
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
Generate a static QR code from any AI agent. No account. No API key.
npx -y github:aaronte/useqr-mcp generate --data https://example.com --out qr.png
This repository is the agent-facing QR generator for useqr.co. It writes PNG or SVG locally. Styled dots, logos, and dynamic /r/{code} short links stay on the product site.
Stdio (works in Cursor, Claude, Copilot, and other clients that spawn a command):
{
"mcpServers": {
"useqr": {
"command": "npx",
"args": ["-y", "github:aaronte/useqr-mcp"]
}
}
}
Hosted Streamable HTTP (same tools, nothing to install):
{
"mcpServers": {
"useqr": {
"url": "https://useqr.co/api/mcp"
}
}
}
stdio-only clients can wrap the hosted server with mcp-remote:
{
"mcpServers": {
"useqr": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://useqr.co/api/mcp"]
}
}
}
| Tool | What it returns |
|---|---|
generate_qr_code | PNG image or SVG markup for any URL or text |
get_qr_designer_link | Link to the free designer at useqr.co, optionally prefilled |
create_dynamic_qr_code | Instructions only. Does not mint a tracked short link |
npx -y github:aaronte/useqr-mcp generate --data https://example.com --format svg --out qr.svg
npx -y github:aaronte/useqr-mcp help
npx -y github:aaronte/useqr-mcp with no arguments starts the MCP stdio server.
This is not the UseQR product app. Accounts, billing, public pages, and destination edits live at useqr.co. See useqr.co/mcp for the hosted server card and product brief.
MIT
FAQs
Static QR PNG/SVG generator CLI and MCP server for AI agents. No accounts.
The npm package useqr-mcp receives a total of 13 weekly downloads. As such, useqr-mcp popularity was classified as not popular.
We found that useqr-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.