短.在线
by xn--s7y.xn--3ds443g · remote · no sign-in to list tools · v1.6.5 · published by xn--3ds443g.xn--s7y
Short links + QR codes for AI agents. Account required to create links via API or MCP. Public beta.
6 tools: 5 change things and 1 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things5Claude Code: ask: see these tools
- Only reads1Claude Code: allow: see these tools
2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http duan-online https://xn--s7y.xn--3ds443g/mcpFindings
Matches of fixed checks, with the text they matched.
The server marks "resolve_short_url" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "resolve_short_url" says "resolve": a word for reading.
- Infoshorten_urls
The description is 2,057 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...that key returns IDEMPOTENCY_CONFLICT, so send the corrected item with a new key."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
6 tools
Changes things 5Claude Code: ask
begin_registration客户端无法启动 OAuth 时的后备入口。返回浏览器注册链接。本工具不创建账号,不接收密码,也不代用户同意条款。 Fallback when the client cannot start OAuth.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it 客户端无法启动 OAuth 时的后备入口。返回浏览器注册链接。本工具不创建账号,不接收密码,也不代用户同意条款。 Fallback when the client cannot start OAuth. Returns a browser registration link. This tool does not create an account, accept a password, or accept terms for the user.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
create_qr为已有短链返回可扫描二维码。默认 PNG 512×512,并包含 image/png 图片块。仅当 format 为 svg 时返回 SVG,且不以 image 块返回。二维码中编码的是带有 ?s=qr 来源标记的短链接(使用 ASCII 域名),与 GET /v1/links/{id}/qr 返回的二维码内容一致。需要已注册账号,且必须是该链接的所有者。不…No findings
Why it is in this group
- The name "create_qr" says "create": a word for a change.
Description, as the server wrote it 为已有短链返回可扫描二维码。默认 PNG 512×512,并包含 image/png 图片块。仅当 format 为 svg 时返回 SVG,且不以 image 块返回。二维码中编码的是带有 ?s=qr 来源标记的短链接(使用 ASCII 域名),与 GET /v1/links/{id}/qr 返回的二维码内容一致。需要已注册账号,且必须是该链接的所有者。不新建短链,也不抓取目标地址。PNG 边长仅 256、512、1024,SVG 忽略边长。可能包含短期 image_url 及其到期时间;该链接不是 API 密钥、OAuth 令牌或会话。返回已存储短链的二维码:默认 PNG,请求时为 SVG;可用时附带短期 image_url。二维码编码的是 qr_tracking_url。未显示图片时,可使用 image_url(如有)或短链。 Return a scannable QR for an existing short link. Default PNG is 512×512 and includes an image/png image block. SVG is returned only when format is svg, and not as an image block. The matrix encodes the tracking URL with ?s=qr (ASCII host), the same payload as GET /v1/links/{id}/qr. A registered account that owns the link is required. Does not create a link and does not fetch the destination. PNG size is 256, 512, or 1024. SVG ignores size. A short-lived image_url and its expiry may be included. That URL is not an API key, an OAuth token, or a session. Returns the stored link's QR as PNG, or SVG when requested, with a short-lived image URL where available. The QR encodes qr_tracking_url. Where an image is not displayed, image_url (when present) or the short link reaches the same code.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
resolve_short_url查询本站短码或本站短链的已保存状态;仅 active 时返回目标地址。无需账号。不查询其他短链服务;查询结果不是安全检测结论。 Look up a 短.在线 code or short URL and return its saved state.1 finding
Why it is in this group
- The name "resolve_short_url" says "resolve": a word for reading.
- The input takes a statement or command to run (input.code), which can change anything it can reach.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "resolve_short_url" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "resolve_short_url" says "resolve": a word for reading.
Description, as the server wrote it 查询本站短码或本站短链的已保存状态;仅 active 时返回目标地址。无需账号。不查询其他短链服务;查询结果不是安全检测结论。 Look up a 短.在线 code or short URL and return its saved state. The destination is returned only when active. No account required. Does not look up other shorteners. The result is not a security verdict.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
shorten_url为 HTTP 或 HTTPS 目标地址创建一条短链。需要已注册账号。返回链接状态;状态为 active 时,同时返回 Unicode 显示地址和 ASCII 地址。创建两条或更多短链时使用 shorten_urls。重试同一操作时,必须复用相同的 idempotency_key。 Create one HTTP or HTTPS short link.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it 为 HTTP 或 HTTPS 目标地址创建一条短链。需要已注册账号。返回链接状态;状态为 active 时,同时返回 Unicode 显示地址和 ASCII 地址。创建两条或更多短链时使用 shorten_urls。重试同一操作时,必须复用相同的 idempotency_key。 Create one HTTP or HTTPS short link. A registered account is required. Returns the state, and when active, the Unicode display URL and the ASCII URL. For two or more, use shorten_urls. A retry of the same operation must reuse the same idempotency_key.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
shorten_urls一次同步创建 1 到 100 条短链。按 client_ref 对应结果,允许部分成功。需要已注册账号。批量重试只有三种情况,不要混用。示例:key 为 batch-1,两项 client_ref 分别为 notes(https://example.com/notes)和 draft(https://example.com/draft)。notes 成功,d…1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- Info
The description is 2,057 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...that key returns IDEMPOTENCY_CONFLICT, so send the corrected item with a new key."
Description, as the server wrote it 一次同步创建 1 到 100 条短链。按 client_ref 对应结果,允许部分成功。需要已注册账号。批量重试只有三种情况,不要混用。示例:key 为 batch-1,两项 client_ref 分别为 notes(https://example.com/notes)和 draft(https://example.com/draft)。notes 成功,draft 的 retryable 为 true。(1) 传输结果不确定(没有拿到已完成的响应、IDEMPOTENCY_IN_PROGRESS、幂等锁不可用,或因瞬时数据库错误且一条都未创建而返回 503):用同一个 key 原样重发整批。已完成的批次返回已保存的结果,notes 不会再次创建。key 已被释放时,同一批会重新执行。(2) 已完成且某项 retryable 为 true:重放 batch-1 只返回已保存的结果,不会重试 draft。只用新 key(例如 batch-1-draft)发送 draft,并保留 client_ref draft,不要带上 notes。去掉 notes 后仍用 batch-1 会返回 IDEMPOTENCY_CONFLICT。(3) 校验错误:改正请求,不要把同一份无效请求当作网络重试。key 尚未保存的 400(重复 client_ref、缺少 items、BATCH_TOO_LARGE)改正后可以继续用同一个 key。已完成且 retryable 为 false 的项已保存;修改请求体后继续使用原 key,会返回 IDEMPOTENCY_CONFLICT,改正后的项必须用新 key。 Create 1 to 100 short links in one synchronous request. Match each result by client_ref. Partial success is allowed. A registered account is required. Batch retry has three cases; do not mix them. Worked example: key batch-1 with client_ref notes (https://example.com/notes) and draft (https://example.com/draft). notes succeeds and draft is retryable true. (1) Uncertain transport outcome — no completed body, IDEMPOTENCY_IN_PROGRESS, an unavailable idempotency lock, or 503 because a transient database error created nothing: resend the entire unchanged batch with the same key. A completed batch returns the stored result and notes is not created again. A released key runs that same batch again. (2) Completed batch with retryable true: replaying batch-1 returns the stored body and does not retry draft. Send only draft, keeping client_ref draft, under a new key such as batch-1-draft. Do not include notes. Dropping notes and reusing batch-1 returns IDEMPOTENCY_CONFLICT. (3) Validation error: fix the request. Do not resend the same invalid body as a network retry. A 400 before the key is stored (duplicate client_ref, missing items, BATCH_TOO_LARGE) may reuse the key after the body is corrected. A completed item with retryable false is stored; a changed body on that key returns IDEMPOTENCY_CONFLICT, so send the corrected item with a new key.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
Only reads 1Claude Code: allow
get_link按 id 查询当前授权账号拥有的链接。需要已注册账号。无需账号的公开状态查询请使用 resolve_short_url。 Fetch one link by id, only a link owned by the signed-in account.No findings
Why it is in this group
- The name "get_link" says "get": a word for reading.
Description, as the server wrote it 按 id 查询当前授权账号拥有的链接。需要已注册账号。无需账号的公开状态查询请使用 resolve_short_url。 Fetch one link by id, only a link owned by the signed-in account. A registered account is required. For a public status check, use resolve_short_url.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 1.6.5. Values in angle brackets are yours to fill in.
claude mcp add --transport http duan-online https://xn--s7y.xn--3ds443g/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__duan-online__get_link"
],
"ask": [
"mcp__duan-online__shorten_url",
"mcp__duan-online__shorten_urls",
"mcp__duan-online__resolve_short_url",
"mcp__duan-online__create_qr",
"mcp__duan-online__begin_registration"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as duan-online. Review it before you use it.