
Company News
AWS Security Hub Adds Socket for Supply Chain Security
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.
whooshly-mcp
Advanced tools
Create short links, dynamic QR codes, UTM templates, hosted vCards, and landing pages with lead capture from your AI assistant. A zero-dependency stdio bridge to Whooshly's hosted MCP server (also connectable directly by URL from claude.ai and ChatGPT).
Give your AI assistant a campaign-link toolkit. Whooshly exposes a hosted Model Context Protocol server so Claude, ChatGPT, and any MCP client can create short links, dynamic QR codes, UTM templates, hosted vCard pages, and landing pages with lead capture – and read back real click/scan analytics – directly from a conversation.
"Shorten this launch URL, make a QR for the flyer, and save a UTM template for the paid-social campaign" → three tools, one message, links you actually own.
whooshly.co with live click trackingThe server is hosted – there's nothing to run for URL-based clients. This npm package is a small stdio bridge for clients that don't yet speak remote MCP (e.g. Claude Desktop) and for npx convenience.
Every tool acts on your Whooshly account, so you need a token:
Reads and writes require the one-time Core unlock; get_billing_status works on any account so an agent can check before it acts.
Add a Custom Connector pointing at the remote server. Claude runs the OAuth flow in-browser; approve it and the tools appear.
https://app.whooshly.co/api/mcp
Settings → Connectors → Add custom connector → paste the URL.
Add a connector / custom MCP server with the same URL:
https://app.whooshly.co/api/mcp
claude mcp add whooshly --transport http https://app.whooshly.co/api/mcp
Then authenticate with /mcp inside Claude Code, or pass a token header:
claude mcp add whooshly --transport http https://app.whooshly.co/api/mcp \
--header "Authorization: Bearer $WHOOSHLY_TOKEN"
For clients that only speak stdio, use this package. Add it to your claude_desktop_config.json:
{
"mcpServers": {
"whooshly": {
"command": "npx",
"args": ["-y", "whooshly-mcp"],
"env": {
"WHOOSHLY_TOKEN": "your-agent-token"
}
}
}
}
That's it – restart the client and the Whooshly tools are available.
| Tool | What it does | Access |
|---|---|---|
get_billing_status | Check whether the account has unlocked Core / Pro | any |
create_link | Create a short link → id, slug, short URL | Core |
list_links | List your links, newest first (cursor-paged) | Core |
get_link_stats | Exact click/scan totals + daily series for a link | Core |
create_qr | Create a dynamic QR code, returned as a scannable PNG | Core |
get_qr | Re-fetch a saved QR code as a PNG | Core |
create_utm | Save a reusable UTM template | Core |
list_utm | List saved UTM templates | Core |
create_vcard | Create a hosted digital business card (vCard) page | Core |
create_page | Create a landing page on your subdomain from content blocks | Core |
update_page | Edit a page's blocks, theme, or slug – never deletes | Core |
list_pages | List your landing pages with lead counts | Core |
get_page | One page's content, lead count & webhook delivery rollup | Core |
search | Search your links by slug/destination (deep-research) | Core |
fetch | Fetch full details of one link by id (deep-research) | Core |
All read tools are annotated readOnlyHint; write tools can only create or edit – an agent can never delete anything, never read your leads' personal details (counts only), and never see or change a lead webhook. Every tool operates only on your own account (openWorldHint: false).
Once connected, try:
summer26 and show me the QR code."paid-social with source instagram, medium cpc, campaign summer-launch."summer26 link get this week?"| Env var | Default | Purpose |
|---|---|---|
WHOOSHLY_TOKEN | – | Required for the stdio bridge. Your agent token. |
WHOOSHLY_MCP_URL | https://app.whooshly.co/api/mcp | Override the endpoint (self-host / staging). |
WHOOSHLY_API_TOKEN is accepted as an alias for WHOOSHLY_TOKEN.
whooshly-mcp reads newline-delimited JSON-RPC from stdin, POSTs each message to the hosted server with your bearer token, and writes the correlated reply to stdout. It has zero npm dependencies (Node 18+ built-ins only), so it's small and easy to audit – the entire bridge is one file: bin/whooshly-mcp.mjs.
The heavy lifting – auth, rate limits, entitlement checks, QR rendering, analytics – all happens server-side on Whooshly. The bridge is a transport shim, nothing more.
https://app.whooshly.co/api/mcpMIT © Whooshly
FAQs
Create short links, dynamic QR codes, UTM templates, hosted vCards, and landing pages with lead capture from your AI assistant. A zero-dependency stdio bridge to Whooshly's hosted MCP server (also connectable directly by URL from claude.ai and ChatGPT).
We found that whooshly-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.