Skip to content

Gajo URL Shortener

by gajo.io · remote · no sign-in to list tools · v1.1.0 · published by io.gajo

Shorten URLs, manage gajo.io short links, and read click analytics. Free account, no credit card.

Deletes · 3Changes · 4

9 tools: 3 can delete or cancel things, 4 change things and 2 only read.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http url-shortener https://gajo.io/mcp

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • The server marks "get_url" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "get_url" says "get": a word for reading.

    What this check looks for
  • The server marks "get_url_stats" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "get_url_stats" says "get": a word for reading.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

9 tools

Deletes or cancels 3Claude Code: deny
  • deactivate_urlTurn off one of your short links so it stops redirecting, keeping its destination and clicks.No findings

    Why it is in this group

    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Turn off one of your short links so it stops redirecting, keeping its destination and clicks. Generated codes are never reassigned; use reactivate_url to turn the link back on, or delete_url to erase it for good.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_urlPermanently delete one of your short links: its destination and click history are erased and it stops redirecting.No findings

    Why it is in this group

    • The name "delete_url" says "delete": a word for removing or ending something.
    • The description says "Permanently delete".
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Permanently delete one of your short links: its destination and click history are erased and it stops redirecting. It can't be undone or reactivated, and the code is never given to anyone else. Use it when a destination shouldn't be kept, e.g. a URL with a private token; to just switch a link off, use deactivate_url.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • update_urlPro only: point an existing short link at a new destination URL.No findings

    Why it is in this group

    • The name "update_url" says "update": a word for a change.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Pro only: point an existing short link at a new destination URL. Takes effect immediately.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
Changes things 4Claude Code: ask
  • get_urlLook up one of your short links by code: destination, click count, status, and expiry.1 finding

    Why it is in this group

    • The name "get_url" says "get": a word for reading.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "get_url" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "get_url" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Look up one of your short links by code: destination, click count, status, and expiry. Use get_url_stats for clicks per day and where they came from.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • get_url_statsGet click analytics for one of your links, bots excluded: total clicks and clicks per day (7 days on Free, 90 on Basic, every day since the link was created on Pro).1 finding

    Why it is in this group

    • The name "get_url_stats" says "get": a word for reading.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "get_url_stats" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "get_url_stats" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Get click analytics for one of your links, bots excluded: total clicks and clicks per day (7 days on Free, 90 on Basic, every day since the link was created on Pro). Basic and Pro also get referrers, devices, countries, and regions.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • reactivate_urlTurn a link you deactivated back on, with its same code and destination.No findings

    Why it is in this group

    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    Description, as the server wrote it
    Turn a link you deactivated back on, with its same code and destination. Expired links, links disabled as unsafe, and custom codes that were unassigned can't be reactivated; create a new link instead.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • shorten_urlCreate a gajo.io short link for a URL and return it as shortUrl.No findings

    Why it is in this group

    • The description's first verb is "create": a word for a change.
    Description, as the server wrote it
    Create a gajo.io short link for a URL and return it as shortUrl. Links follow your plan's code length and lifetime and count against its monthly quota. Pro plans can pass customCode for a branded gajo.io/c/{code} link, or shorten app deep links (myapp://...) with a web fallbackUrl.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Only reads 2Claude Code: allow
  • get_usageShows your plan and quota: links created and remaining this month, maximum link lifetime, and API requests per minute.No findings

    Why it is in this group

    • The name "get_usage" says "get": a word for reading.
    Description, as the server wrote it
    Shows your plan and quota: links created and remaining this month, maximum link lifetime, and API requests per minute. Call it before creating many links or after a monthly-limit error; the allowance resets on the 1st of each month (UTC).

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • list_urlsList your short links, newest first, with click counts.No findings

    Why it is in this group

    • The name "list_urls" says "list": a word for reading.
    Description, as the server wrote it
    List your short links, newest first, with click counts. Use it to browse or to find a link's code; for one known code use get_url, and for clicks over time get_url_stats. Returns one page; use page to see more.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http url-shortener https://gajo.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__url-shortener__list_urls",
      "mcp__url-shortener__get_usage"
    ],
    "ask": [
      "mcp__url-shortener__shorten_url",
      "mcp__url-shortener__get_url",
      "mcp__url-shortener__get_url_stats",
      "mcp__url-shortener__reactivate_url"
    ],
    "deny": [
      "mcp__url-shortener__update_url",
      "mcp__url-shortener__deactivate_url",
      "mcp__url-shortener__delete_url"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as url-shortener. Review it before you use it.