# Strait (npm · @straitlink/mcp)

Create, search and pause deep links; QR codes; analytics, taps, events; domains; webhooks.

- Trust score: 82/100 (high trust)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `strait.link`: 36/100, [markdown](https://verifymcp.io/servers/in-straitlink-mcp/strait.md), [page](https://verifymcp.io/servers/in-straitlink-mcp/strait)
- npm · `@straitlink/mcp`: 82/100 (this document), [markdown](https://verifymcp.io/servers/in-straitlink-mcp/straitlink-mcp.md), [page](https://verifymcp.io/servers/in-straitlink-mcp/straitlink-mcp)

## Channel facts

- Registry: `npm`
- Package: `@straitlink/mcp`
- Version: `0.7.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 30 of 92 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to strait-link/strait-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 80/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 5407 tokens (~168/item across 32 items; 32 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 3/100
  - Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 97/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 90% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 33 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Strait MCP server?

Strait runs locally as an npm package, launched with npx -y @straitlink/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add in-straitlink-mcp -- npx -y @straitlink/mcp
```

### Cursor

```json
{
  "mcpServers": {
    "in-straitlink-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@straitlink/mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "in-straitlink-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@straitlink/mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add in-straitlink-mcp -- npx -y @straitlink/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "in-straitlink-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@straitlink/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add in-straitlink-mcp --command npx --arg -y --arg @straitlink/mcp
```

### Hermes

```yaml
mcp_servers:
  in-straitlink-mcp:
    command: "npx"
    args: ["-y", "@straitlink/mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "in-straitlink-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@straitlink/mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add in-straitlink-mcp -t stdio -c npx -a -y @straitlink/mcp
```

### Other

```json
{
  "mcpServers": {
    "in-straitlink-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@straitlink/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 82, 0)

- [security regression] Stability: 0.00 → unverified
- [security regression] Tool safety: pass → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional] Package version: 0.6.0 → 0.7.0

### 2026-11-04 (score 82)

First indexed and scored.

## MCP tools (32)

### `create_link` (~338 tokens)

Create a link

Create one deep link (short link) in the workspace of STRAIT_SECRET_KEY. Returns the link with its shortUrl (https://<workspace>.strait.link/<slug>) to share. The link opens the app when installed (App Links / Universal Links), otherwise the store or website, and keeps the destination through an install. For more than a few links use batch_create_links.

Input parameters:

- `androidFallbackUrl` (string): Android without the app (website mode): this page instead of longUrl
- `campaign` (string): Campaign name for analytics; defaults to longUrl's utm_campaign
- `description` (string): Social preview description
- `desktopUrl` (string): Computers go here instead of longUrl
- `expiredAction` (string): Where taps go after expiry: page (expired page), store (app store), url (expiredUrl)
- `expiredUrl` (string): Required with expiredAction url
- `expiresAt` (string|number): After this the link stops opening its destination. Omit for never.
- `imageUrl` (string): Social preview image (https)
- `iosFallbackUrl` (string): iPhone without the app: this page instead of longUrl
- `longUrl` (string, required): Where the link goes: an https URL on your app's domain. The app receives its path and query as the in-app route.
- `slug` (string, required): The link's slug: the part after the link domain, e.g. `summer` in https://hilltop.strait.link/summer
- `tags` (array)
- `title` (string): Social preview title

### `batch_create_links` (~71 tokens)

Create links in bulk

Create up to 500 links in one call (imports, migrations, campaigns). Each item is checked like create_link and gets its own result; a slug that already exists is a per-item 409, so re-running an import is safe. Read results[i].ok.

Input parameters:

- `links` (array, required)

### `get_link` (~63 tokens)

Get a link

Get one active link by slug: destination, fallbacks, tags, expiry and its shortUrl.

Input parameters:

- `slug` (string, required): The link's slug: the part after the link domain, e.g. `summer` in https://hilltop.strait.link/summer

### `list_links` (~104 tokens)

List links

List links, newest first, one page at a time. Pass nextCursor back as cursor until it is null. status: active (default) or paused (turned off, and can be turned back on with update_link isActive: true; links disabled for abuse are not listed).

Input parameters:

- `cursor` (string): nextCursor from the previous page
- `limit` (integer): Page size, default 50
- `status` (string): active (default) or paused

### `update_link` (~270 tokens)

Update a link

Change a link: its destination, title, tags or expiry, or turn it off or back on with isActive. People who tap the link afterwards get the change, so this needs confirm: true. Without it nothing changes: you get a preview of the current and proposed values to show the user first. null clears expiresAt / expiredAction / expiredUrl. isActive is sent on its own: false pauses the link (taps get the "link not found" page), true turns a paused link back on (taps follow within about 30 seconds). A link disabled for breaking the acceptable use policy cannot be turned back on, and if another active link now uses the slug, pause or rename that one first.

Input parameters:

- `confirm` (boolean): true to apply the change; omit or false to preview it
- `expiredAction`
- `expiredUrl`
- `expiresAt`
- `isActive` (boolean): Alone: false pauses the link, true turns a paused link back on
- `longUrl` (string)
- `slug` (string, required): The link's slug: the part after the link domain, e.g. `summer` in https://hilltop.strait.link/summer
- `tags` (array)
- `title` (string)

### `get_analytics` (~138 tokens)

Read analytics

Taps, app opens, installs, conversions and revenue for the workspace (or one link) over a date range, optionally grouped by day, channel (whatsapp, instagram, gmail, direct…), link or platform. Same definitions as the dashboard; days are UTC; at most 92 days per call (default: the last 30 days).

Input parameters:

- `from` (string): Inclusive start: 2026-09-01, an ISO date-time or epoch ms
- `group` (string)
- `link` (string): Only this link (slug)
- `to` (string): Exclusive end, same formats; default now

### `check_app_links` (~119 tokens)

Check App Links / Universal Links files

Check a domain's App Links (Android, /.well-known/assetlinks.json) and Universal Links (iPhone, apple-app-site-association) files: each finding has a severity (ok / warn / error) and a fix. Use it when links open the browser instead of the app. It checks the files the domain serves, not how one particular phone behaves. No key needed.

Input parameters:

- `domain` (string, required): A domain such as hilltop.strait.link or shop.hilltop.example (a full URL is reduced to its host)

### `simulate_tap` (~153 tokens)

Simulate a tap

Dry-run one tap on a link from one kind of device or app and see exactly what Strait would do (redirect, in-app-browser escape page, store, preview card) and why. Nothing is recorded or billed. ua is a preset or a raw User-Agent string.

Input parameters:

- `slug` (string): The link's slug: the part after the link domain, e.g. `summer` in https://hilltop.strait.link/summer
- `ua` (string, required): A preset (android, iphone, ipad, desktop, instagram-ios, instagram-android, facebook-android, whatsapp-android, bot) or a raw User-Agent
- `url` (string): The full short link instead of slug

### `trace_tap` (~182 tokens)

Trace taps on a link

Explain where taps on a link go. With slug or url: walks the link through the common channels (Android Chrome, WhatsApp, Instagram and Facebook in-app browsers, iPhone Safari and Instagram, iPad, computer, preview bot) and returns one row per channel with the decision, where the tap is sent and the reason. A simulation: nothing is recorded. With token: reads a Live Tap Trace from the straitlink.in demo (the st value of a demo.strait.link/try link), i.e. what happened to a real tap.

Input parameters:

- `slug` (string): The link's slug: the part after the link domain, e.g. `summer` in https://hilltop.strait.link/summer
- `token` (string): Demo trace token (st=…) instead of a link
- `url` (string)

### `get_workspace` (~114 tokens)

Read the workspace and key

Read-only. Who this secret key is: the workspace name, its link domain (the host every shortUrl uses, e.g. hilltop.strait.link or a verified custom domain), custom domains, the plan, what the key may do (full, links or read) and the saved QR styles (qrStyles: their id is the preset for get_link_qr and get_campaign_qr_zip). Call it first when you need the link domain (for check_app_links) or to know whether the key can write.

### `get_usage` (~90 tokens)

Read this month's usage

Read-only. This calendar month's usage (UTC) against the workspace's plan: billed taps used and included, new links created and included (null = no limit), level (ok, warn from 80 % of included taps, over from 100 %) and new_links_paused. Going over never stops a redirect; new_links_paused means create_link answers 402 until an upgrade or the month ends.

### `get_referrals` (~119 tokens)

Read the referral report

Read-only. The referral report (a preview): for each referral code in a date range, the taps that carried it and the referred installs, most conversions first. Days are UTC; at most 92 days per call (default: the last 30 days). If referrals are not switched on for the workspace yet, says so instead of failing.

Input parameters:

- `from` (string): Inclusive start: 2026-10-01, an ISO date-time or epoch ms
- `to` (string): Exclusive end, same formats; default now

### `list_webhook_deliveries` (~169 tokens)

List webhook deliveries

Read-only. A webhook's delivery history, newest first (kept 30 days): each event sent, its status (pending = waiting for a retry, delivered, failed = gave up after 6 attempts), attempts, last HTTP status or error and the next retry time. A permanent error (e.g. unsafe_target) fails at once. Payloads are never returned. Without webhookId it lists the workspace's webhooks (id, receiver site, events, active) so you can pick one. Use it when a webhook seems to have stopped.

Input parameters:

- `cursor` (string): nextCursor from the previous page
- `limit` (integer): Page size, default 20
- `webhookId` (string): The webhook id; omit to list the webhooks first

### `test_webhook` (~92 tokens)

Send a test webhook

Write. Sends one test event (event: ping) to a webhook right now, even if it is paused, and returns whether the receiver accepted it, its HTTP status and the time taken (never its response body). The ping is not stored or retried and changes nothing in Strait. Get the id from list_webhook_deliveries without webhookId.

Input parameters:

- `webhookId` (string, required): The webhook id

### `redeliver_webhook_delivery` (~162 tokens)

Redeliver a webhook delivery

Write. Sends one past webhook delivery again, right away, to the webhook's current URL, with the same X-Strait-Delivery id (receivers that de-duplicate on it are safe); its retry schedule starts over. For failed deliveries. This re-sends a real event into the receiving system, so it needs confirm: true; without it nothing is sent. Refused (409) when already delivered or being sent right now. A paused webhook must be turned back on first (Dashboard → Settings → Webhooks), otherwise the redelivery fails at once.

Input parameters:

- `confirm` (boolean): true to send it; omit or false to preview
- `deliveryId` (string, required): The delivery id, from list_webhook_deliveries

### `deactivate_link` (~134 tokens)

Deactivate a link

Write. Turns a link off: afterwards every tap on it gets the "link not found" page instead of the app, store or website. Its history stays in analytics, and it can be turned back on with update_link with isActive: true. This needs confirm: true; without it nothing changes and you get a preview of the link to show the user first.

Input parameters:

- `confirm` (boolean): true to deactivate; omit or false to preview
- `slug` (string, required): The link's slug: the part after the link domain, e.g. `summer` in https://hilltop.strait.link/summer

### `pause_link` (~123 tokens)

Pause a link

Write. Pauses a link: until it is resumed, every tap gets the "link not found" page instead of the app, store or website. Its history stays in analytics. Needs confirm: true; without it nothing changes and you get a preview of the link to show the user. Undo with resume_link.

Input parameters:

- `confirm` (boolean): true to pause; omit or false to preview
- `slug` (string, required): The link's slug: the part after the link domain, e.g. `summer` in https://hilltop.strait.link/summer

### `resume_link` (~142 tokens)

Resume a paused link

Write. Turns a paused link back on: taps follow it again within about 30 seconds. Needs confirm: true; without it nothing changes and you get a preview (it looks the link up among paused links). A link disabled for breaking the acceptable use policy cannot be resumed, and if another active link now uses the slug, pause or rename that one first. list_links with status: paused lists paused links.

Input parameters:

- `confirm` (boolean): true to resume; omit or false to preview
- `slug` (string, required): The link's slug: the part after the link domain, e.g. `summer` in https://hilltop.strait.link/summer

### `search_links` (~176 tokens)

Search links

Read-only. Finds links by text across slug, title, destination (longUrl), campaign and tags, or by an exact tag or campaign, including paused and inactive links (status: all). Use it for "which links point at /summer", "every link tagged diwali" or "links in the spring campaign". Reads the workspace's links export, so it needs an owner's or admin's secret key.

Input parameters:

- `campaign` (string): Only links in exactly this campaign
- `limit` (integer): Links to return, default 20
- `query` (string): Text to find (case-insensitive) in slug, title, longUrl, campaign or tags
- `status` (string): active (default), inactive (paused or disabled) or all
- `tag` (string): Only links with exactly this tag

### `get_link_qr` (~286 tokens)

Get a QR code for a link

Read-only. A print-ready QR code for a link, in the workspace's QR style (Dashboard → Settings → QR codes); the options override it for this one code, or pass preset to use a saved style (get_workspace lists them). Returns the image (PNG, or SVG markup) and the exact URL in the code. By default scans add utm_source=qr, so they show as the qr channel in analytics. Refused (400) if the colours have under 3:1 contrast.

Input parameters:

- `background` (string): Background colour as hex, e.g. ffffff
- `color` (string): Code colour as hex, e.g. 1f2937
- `format` (string): png (default) or svg
- `logo` (boolean): Put the app icon in the middle (default: the workspace setting)
- `preset` (string): A saved QR style (its id from get_workspace qrStyles); color, background and logo still override it
- `size` (integer): Width and height in pixels, default 512
- `slug` (string, required): The link's slug: the part after the link domain, e.g. `summer` in https://hilltop.strait.link/summer
- `track` (boolean): Add utm_source=qr so scans count as the qr channel (default true)

### `get_campaign_qr_zip` (~306 tokens)

Get a campaign's QR codes as a ZIP

Read-only. Every live link of one campaign as print-ready QR codes in one ZIP (one file per link, `<slug>-qr.svg` or .png, sorted by slug), in the workspace's QR style or a saved style (preset; get_workspace lists them as qrStyles). SVG by default (vector, for print); PNG at most 1024 px and 50 links. Returns a summary and the ZIP as an embedded file. Scans add utm_source=qr by default. Limit: 3 ZIPs a minute per workspace. For very large campaigns use Dashboard -> Links -> filter by campaign -> QR ZIP.

Input parameters:

- `background` (string): Background colour as hex, overrides the style
- `campaign` (string, required): The links' campaign name, e.g. diwali_sale (case-insensitive, as in the dashboard's links filter)
- `color` (string): Code colour as hex, overrides the style
- `format` (string): svg (default) or png
- `logo` (boolean): Put the app icon in the middle, overrides the style
- `preset` (string): A saved QR style (its id from get_workspace qrStyles); color, background and logo still override it
- `size` (integer): Width and height in pixels (default 1024; PNG at most 1024)
- `track` (boolean): Add utm_source=qr so scans count as the qr channel (default true)

### `compare_analytics` (~231 tokens)

Compare two periods

Read-only. Compares two periods: taps, app opens, installs, conversions and revenue now against before, with the change and the percent change (null when before was 0). By default "before" is the period of the same length just before. With group (channel, platform or link) it compares each row too, biggest first. Use it for "how did this week do against last week" or "why did installs drop". Days are UTC; each period at most 92 days.

Input parameters:

- `compareFrom` (string): Start of the period to compare against; default: just before from
- `compareTo` (string): End of the period to compare against; default: from
- `from` (string): Inclusive start: 2026-10-01, an ISO date-time or epoch ms
- `group` (string): Also compare row by row
- `limit` (integer): Rows to compare with group, default 10
- `link` (string): Only this link (slug)
- `to` (string): Exclusive end, same formats; default now

### `get_top_links` (~140 tokens)

Rank the top links

Read-only. The workspace's top links over a date range, ranked by taps, app opens, installs or conversions, with each link's share of the total. Use it for "which links brought the most installs this month". Days are UTC; at most 92 days (default: the last 30).

Input parameters:

- `by` (string): What to rank by, default taps
- `from` (string): Inclusive start: 2026-10-01, an ISO date-time or epoch ms
- `limit` (integer): Links to return, default 10
- `to` (string): Exclusive end, same formats; default now

### `list_taps` (~163 tokens)

List recent taps

Read-only. Recent individual taps, newest first: when, which link, platform, channel, in-app browser, where Strait sent it (sent_to), and the app open and install it led to (opened_at, open_kind, installed_at, match_method). Default: the last hour. Use it to check that a test tap was recorded and what happened to it. Reads the taps export (an owner's or admin's key).

Input parameters:

- `from` (string): Inclusive start: 2026-10-01, an ISO date-time or epoch ms
- `limit` (integer): Taps to return, default 20
- `slug` (string): Only taps on this link
- `to` (string): Exclusive end, same formats; default now

### `list_events` (~154 tokens)

List recent events

Read-only. Recent conversion and revenue events (from the SDKs' track calls or record_event), newest first: name, value, currency, platform, the link and tap they are attributed to, and that tap's channel and campaign. Default: the last 7 days. Use it to check that purchases or sign-ups arrive. Reads the events export (an owner's or admin's key).

Input parameters:

- `from` (string): Inclusive start: 2026-10-01, an ISO date-time or epoch ms
- `limit` (integer): Events to return, default 20
- `slug` (string): Only events attributed to this link
- `to` (string): Exclusive end, same formats; default now

### `record_event` (~277 tokens)

Record a conversion event

Write. Records one conversion or revenue event from your server side (trusted: sentWith secret_key), the same as POST /v1/event. It counts in analytics and revenue and is sent to webhooks subscribed to app.event, so it needs confirm: true; without it nothing is recorded and you get a preview. clickId ties it to the tap it came from (apps get it from the SDK). eventId (e.g. your order id) makes retries safe: the same eventId is stored once. Apps should send events with the SDKs, not this tool.

Input parameters:

- `clickId` (string): The tap this conversion came from
- `confirm` (boolean): true to record it; omit or false to preview
- `currency` (string): ISO currency, e.g. INR or USD
- `data` (object): Up to 20 custom key-values for the app.event webhook (not stored with the event)
- `event` (string, required): Event name, e.g. purchase or signup
- `eventId` (string): Idempotency id, e.g. ord_1001
- `linkId` (string): The link, when there is no clickId
- `platform` (string): ios, android or web
- `value` (number): Revenue amount, e.g. 499

### `list_domains` (~92 tokens)

List custom domains

Read-only. The workspace's custom link domains (e.g. links.hilltop.example) with each one's status (pending_dns until the DNS records are in place, then live; verified once ownership is proven) and the exact DNS records to add. Also says whether custom domains are switched on and allowed on this plan (Scale and Enterprise) and the limit. Use it for "is my domain set up yet".

### `add_domain` (~135 tokens)

Add a custom domain

Write. Adds a custom link domain (a subdomain you own, e.g. links.hilltop.example) and returns the DNS records to add at your DNS provider: a CNAME to Strait, a TXT record proving ownership and a TXT record for the HTTPS certificate. Scale and Enterprise only, at most 5 per workspace. Needs confirm: true; without it nothing changes and you get a preview (plan, limit, domains already added).

Input parameters:

- `confirm` (boolean): true to add it; omit or false to preview
- `hostname` (string, required): A subdomain you own, such as links.hilltop.example

### `remove_domain` (~101 tokens)

Remove a custom domain

Write. Removes a custom link domain: links stop working on it at once (they keep working on the workspace's strait.link address). Afterwards delete its CNAME and TXT records at your DNS provider. Needs confirm: true; without it nothing changes and you get a preview.

Input parameters:

- `confirm` (boolean): true to remove it; omit or false to preview
- `hostname` (string, required): A subdomain you own, such as links.hilltop.example

### `list_webhooks` (~96 tokens)

List webhooks

Read-only. The workspace's webhooks: id, receiver site (the host only: receiver URLs often carry a secret), the events each one gets (link.clicked, app.opened, install.matched, app.event, referral.converted) and whether it is on. Never returns signing secrets. Use the id with list_webhook_deliveries or test_webhook. Webhooks are added in Dashboard → Settings → Webhooks.

### `check_link` (~113 tokens)

Check any deep link

Read-only. Checks any deep link, from any vendor (a Firebase Dynamic Link on page.link, Branch app.link, a Strait link, a plain URL): where it goes on Android, iPhone and computers, whether it still works, and what to fix. Use it before migrating links or when an old link stopped working. Only public https links. No key needed; a few checks a minute per network.

Input parameters:

- `url` (string, required): The full link, e.g. https://hilltop.page.link/abc

### `search_docs` (~98 tokens)

Search the docs

Search the Strait documentation (SDK setup for React Native / Expo, Flutter, Android, iOS, Unity, web and Node; App Links and Universal Links; deferred deep linking; analytics; REST API; webhooks; migrating from Firebase Dynamic Links or Branch; troubleshooting). Returns the closest-matching sections as Markdown with their URLs. Works offline.

Input parameters:

- `limit` (integer): Sections to return, default 4
- `query` (string, required)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/in-straitlink-mcp/straitlink-mcp#diagnostics

## Score history

- 2026-11-05: 82
- 2026-11-04: 82

## Common questions

### What is the Strait MCP server?

Strait is an MCP server listed in the public MCP registry as in.straitlink/mcp. Create, search and pause deep links; QR codes; analytics, taps, events; domains; webhooks. This page covers its npm package (@straitlink/mcp).

### Is the Strait MCP server safe to use?

Strait scores 82 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Strait MCP server expose?

Strait exposes 32 tools: create_link, batch_create_links, get_link, list_links, update_link, and 27 more. Their descriptions and schemas cost roughly 4,951 tokens of context every time the server is loaded.

### Is the Strait MCP server still maintained?

Strait is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Strait MCP server under?

Strait declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/@straitlink/mcp
- Socket report: https://socket.dev/npm/package/@straitlink/mcp
- Repository: https://github.com/strait-link/strait-mcp
- Website: https://straitlink.in/
- Changelog RSS feed: https://verifymcp.io/servers/in-straitlink-mcp/straitlink-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/in-straitlink-mcp/straitlink-mcp.json
- HTML version of this page: https://verifymcp.io/servers/in-straitlink-mcp/straitlink-mcp