generate a UTM-tagged link |
mlz_inspect_destination | Inspect URL for social sharing readiness |
mlz_validate_url | Validate URL (SSL, resolution, redirects) |
mlz_list_campaigns | List all campaigns |
mlz_suggest_naming | Suggest consistent naming for sources/mediums |
mlz_get_taxonomy | Read strict-mode state + allowed source/medium dictionary |
mlz_set_taxonomy | Configure strict taxonomy: allow/disallow values, toggle enforcement (Team) |
mlz_list_seats | List workspace seats (API keys), plan seat cap, and usage |
mlz_manage_seats | Mint/revoke workspace seat keys (Team, owner only) |
mlz_list_links | List recently generated links |
mlz_check_usage | Check API usage and remaining quota |
mlz_register | Register a new account |
Every capability is also available over HTTP at https://api.missinglinkz.io — the surface for non-Node backends, HTTP-only agents (e.g. ChatGPT Actions), serverless functions, and any language that can make a POST request. Pass your key as Authorization: Bearer mlz_live_....
| Method & path | Description |
|---|---|
POST /v1/preflight | Build + validate + inspect in one call. Returns the full go/no-go report and stores the link. Body: { url, source, medium, campaign, term?, content? } |
POST /v1/inspect | Inspect a destination for social-sharing readiness (OG tags, Twitter Card, viewport, canonical, favicon). Body: { url } |
POST /v1/links | Build + store a UTM link. Body: { url, source, medium, campaign, term?, content? } |
GET /v1/links | List recent links |
GET /v1/campaigns | List campaigns |
GET /v1/taxonomy | Strict-mode state + allowed source/medium dictionary |
POST /v1/taxonomy/terms | Add allowed values (Team). Body: { field, values } |
PUT /v1/taxonomy/mode | Toggle strict enforcement (Team). Body: { strict } |
GET /v1/seats | List workspace seats + plan seat cap |
POST /v1/seats | Mint a seat API key (Team, owner only). Body: { label? } |
DELETE /v1/seats/:id | Revoke a seat key (owner only) |
POST /v1/reports | Store a shareable preflight report (Team). Returns { id, url } |
GET /v1/reports/:id | Report JSON — public (anyone with the link) |
GET /r/:id | Public HTML report page |
GET /v1/auth/status | Plan, usage, and remaining quota |
POST /v1/preflight accepts share: true (Team) and returns a public report: { id, url }.
| POST /v1/auth/register | Create an account, returns an API key. Body: { email } |
| GET /v1/auth/verify | Confirm email (from the verification link); unlocks the full free quota |
| POST /v1/auth/resend | Resend the verification email. Body: { email } |
When strict taxonomy is on (Team plan), POST /v1/links and POST /v1/preflight return 422 TAXONOMY_VIOLATION for any source/medium not in the account's dictionary.
curl -s -X POST https://api.missinglinkz.io/v1/preflight \
-H "Authorization: Bearer $MLZ_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url":"https://example.com/landing","source":"linkedin","medium":"social","campaign":"spring-2026"}'
The REST preflight/inspect endpoints run the same validation engine as the CLI and MCP server, so all three surfaces return identical checks.
Rate limits. Endpoints are rate-limited per IP on top of the monthly quota: register/claim 10/min, /v1/links 60/min, /v1/preflight and /v1/inspect 30/min. Exceeding a limit returns 429 RATE_LIMITED with a Retry-After header.
Email verification. When the API is configured with an email provider (RESEND_API_KEY), a new free account gets its API key immediately but a reduced quota (50 links/month) until the email is verified — then the full 1,000 unlocks. This deters mass account farming without blocking instant onboarding. When no provider is configured, accounts are auto-verified and get the full 1,000 right away.
| Check | What it detects |
|---|---|
| URL format | Invalid or malformed URLs |
| SSL | HTTP vs HTTPS |
| Resolution | 404s, 500s, unreachable destinations |
| Redirects | Long redirect chains, lost UTM params |
| Response time | Slow pages that cause bounce |
| OG tags | Missing og:title, og:description, og:image |
| Twitter Card | Missing twitter:card, twitter:title |
| Viewport | No mobile viewport meta tag |
| Canonical | Canonical URL differs from destination |
| Favicon | No favicon for browser tabs |
| UTM conflicts | Destination already has UTM parameters |
| Variable | Required | Description |
|---|---|---|
MLZ_API_KEY | No (required for API features) | Your MissingLinkz API key. Offline UTM generation works without it. |
MLZ_API_URL | No | Override API URL (default: https://api.missinglinkz.io) |
MLZ_FORMAT | No | Default output format: json (default) or human |
Config is stored in ~/.missinglinkz/config.json. Env vars take priority.
Normalization (all plans). Every source, medium, and campaign is cleaned automatically:
"Spring Launch 2026" becomes "spring-launch-2026". Use mlz campaigns suggest --source linkedin to get naming suggestions based on what you've used before.
Strict taxonomy enforcement (Team plan). Define a dictionary of allowed source/medium values and turn on strict mode. After that, building or preflighting a link with an off-dictionary value is rejected (not just warned) — so "social" can be the only allowed medium and fb gets blocked. This is the governance layer that keeps tracking consistent across a whole team.
mlz taxonomy allow --medium social email cpc # define the allowed mediums
mlz taxonomy allow --source linkedin google # define the allowed sources
mlz taxonomy strict --on # enforce — off-dictionary values now rejected
mlz taxonomy list # view mode + dictionary
When a value is rejected, the API returns a TAXONOMY_VIOLATION error listing the allowed values. An empty dictionary for a field leaves that field unconstrained, so you can roll it out one field at a time.
| Plan | Price | Links/month | For |
|---|---|---|---|
| Free | $0 | 1,000 | Solo devs, AI agents, hobby projects |
| Team | $49/mo | Unlimited | RevOps + marketing teams that need governance |
| Enterprise | Contact | Unlimited + SLA | Larger orgs with compliance / SSO needs |
Free tier requires no credit card and includes the full CLI, MCP server, and API. Pay for governance, not volume. The Team plan unlocks taxonomy enforcement, shared workspace (5 seats), and shareable preflight reports — the things that matter when more than one person is publishing links. Every plan runs in CI/CD with pass/fail exit codes; Team adds pipeline enforcement of your shared taxonomy, so off-dictionary links fail the build.
Publishing campaign links without validation is the most common source of silent marketing waste:
A single mlz preflight call catches all of these problems before publishing.
MissingLinkz is designed for automation. Common integration points:
mlz preflight — validates the destination, checks social sharing readiness, and builds the UTM link in one callnpm install -g missinglinkz → mlz auth register --email owner@example.com → mlz preflightThis package includes a SKILL.md file for agent discovery via OpenClaw and Claude Code. It documents all commands, capabilities, and environment variables needed to use MissingLinkz.
MIT
FAQs
Campaign link infrastructure for AI agents. Validate destinations, build UTM-tracked links, and inspect landing pages for social sharing readiness. CLI, MCP server, and REST API.
We found that missinglinkz demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.