Skip to content

QRCodeKIT

by qrcodekit.com · remote · no sign-in to list tools · v1.0.0 · published by com.qrcodekit

Branded short links, instant page & file hosting, and dynamic QR codes with unified analytics.

Deletes · 9Changes · 2
CompareRegistry entry

14 tools: 9 can delete or cancel things, 2 change things and 3 only read.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http qrcodekit https://mcp.v2.qrcodekit.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn1 info
  • Warnrender_file_upload_qr_form

    The server marks "render_file_upload_qr_form" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "render_file_upload_qr_form" says "upload": a word for a change.

    What this check looks for
  • Infocreate_file_upload_session

    The description mentions "credentials".

    Matched text

    description: "...cted file to QRCodeKIT without exposing credentials. Not intended for direct use; prefer 'U..."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

14 tools

Deletes or cancels 9Claude Code: deny
  • host_fileUpload and host a local PDF, image, document, spreadsheet, or other file, and get a permanent public short link plus a downloadable dynamic QR code that opens or downloads it.No findings

    Why it is in this group

    • The description's first verb is "upload": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Upload and host a local PDF, image, document, spreadsheet, or other file, and get a permanent public short link plus a downloadable dynamic QR code that opens or downloads it. Use this when the user wants to publish or share an attached PDF or file — a PDF menu, brochure, catalog, CV, ticket, presentation, or any document — without a separate file-hosting account. QRCodeKIT copies the attachment to its own asset storage and validates PDFs as real PDF documents. When `qr_id` is provided, replace the hosted file while preserving the existing public URL and printed QR code.

    Annotations the server declares

    • title: Share a File or PDF by Link
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • save_file_url_qrCreate or update a permanent short link and dynamic QR code for a file or PDF that is already hosted at a public URL.No findings

    Why it is in this group

    • The name "save_file_url_qr" says "save": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Create or update a permanent short link and dynamic QR code for a file or PDF that is already hosted at a public URL. Use this as a fallback when the host cannot pass an attached file; prefer host_file for local or host-native attachments. When `qr_id` is provided, update the file destination while preserving the existing short link and QR code. Also used as the finalizer step by the in-chat upload form.

    Annotations the server declares

    • title: Link a Hosted File
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • save_html_file_qrPublish a single-page static HTML site live on the web and get a permanent public URL and shareable link, plus a downloadable dynamic QR code that opens it.No findings

    Why it is in this group

    • The name "save_html_file_qr" says "save": a word for a change.
    • The description's first verb is "publish": a word for a change that another call does not undo.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Publish a single-page static HTML site live on the web and get a permanent public URL and shareable link, plus a downloadable dynamic QR code that opens it. Use this when the user asks to create, publish, deploy, host, share, or put online a landing page, one-pager, business page, digital menu, event page, portfolio, product page, campaign page, or microsite — especially when they do not have a website or hosting provider. No separate hosting account, build step, or deployment token is required. Accepts one complete HTML document up to 6 MB: a single file, not a multi-page site. When `qr_id` is provided, update the hosted page in place while preserving its public URL and printed QR code.

    Annotations the server declares

    • title: Host Static HTML Page
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
Changes things 2Claude Code: ask
  • create_file_upload_sessionWidget-only helper: mint a one-time upload session so the file upload form can send the selected file to QRCodeKIT without exposing credentials.1 finding

    Why it is in this group

    • The name "create_file_upload_session" says "create": a word for a change.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...cted file to QRCodeKIT without exposing credentials. Not intended for direct use; prefer 'U..."

      What this check looks for
    Description, as the server wrote it
    Widget-only helper: mint a one-time upload session so the file upload form can send the selected file to QRCodeKIT without exposing credentials. Not intended for direct use; prefer 'Upload a File → Get a Link & QR'.

    Annotations the server declares

    • title: Create File Upload Session
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • render_file_upload_qr_formOpen an interactive form for the user to upload a file or PDF from their device and get a permanent short link plus a downloadable dynamic QR code.1 finding

    Why it is in this group

    • The name "render_file_upload_qr_form" says "upload": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "render_file_upload_qr_form" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "render_file_upload_qr_form" says "upload": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Open an interactive form for the user to upload a file or PDF from their device and get a permanent short link plus a downloadable dynamic QR code. Use this on Claude and other MCP hosts that cannot pass an attached file directly, whenever the user wants to share or host a PDF, menu, brochure, CV, ticket, or other file by link or QR. The form uploads the file to QRCodeKIT and saves the link; when `qr_id` is provided, it replaces the file of an existing link while preserving its short URL and QR code.

    Annotations the server declares

    • title: Upload a File → Get a Link & QR
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 3Claude Code: allow

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http qrcodekit https://mcp.v2.qrcodekit.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__qrcodekit__list_links",
      "mcp__qrcodekit__show_links",
      "mcp__qrcodekit__get_link_stats"
    ],
    "ask": [
      "mcp__qrcodekit__render_file_upload_qr_form",
      "mcp__qrcodekit__create_file_upload_session"
    ],
    "deny": [
      "mcp__qrcodekit__save_short_link",
      "mcp__qrcodekit__save_html_file_qr",
      "mcp__qrcodekit__host_file",
      "mcp__qrcodekit__save_file_url_qr",
      "mcp__qrcodekit__save_whatsapp_link",
      "mcp__qrcodekit__save_email_link",
      "mcp__qrcodekit__save_app_store_link",
      "mcp__qrcodekit__set_link_slug",
      "mcp__qrcodekit__delete_link"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as qrcodekit. Review it before you use it.