Gajo URL Shortener
by gajo.io · remote · no sign-in to list tools · v1.1.0 · published by io.gajo
Shorten URLs, manage gajo.io short links, and read click analytics. Free account, no credit card.
9 tools: 3 can delete or cancel things, 4 change things and 2 only read.
Scanned Oct 21, 2026
- Deletes or cancels3Claude Code: deny: see these tools
- Can't be undone0Claude Code: ask
- Changes things4Claude Code: ask: see these tools
- Only reads2Claude Code: allow: see these tools
2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http url-shortener https://gajo.io/mcpFindings
Matches of fixed checks, with the text they matched.
- Warnget_url
The server marks "get_url" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "get_url" says "get": a word for reading.
- Warnget_url_stats
The server marks "get_url_stats" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "get_url_stats" says "get": a word for reading.
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
9 tools
Deletes or cancels 3Claude Code: deny
deactivate_urlTurn off one of your short links so it stops redirecting, keeping its destination and clicks.No findings
Why it is in this group
- The input takes a statement or command to run (input.code), which can change anything it can reach.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Turn off one of your short links so it stops redirecting, keeping its destination and clicks. Generated codes are never reassigned; use reactivate_url to turn the link back on, or delete_url to erase it for good.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
delete_urlPermanently delete one of your short links: its destination and click history are erased and it stops redirecting.No findings
Why it is in this group
- The name "delete_url" says "delete": a word for removing or ending something.
- The description says "Permanently delete".
- The input takes a statement or command to run (input.code), which can change anything it can reach.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Permanently delete one of your short links: its destination and click history are erased and it stops redirecting. It can't be undone or reactivated, and the code is never given to anyone else. Use it when a destination shouldn't be kept, e.g. a URL with a private token; to just switch a link off, use deactivate_url.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
update_urlPro only: point an existing short link at a new destination URL.No findings
Why it is in this group
- The name "update_url" says "update": a word for a change.
- The input takes a statement or command to run (input.code), which can change anything it can reach.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Pro only: point an existing short link at a new destination URL. Takes effect immediately.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
Changes things 4Claude Code: ask
get_urlLook up one of your short links by code: destination, click count, status, and expiry.1 finding
Why it is in this group
- The name "get_url" says "get": a word for reading.
- The input takes a statement or command to run (input.code), which can change anything it can reach.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "get_url" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "get_url" says "get": a word for reading.
Description, as the server wrote it Look up one of your short links by code: destination, click count, status, and expiry. Use get_url_stats for clicks per day and where they came from.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_url_statsGet click analytics for one of your links, bots excluded: total clicks and clicks per day (7 days on Free, 90 on Basic, every day since the link was created on Pro).1 finding
Why it is in this group
- The name "get_url_stats" says "get": a word for reading.
- The input takes a statement or command to run (input.code), which can change anything it can reach.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "get_url_stats" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "get_url_stats" says "get": a word for reading.
Description, as the server wrote it Get click analytics for one of your links, bots excluded: total clicks and clicks per day (7 days on Free, 90 on Basic, every day since the link was created on Pro). Basic and Pro also get referrers, devices, countries, and regions.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
reactivate_urlTurn a link you deactivated back on, with its same code and destination.No findings
Why it is in this group
- The input takes a statement or command to run (input.code), which can change anything it can reach.
Description, as the server wrote it Turn a link you deactivated back on, with its same code and destination. Expired links, links disabled as unsafe, and custom codes that were unassigned can't be reactivated; create a new link instead.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
shorten_urlCreate a gajo.io short link for a URL and return it as shortUrl.No findings
Why it is in this group
- The description's first verb is "create": a word for a change.
Description, as the server wrote it Create a gajo.io short link for a URL and return it as shortUrl. Links follow your plan's code length and lifetime and count against its monthly quota. Pro plans can pass customCode for a branded gajo.io/c/{code} link, or shorten app deep links (myapp://...) with a web fallbackUrl.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
Only reads 2Claude Code: allow
get_usageShows your plan and quota: links created and remaining this month, maximum link lifetime, and API requests per minute.No findings
Why it is in this group
- The name "get_usage" says "get": a word for reading.
Description, as the server wrote it Shows your plan and quota: links created and remaining this month, maximum link lifetime, and API requests per minute. Call it before creating many links or after a monthly-limit error; the allowance resets on the 1st of each month (UTC).
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_urlsList your short links, newest first, with click counts.No findings
Why it is in this group
- The name "list_urls" says "list": a word for reading.
Description, as the server wrote it List your short links, newest first, with click counts. Use it to browse or to find a link's code; for one known code use get_url, and for clicks over time get_url_stats. Returns one page; use page to see more.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 1.1.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http url-shortener https://gajo.io/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__url-shortener__list_urls",
"mcp__url-shortener__get_usage"
],
"ask": [
"mcp__url-shortener__shorten_url",
"mcp__url-shortener__get_url",
"mcp__url-shortener__get_url_stats",
"mcp__url-shortener__reactivate_url"
],
"deny": [
"mcp__url-shortener__update_url",
"mcp__url-shortener__deactivate_url",
"mcp__url-shortener__delete_url"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as url-shortener. Review it before you use it.