# MiniURL

> OAuth 2.1 short-link tools for AI agents with scoped tokens, approvals, audit logs, and revocation.

- name: io.github.addychang/miniurl
- version: 1.2.0
- connection class: R0 (autonomous)
- trust: 94/100
- quality: 89/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.addychang%2Fminiurl
- tools: https://api.protogrid.dev/v1/servers/io.github.addychang%2Fminiurl/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "miniurl": {
      "type": "http",
      "url": "https://workers.miniurl.com/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 99
- freshness: 85
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-97% ~updated-73d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 89/100 (good)

### protocol: 100 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- pass `protocol.list_ttl`: tool list is cacheable (ttlMs 300000)

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 23 of 23 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 3,555 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 50 (weight 15)

- pass `stability.changes`: 3 tool changes in 30 days
- fail `stability.rug_pull`: 1 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 23, about 3,555 tokens to load them all
- tool set hash: 820a09853f73069166cd2d0fd76d11c0
- tools last changed: 2026-10-08T08:46:17.101Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.addychang/miniurl.svg)](https://protogrid.dev/servers/io.github.addychang/miniurl)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-08 `verify_domain` changed (inputSchema)
- 2026-10-08 `add_domain` changed (inputSchema)
- 2026-10-08 `list_domains` changed (description) **meaning changed**
  - before: List domains available to the current registered account, including miniurl.com and active custom domains.
  - after: List the account’s domains, including miniurl.com, active custom domains and pending setups with their ids and DNS records.

Full history: https://api.protogrid.dev/v1/servers/io.github.addychang%2Fminiurl/changes

## Remotes

- https://workers.miniurl.com/mcp (streamable-http, auth none, reachable true, uptime30d 0.973913)

## Packages

_none_

## Tools (23)

- `add_domain`: Request a custom domain to be connected to MiniURL. Agent domain changes require human approval by default.
- `bulk_create_links`: Create multiple short links in one request. Free accounts can create up to 10 at a time, Pro up to 50.
- `check_alias`: Check whether a custom alias is available on a given domain before creating a link.
- `clear_authentication`: Clear authentication retained by a legacy MCP session. Stateless clients clear authentication by omitting the Authorization header on later requests.
- `create_guest_token`: Create a short-lived MiniURL guest bearer token. Legacy MCP sessions retain it; stateless clients must pass the returned gt_ token explicitly on later requests. shorten_url can provision one automatically.
- `create_tag`: Create a new tag for organising links. Maximum 20 tags per account.
- `delete_domain`: Delete a custom domain and its linked URLs after a dry-run confirmation. Agent domain changes require human approval by default.
- `delete_link`: Delete a registered short link permanently.
- `delete_tag`: Delete a tag and remove it from all associated links.
- `get_account_status`: Inspect the current guest/free/pro account status, remaining quota, and feature availability.
- `get_link`: Get a single short link by alias for the current registered account.
- `get_link_stats`: Get link analytics. Free accounts receive a basic total plus an upgrade hint; Pro accounts receive full breakdowns.
- `list_domains`: List the account’s domains, including miniurl.com, active custom domains and pending setups with their ids and DNS records.
- `list_links`: List short links for the current registered account.
- `list_tags`: List all tags for the current registered account. Tags help organise links into campaigns or categories.
- `send_registration_code`: Send a 6-digit registration code to the user email, using the current guest session.
- `shorten_url`: Create a MiniURL short link for a supplied HTTP or HTTPS destination. Use when the user asks to shorten a URL or generate a MiniURL link. This is an additive external write; do not fetch or open the destination. If no authentication is supplied, MiniURL automatically starts a guest flow. Reuse idempotency_key when retrying the same logical request.
- `start_pro_upgrade`: Create a shortened checkout link for upgrading the current registered account to Pro.
- `tag_link`: Add a tag to a short link for campaign or category organisation.
- `untag_link`: Remove a tag from a short link.
- `update_link`: Update a registered short link. Some fields require Pro.
- `verify_domain`: Refresh custom-domain DNS and SSL verification status. Agent domain changes require human approval by default.
- `verify_registration_code`: Verify the emailed code, create the account, claim guest links, and continue with OAuth 2.1 + PKCE. Long-lived API keys are never returned over MCP.