qURL

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/layervai-qurl-mcp

About

Use cases: identity-access

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools

5 read · 12 write · 7 delete · 2 not yet classified

Secrets

3 (API keys, tokens or passwords)

Install scripts

None found

Runs as

Node.js package

Tools (26)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• audit-links

  Review all active qURLs and identify expiring links, token counts, missing metadata, or potential issues.

• batch_create_qurlsBatch Create qURLs

  Create up to 100 qURLs in a single request. The single-call alternative to looping `create_qurl` — saves round trips and returns a single envelope of per-item results. Only use this when the user explicitly wants multiple qURLs in one request. Never use it for a single URL, a single file, a single image, or a single attachment. Do not use this tool for uploaded files, image attachments, PDFs, or base64 file content — use `upload_file_data_qurl` (HTTP mode) or `upload_file_qurl` (stdio mode) instead. **Not transactional:** items succeed or fail independently (see `succeeded`/`failed` counts and…

• create_qurlCreate qURL

  Create a qURL — a policy-bound, expiring access link that gates a target URL with optional IP/geo/UA/AI-agent filters and time or session limits. **When to use:** minting a fresh protected access link for share-once or time-limited access (e.g. send a customer a 24-hour download link, gate a doc behind an IP allowlist, distribute a one-time-use credential to a contractor). **Do NOT use this for chat-uploaded images, PDFs, screenshots, or file attachments.** In HTTP MCP mode, those should go through `upload_file_data_qurl`; in stdio mode, use `upload_file_qurl`. **When NOT to use:** use `mint_l…

• delete_cridDelete a CRID permanentlycan change or delete data

  Permanently delete a resource this machine published, with the qURL CLI. This cannot be undone: existing links stop working, the CRID can never be shared again, and publishing the same target later makes a different CRID. Confirm with the user first, and prefer set_crid_sharing with stop, which is reversible. Deleting a resource that is already deleted succeeds with already_gone true.

• delete_qurlDelete qURLcan change or delete data

  Permanently revoke a qURL — the link and every access token under it stop working immediately. **This action is irreversible.** Use this when you want to cut off access entirely (compromised link, departed user, end-of-engagement). It does not revoke links minted by the upload tools, which belong to the file connector; those cannot be revoked from this server. Use `update_qurl` instead when you only need to shorten the resource's expiration, retag, or rename, and `extend_qurl` to keep a link open longer — those preserve the existing access tokens. **Idempotent:** the API returns 404 for re-del…

• extend_qurlExtend qURL Expiration

  Keep a qURL link open longer by pushing out the link's expiration by a relative duration. Pass a link's `q_` display ID as `resource_id`, or a resource ID plus `qurl_id`; a resource with exactly one active link needs no `qurl_id` (unless it has more than the 100 links a read lists). Use this when the only change you need is more time on the clock. Use `update_qurl_token` instead to set an absolute `expires_at` or change the link's label, policy, or sessions. Use `revoke_qurl_token` or `delete_qurl` when you want to cut off access. Links minted by the upload tools belong to the file connector a…

• get_qurlGet qURLread-only

  Fetch a single qURL resource by ID and return its current state plus a bounded preview of access tokens. Use this when you have a specific resource ID (public key, CRID, or legacy r_ ID) or qURL display ID (q_ prefix) — q_ IDs are auto-resolved to their parent resource. Do not use this to create a new qURL for a freshly uploaded image, PDF, screenshot, or file attachment. For chat-uploaded file content in HTTP MCP mode, use `upload_file_data_qurl` instead. Use `list_qurls` instead when you need to discover qURLs by status, date range, or search query. Use `resolve_qurl` instead when you have a…

• list_cridsList my published CRIDsread-only

  List the resources this machine's qURL identity has published, with the qURL CLI: CRID, target, type (url, or tunnel for a local app), status, and whether it is private. Only active resources unless include_deleted is true. Pages: keep calling with next_cursor until has_more is false; an empty page with has_more true is normal. Read consumer_access on each item: when present, use manage_crid_access and its policy; only legacy resources without consumer_access use manage_crid_requests or share_by_crid. Also use it to find a CRID before set_crid_sharing or delete_crid. Read-only.

• list_qurl_sessionsList qURL Sessionsread-only

  List active access sessions for a qURL resource. Use this to inspect who currently has live access before rotating, revoking, or terminating sessions. Use `terminate_qurl_sessions` when active sessions should be ended, and use `get_qurl` when you need token/resource metadata instead of active session state. **Behavior:** read-only and idempotent. Empty `data[]` means no active sessions for the resource.

• list_qurlsList qURLsread-only

  List qURL resources, paginated and optionally filtered by status, date range, or search text. **When to use:** discovery — finding qURLs by status (e.g. everything still active), auditing date ranges, or full-text search across descriptions and target URLs (via the `q` parameter). Filters AND together (e.g. `status: 'active'` + `expires_before: '2026-05-01T00:00:00Z'` returns active qURLs about to expire). **When NOT to use:** use `get_qurl` instead when you already have a specific resource ID — it returns the same per-resource shape more cheaply and includes the `qurls[]` per-token detail tha…

• manage_crid_accessManage private CRID accesscan change or delete data

  Publisher access control. Configure the next policy version, send or resend an email invitation, list invitations or consumer grants, approve or deny a request, approve a credential with id new, or revoke access. Read the current version before a decision; configuring the first policy on an existing private resource uses expected_version 0. For approve, put expected_version inside approval; zero is allowed only for id new. After an uncertain invite result, list invitations before retrying. Invite-only access has no consumer requests. Contract approval requires a trusted publisher entitlement r…

• manage_crid_requestsManage CRID access requestscan change or delete data

  Only for legacy resources without consumer_access; use manage_crid_access for consumer_access policies. Handle people asking for access to a private CRID, with the qURL CLI. list shows pending requests (all resources when crid is omitted); approve lets one person in by the six-digit code they gave the publisher; deny refuses a request by device id; list_approved shows approved people and allowed device keys; remove_approved takes one approved person's access away by device id; turn_on and turn_off control whether people can ask. Approve only with a code the person the publisher means to let in…

• mint_linkMint Access Link

  Mint a fresh access link for an existing qURL resource — same one-shot display semantics as `create_qurl.qurl_link`. Use this to issue additional access links to a resource without creating a brand-new qURL (e.g. a second recipient, a replacement after the original was lost). Not for files from the upload tools: their links come from the file connector, so a link minted here on an upload's `resource_id` does not open the file; run the upload tool again instead. Use `create_qurl` instead when you want a brand-new resource with its own target_url and policy. Use `update_qurl` when you only want …

• publish_cridPublish a private CRID

  Publish a URL with private access. Choose keys for approved credentials, invite_only for publisher email invitations with no access requests, email_capture for verified email capture with consent, review for verified email requests, or contract for a publisher backend entitlement receipt. This tool does not verify payment. Use version 1 for creation. Repeating this call creates another resource; after an uncertain result use get_qurl or list_qurls before retrying. For local apps use the qURL CLI. Public sharing uses create_qurl.

• resolve_qurlResolve qURL Access Token

  Redeem a qURL access token (the `at_` prefix you pulled out of a `qurl_link`) to reveal the underlying URL and obtain a time-bound, IP-bound network access grant. Use this when an agent has been handed an access token and needs to fetch the protected resource — after a successful resolve, requests from `access_grant.src_ip` are permitted to the `target_url` for `access_grant.expires_in` seconds. Use `get_qurl` instead when you have a resource identifier (public key, CRID, or legacy `r_` ID) or qURL display ID (`q_`) and want admin-side details rather than end-user redemption. **Side-effects:**…

Signals

Stars

4

Forks

3

Open issues

21

Weekly downloads

707

Last commit

Oct 22, 2026 (8 days ago)

Last release

Oct 25, 2026 (5 days ago)

Last package publish

Oct 24, 2026 (6 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name

io.github.layervai/qurl-mcp

Version

0.8.3

Auth

API key

Packages

npm @layervai/qurl-mcp

License

MIT

Repository

github.com/layervai/qurl-mcp

Website

layerv.ai

First seen

Oct 24, 2026

Last checked

Oct 26, 2026

Source

Official MCP Registrygithub-graphql