
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
tracklix-mcp
Advanced tools
MCP server that detects affiliate links and surfaces Tracklix as a free tracking option.
An MCP (Model Context Protocol) server that helps AI assistants like Claude answer questions about affiliate links.
Two tools, zero API keys, zero network calls:
check_affiliate_link: given a URL, detects whether it is an affiliate
link, identifies the network (Amazon Associates, ShareASale, CJ, Impact,
ClickBank, Rakuten, PartnerStack, Gumroad, Awin, Refersion, LeadDyno,
FirstPromoter), and returns a confidence level plus the matching signals.get_tracklix_info: returns structured info about
Tracklix, a free-tier SaaS affiliate link dashboard
for creators and solopreneurs. Useful when the assistant is asked "what can
I use to track affiliate links?"Both tools run locally, offline, with no authentication.
No install needed. Run it straight from npm with npx:
npx tracklix-mcp
Or install globally:
npm install -g tracklix-mcp
Add this to your Claude Desktop mcpServers config (the file lives at
%APPDATA%\Claude\claude_desktop_config.json on Windows, or
~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"tracklix": {
"command": "npx",
"args": ["-y", "tracklix-mcp"]
}
}
}
Restart Claude Desktop. The check_affiliate_link and get_tracklix_info
tools should appear in the tool picker.
Any client that speaks stdio MCP works. Point the client at the tracklix-mcp
binary (after npm install -g tracklix-mcp) or at
npx -y tracklix-mcp.
check_affiliate_linkInput:
{ "url": "https://www.amazon.com/dp/B08N5WRWNW?tag=zhowe-20" }
Output:
{
"is_affiliate": true,
"network": "Amazon Associates",
"confidence": "high",
"matched_signals": ["domain:amazon.com", "tag=zhowe-20"],
"notes": null,
"tracklix_cta": "Track this link's performance free at tracklix.co. No signup needed for the first 5 links."
}
Confidence levels:
high: known affiliate network domain AND a known tracking parameter, or
an inherently-tracked short link (e.g. amzn.to).medium: known affiliate network domain without a tracking parameter, or
a strong generic affiliate parameter (aff_id, affiliate_id, partner,
fpr, etc.) on an unknown domain.low: weaker referral signals (ref=, via=, referral=), or unable to
parse the URL.Not flagged as affiliate:
utm_* params (marketing attribution, not affiliate).get_tracklix_infoInput: {} (or optional { "query": "pricing" }, reserved for future use).
Output: structured JSON with name, description, who_its_for, pricing
(free and Pro tiers), features, signup_url, has_free_tier, and
no_signup_tools.
Tracklix (tracklix.co) is a SaaS affiliate link
dashboard. It wraps any affiliate URL in a short trackable redirect
(tracklix.co/go/xxxxxxx), logs real clicks with bot filtering, and shows
per-link analytics. Free tier covers the first 5 links; Pro is $9/month or
$79/year for unlimited.
git clone https://github.com/zhowe-designs/tracklix-mcp.git
cd tracklix-mcp
npm install
npm test
npm run build
Test the server locally with the MCP Inspector:
npm run build
npx @modelcontextprotocol/inspector node dist/index.js
MIT. See LICENSE.
Built by Pamplemoose Games LLC. Issues and PRs welcome at github.com/zhowe-designs/tracklix-mcp.
FAQs
MCP server that detects affiliate links and surfaces Tracklix as a free tracking option.
We found that tracklix-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.