MiniURL

by addychang · remote · no sign-in to list tools · v1.2.0 · published by GitHub user addychang

OAuth 2.1 short-link tools for AI agents with scoped tokens, approvals, audit logs, and revocation.

Deletes · 6Final · 1Changes · 10

Compare Registry entry

23 tools: 6 can delete or cancel things, 1 do something that can't be undone, 10 change things and 6 only read.

Scanned Oct 21, 2026

Deletes or cancels6Claude Code: deny: see these tools
Can't be undone1Claude Code: ask: see these tools
Changes things10Claude Code: ask: see these tools
Only reads6Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http miniurl https://workers.miniurl.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warnuntag_link
The server marks "untag_link" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "untag_link" says "link": a word for a change.
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

23 tools

Deletes or cancels 6Removes, cancels or revokes something.Claude Code: deny

add_domainRequest a custom domain to be connected to MiniURL.No findings
Why it is in this group
- The name "add_domain" says "add": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Request a custom domain to be connected to MiniURL. Agent domain changes require human approval by default.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
delete_domainDelete a custom domain and its linked URLs after a dry-run confirmation.No findings
Why it is in this group
- The name "delete_domain" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete a custom domain and its linked URLs after a dry-run confirmation. Agent domain changes require human approval by default.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
delete_linkDelete a registered short link permanently.No findings
Why it is in this group
- The name "delete_link" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete a registered short link permanently.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
delete_tagDelete a tag and remove it from all associated links.No findings
Why it is in this group
- The name "delete_tag" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete a tag and remove it from all associated links.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
start_pro_upgradeCreate a shortened checkout link for upgrading the current registered account to Pro.No findings
Why it is in this group
- The name "start_pro_upgrade" says "start": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Create a shortened checkout link for upgrading the current registered account to Pro.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
untag_linkRemove a tag from a short link.1 finding
Why it is in this group
- The name "untag_link" says "link": a word for a change.
- The description's first verb is "remove": a word for removing or ending something.
- The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.
Findings
- Warn
  The server marks "untag_link" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "untag_link" says "link": a word for a change.
  What this check looks for
Description, as the server wrote it
Remove a tag from a short link.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false

Can't be undone 1Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

send_registration_codeSend a 6-digit registration code to the user email, using the current guest session.No findings
Why it is in this group
- The name "send_registration_code" says "send": a word for sending, and what is sent cannot be taken back.
Description, as the server wrote it
Send a 6-digit registration code to the user email, using the current guest session.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false

Changes things 10Creates or changes something that can be changed back.Claude Code: ask

bulk_create_linksCreate multiple short links in one request.No findings
Why it is in this group
- The name "bulk_create_links" says "create": a word for a change.
Description, as the server wrote it
Create multiple short links in one request. Free accounts can create up to 10 at a time, Pro up to 50.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
check_aliasCheck whether a custom alias is available on a given domain before creating a link.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Check whether a custom alias is available on a given domain before creating a link.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
clear_authenticationClear authentication retained by a legacy MCP session.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Clear authentication retained by a legacy MCP session. Stateless clients clear authentication by omitting the Authorization header on later requests.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
create_guest_tokenCreate a short-lived MiniURL guest bearer token.No findings
Why it is in this group
- The name "create_guest_token" says "create": a word for a change.
Description, as the server wrote it
Create a short-lived MiniURL guest bearer token. Legacy MCP sessions retain it; stateless clients must pass the returned gt_ token explicitly on later requests. shorten_url can provision one automatically.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
create_tagCreate a new tag for organising links.No findings
Why it is in this group
- The name "create_tag" says "create": a word for a change.
Description, as the server wrote it
Create a new tag for organising links. Maximum 20 tags per account.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
shorten_urlCreate a MiniURL short link for a supplied HTTP or HTTPS destination.No findings
Why it is in this group
- The description's first verb is "create": a word for a change.
Description, as the server wrote it
Create a MiniURL short link for a supplied HTTP or HTTPS destination. Use when the user asks to shorten a URL or generate a MiniURL link. This is an additive external write; do not fetch or open the destination. If no authentication is supplied, MiniURL automatically starts a guest flow. Reuse idempotency_key when retrying the same logical request.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
tag_linkAdd a tag to a short link for campaign or category organisation.No findings
Why it is in this group
- The name "tag_link" says "link": a word for a change.
Description, as the server wrote it
Add a tag to a short link for campaign or category organisation.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
update_linkUpdate a registered short link.No findings
Why it is in this group
- The name "update_link" says "update": a word for a change.
Description, as the server wrote it
Update a registered short link. Some fields require Pro.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
verify_domainRefresh custom-domain DNS and SSL verification status.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Refresh custom-domain DNS and SSL verification status. Agent domain changes require human approval by default.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
verify_registration_codeVerify the emailed code, create the account, claim guest links, and continue with OAuth 2.1 + PKCE.No findings
Why it is in this group
- The input takes a statement or command to run (input.code), which can change anything it can reach.
Description, as the server wrote it
Verify the emailed code, create the account, claim guest links, and continue with OAuth 2.1 + PKCE. Long-lived API keys are never returned over MCP.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false

Only reads 6Looks things up and changes nothing.Claude Code: allow

get_account_statusInspect the current guest/free/pro account status, remaining quota, and feature availability.No findings
Why it is in this group
- The name "get_account_status" says "get": a word for reading.
Description, as the server wrote it
Inspect the current guest/free/pro account status, remaining quota, and feature availability.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_linkGet a single short link by alias for the current registered account.No findings
Why it is in this group
- The name "get_link" says "get": a word for reading.
Description, as the server wrote it
Get a single short link by alias for the current registered account.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_link_statsGet link analytics.No findings
Why it is in this group
- The name "get_link_stats" says "get": a word for reading.
Description, as the server wrote it
Get link analytics. Free accounts receive a basic total plus an upgrade hint; Pro accounts receive full breakdowns.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_domainsList the account’s domains, including miniurl.com, active custom domains and pending setups with their ids and DNS records.No findings
Why it is in this group
- The name "list_domains" says "list": a word for reading.
Description, as the server wrote it
List the account’s domains, including miniurl.com, active custom domains and pending setups with their ids and DNS records.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_linksList short links for the current registered account.No findings
Why it is in this group
- The name "list_links" says "list": a word for reading.
Description, as the server wrote it
List short links for the current registered account.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_tagsList all tags for the current registered account.No findings
Why it is in this group
- The name "list_tags" says "list": a word for reading.
Description, as the server wrote it
List all tags for the current registered account. Tags help organise links into campaigns or categories.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.2.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http miniurl https://workers.miniurl.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__miniurl__get_account_status",
      "mcp__miniurl__list_domains",
      "mcp__miniurl__list_links",
      "mcp__miniurl__get_link",
      "mcp__miniurl__get_link_stats",
      "mcp__miniurl__list_tags"
    ],
    "ask": [
      "mcp__miniurl__create_guest_token",
      "mcp__miniurl__clear_authentication",
      "mcp__miniurl__shorten_url",
      "mcp__miniurl__send_registration_code",
      "mcp__miniurl__verify_registration_code",
      "mcp__miniurl__verify_domain",
      "mcp__miniurl__update_link",
      "mcp__miniurl__bulk_create_links",
      "mcp__miniurl__check_alias",
      "mcp__miniurl__create_tag",
      "mcp__miniurl__tag_link"
    ],
    "deny": [
      "mcp__miniurl__start_pro_upgrade",
      "mcp__miniurl__add_domain",
      "mcp__miniurl__delete_domain",
      "mcp__miniurl__delete_link",
      "mcp__miniurl__delete_tag",
      "mcp__miniurl__untag_link"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as miniurl. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.addychang/miniurl/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

17 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:22 UTC.

For agents: Markdown · JSON · report this listing