Is QRcodly safe to install?

SaferSkills independently audited QRcodly (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md5.3 KB · Markdown

QRcodly

QRcodly is a free, open-source QR code generator and management platform. Create, customize, and track QR codes for URLs, contact details, Wi-Fi credentials, and more.

Features

Multiple QR code types — URL, vCard, Wi-Fi, Email, Calendar Event, Location, Plain Text
Full customization — colors, sizes, backgrounds, and custom icon uploads
Export formats — PNG, JPEG, SVG
URL shortening & analytics — shorten links and track scans
Templates — save and reuse QR code configurations
Custom domains — use your own domain for short URLs (Cloudflare integration)
Internationalization — 8 languages (EN, DE, ES, FR, IT, NL, PL, RU)
Authentication — powered by Clerk
Browser extension — generate QR codes from any page

Monorepo Structure

qrcodly/
├── apps/
│   ├── backend/            # Fastify REST API
│   ├── frontend/           # Next.js web application
│   └── browser-extension/  # Vite-based browser extension
├── packages/
│   ├── shared/             # Zod schemas, DTOs, and shared utilities
│   ├── eslint-config/      # Shared ESLint configuration
│   └── typescript-config/  # Shared TypeScript configuration
└── docker-compose.yaml     # Local development services

See per-app READMEs for architecture details: Backend · Frontend · Browser Extension · Shared Package

Tech Stack

Layer	Technologies
Frontend	Next.js, React, TypeScript, Tailwind CSS, shadcn/ui, Zustand, TanStack Query, next-intl
Backend	Fastify, TypeScript, Drizzle ORM, tsyringe (DI), Zod, Nodemailer, Handlebars
Database	MySQL, Redis
Storage	S3 / MinIO
Auth	Clerk
Billing	Stripe
Analytics	Umami, PostHog
Monitoring	Axiom, Sentry

Prerequisites

Node.js >= 22.11
pnpm >= 9.15
Docker (for local development services)

Quick Start

# 1. Clone the repository
git clone https://github.com/FloB95/qrcodly.git
cd qrcodly

# 2. Install dependencies
pnpm install

# 3. Start local services (MySQL, Redis, MinIO, Umami)
docker-compose up -d

# 4. Set up environment variables
cp apps/backend/.env.example apps/backend/.env
cp apps/frontend/.env.example apps/frontend/.env
# Edit both .env files with your configuration (Clerk keys, etc.)

# 5. Start development servers
pnpm run start:dev
# Backend API → http://localhost:5001
# Frontend   → http://localhost:3000

Available Scripts

Script	Description
`pnpm run start:dev`	Start backend and frontend in development mode
`pnpm run backend:dev`	Start backend only (runs migrations first)
`pnpm run frontend:dev`	Start frontend only
`pnpm run build`	Build all apps
`pnpm run build:shared-package`	Build the shared package only
`pnpm run lint`	Lint all workspaces
`pnpm run format`	Format all files with Prettier
`pnpm run clean`	Clean build artifacts across all apps

Local Services (Docker Compose)

Service	Port	Details
MySQL	3306	Credentials: `root` / `root`, database: `qrcodly`
Redis	6379	—
MinIO (S3)	9000 (API), 9001 (Console)	Credentials: `minio` / `testtest`
phpMyAdmin	8081	—
Umami Analytics	3001	—

Contributing

Contributions are welcome! Please see CONTRIBUTING.md for guidelines and setup instructions.

License

This project is licensed under the MIT License.

QRcodly— mcp server

Is QRcodly safe to install?

QRcodly

Features

Monorepo Structure

Tech Stack

Prerequisites

Quick Start

Available Scripts

Local Services (Docker Compose)

Contributing

License

Audit the pieces. Scan the whole. Decide.