Skip to main content
The CodeQR MCP server lets an AI assistant work directly in your workspace: shorten a URL, generate a QR code, change where a printed code points, and read scan and click analytics — without leaving the conversation. It speaks the Model Context Protocol, so any client that supports MCP can connect to it.

Server endpoint

https://mcp.codeqr.io/mcp — Streamable HTTP

​
What you can do with it

Create and update links

Shorten a URL, set a custom slug, add an expiry date, or change a destination after the fact.

Generate QR codes

Nine content types — URL, WiFi, vCard, WhatsApp, crypto and more — with your own colors and size.

Read analytics

Scans and clicks grouped by country, device, browser, referrer, or over time.

Organize

List your custom domains, create tags, and see what your workspace is on.
See the tool reference for all fourteen tools and what each one accepts.

​
Connect

You do not need an API key. The first request opens your browser, you sign in to CodeQR and pick which project to grant access to, and the client stores the token from there on.
Run /mcp inside Claude Code to start the sign-in.
Connecting from Gemini Enterprise takes a few extra fields, because that connector asks for a client ID up front instead of registering itself. See Gemini Enterprise.
Every client here uses the same endpoint and the same sign-in. If yours is not listed, point it at https://mcp.codeqr.io/mcp over Streamable HTTP — the server advertises everything a client needs to discover on its own.

​
Try it

Once connected, ask in plain language. Three that exercise different parts of the server:
The assistant picks the tool; you approve the call. Anything that overwrites or deletes something already in circulation is marked as such, so your client can warn you before it runs.
Ask for scan counts on a specific QR code, as above. Asking for scans broken down by country or device at the workspace level returns clicks across links, QR codes and pages together, not QR scans alone — see the note on get_analytics.

​
How sign-in works

You never handle an API key. The flow is standard OAuth 2.0, and the client does the work:
1

The client registers itself

On first contact the server answers 401 with a pointer to its metadata, and the client registers via Dynamic Client Registration (RFC 7591) at POST /oauth/register. It gets back a client_id. There is no client secret — the server treats every client as public and relies on PKCE instead.
2

You sign in to CodeQR

The client sends you to /oauth/authorize, which hands off to CodeQR. You log in, choose the project to grant access to, and approve.
3

The client gets a token

CodeQR returns you to the server, which exchanges the code and issues the client its own token at POST /oauth/token. PKCE with S256 is required — a request without a code_verifier is rejected.
4

It stays signed in

The CodeQR credentials underneath are refreshed transparently, so you do not sign in again on that client.
One signed-in client at a time, per CodeQR project. Signing in from a second client — or re-authorizing the same one — replaces the previous authorization for that project, and the earlier client stops working until it reconnects. If you want CodeQR in two places at once, point each at a different project.
The server publishes its own metadata, so a client can discover all of this without being told:

​
What access you grant

Approving the connection grants these scopes on the project you picked: Access is scoped to the one project you choose during sign-in. To reach a second project, connect again and pick that one. The consent screen spells the same permissions out in more detail, naming read and write on separate lines.
Conversion tracking is not available through this connection. Reading conversion data needs a scope that only workspace owners can grant, so including it would lock everyone else out of the connection entirely. Use the API for conversions.

​
Troubleshooting

Check that it is up:
A healthy server answers {"status":"ok","service":"codeqr-mcp-remote", ...}.
Some clients only start the OAuth flow when a tool is first called. Ask it to do something — “list my short links” — and the browser should open.
This server speaks Streamable HTTP, the current MCP transport. The older SSE transport is not offered. Update the client, or use one from the list above.
The token is scoped to the single project you picked at sign-in, and to the scopes listed above. If you are trying to reach a different project, reconnect and choose that one.