Linkly Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Linkly Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Official Model Context Protocol (MCP) server for Linkly — the URL shortener and link management platform.
This repository powers the hosted MCP server at `https://mcp.linklyhq.com`. That is the only supported way to connect an AI assistant to Linkly via MCP. See https://linklyhq.com/support/mcp-server for setup instructions.
⚠️ The `linkly-mcp-server` npm package is deprecated. The self-hosted / API-key flow is no longer maintained. All users should migrate to the hosted server — it uses OAuth 2.1 with PKCE, requires no API keys or local install, and always runs the latest tool set. The npm package will continue to exist on the registry for backwards compatibility but will not receive new tools or bug fixes, and may be unpublished in the future.
For full documentation, setup guides, and examples, visit: https://linklyhq.com/support/mcp-server
Server URL: https://mcp.linklyhq.com
Connect your MCP client to the hosted server and sign in to Linkly when your browser opens. That's it — no API keys, no installation, no config drift.
{
"mcpServers": {
"linkly": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://mcp.linklyhq.com"]
}
}
}claude mcp add --transport http linkly https://mcp.linklyhq.com{
"servers": {
"linkly": {
"type": "url",
"url": "https://mcp.linklyhq.com"
}
}
}| Tool | Description |
|---|---|
create_link | Create a new short link |
update_link | Update an existing link |
delete_link | Delete a link |
get_link | Get link details |
list_links | List all links in workspace |
search_links | Search links by name, URL, or note |
get_analytics | Get time-series click data |
get_analytics_by | Get clicks grouped by dimension |
get_clicks | Get recent click data |
export_clicks | Export detailed click records |
list_domains | List custom domains |
create_domain | Add a custom domain |
delete_domain | Remove a custom domain |
update_domain_favicon | Update domain favicon |
list_webhooks | List workspace webhooks |
subscribe_webhook | Add a webhook |
unsubscribe_webhook | Remove a webhook |
list_link_webhooks | List link-specific webhooks |
subscribe_link_webhook | Add a link webhook |
unsubscribe_link_webhook | Remove a link webhook |
For help and support, visit Linkly Support or email [email protected].
The server.json at the repo root is the official MCP Registry manifest for the com.linklyhq/linkly server. It is remote-only: it points clients at the hosted server and intentionally ships no package (the deprecated npm distribution was dropped in v2.0.0).
Publishing requires DNS access to linklyhq.com — the com.linklyhq namespace is verified via a DNS TXT record on the domain apex:
# 1. Generate an Ed25519 key + TXT record (macOS: use openssl@3; system LibreSSL lacks Ed25519)
openssl genpkey -algorithm Ed25519 -out key.pem
PUBLIC_KEY="$(openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64)"
echo "linklyhq.com. IN TXT \"v=MCPv1; k=ed25519; p=${PUBLIC_KEY}\"" # add at the APEX of linklyhq.com
# 2. Authenticate the namespace + publish
PRIVATE_KEY="$(openssl pkey -in key.pem -noout -text | grep -A3 'priv:' | tail -n +2 | tr -d ' :\n')"
mcp-publisher login dns --domain linklyhq.com --private-key "$PRIVATE_KEY"
mcp-publisher publishSee the registry authentication guide for details.
chatgpt-app-submission.json is the OpenAI Apps SDK submission import — it pre-fills the per-tool annotations and the three safety justifications (read-only / open-world / destructive) for all 25 tools, so they don't have to be typed by hand in the dashboard.
OpenAI freezes a metadata snapshot at publish time and does not auto-detect MCP changes, so after deploying server changes you publish a new version:
wrangler deploy).https://mcp.linklyhq.com).chatgpt-app-submission.json onto the form (top of the page) to fill the justifications.Keep this file in sync with the worker whenever tools are added/removed or their readOnlyHint/destructiveHint change. The destructive flag is true only for the 5 genuinely destructive tools (delete_link, delete_domain, batchDeleteLinks, unsubscribe_webhook, unsubscribe_link_webhook); creates/updates/subscribes are additive (false).
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.