Gajo URL Shortener
REMOTE · GAJO.IO
Shorten URLs, manage gajo.io short links, and read click analytics. Free account, no credit card.
Available components
Last scanned (14 hours ago)
Scores higher than 89% of remote servers
Reachable. Last reached 25 Oct 2026.
Category Marketing and SEO
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security92
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server supports Client ID Metadata Documents, the current MCP client-registration mechanism. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability73
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1680 tokens (~152/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management37
- Stability observed for 11 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 25 Oct 26 0
- “create_app_link” reworded the description of “androidUrl” cosmetic
- “create_app_link” reworded the description of “iosUrl” cosmetic
- “create_app_link” reworded the description of “otherwise” cosmetic
- “update_app_link” reworded the description of “androidUrl” cosmetic
- “update_app_link” reworded the description of “iosUrl” cosmetic
- “update_app_link” reworded the description of “otherwise” cosmetic
6 cosmetic changes on this day. Switch on “Show cosmetic changes” to see them.
- 24 Oct 26 −1
- The server rewrote its instructions, which are the text every model session reads security
- New tool “update_app_link”, which the server declares destructive security
- Schema quality: pass → fail ▼ functional
- New tool “create_app_link” functional
- 23 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
- 22 Oct 26 +1
- New tool “delete_url”, which the server declares destructive security
- Tool “deactivate_url” rewrote its description, which is the text the model reads security
- Schema quality: 746 → 974 ▼ functional
- Destructive annotations: pass → 100 functional
- New tool “reactivate_url” functional
- 21 Oct 26 +1
- Tool “get_url” rewrote its description, which is the text the model reads security
- Tool “get_url_stats” rewrote its description, which is the text the model reads security
- Tool “get_usage” rewrote its description, which is the text the model reads security
- Tool “list_urls” rewrote its description, which is the text the model reads security
- Schema quality: 95 → 106 ▼ functional
- Schema quality: good → excellent functional
- 19 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Oct 26 +14
- Authorization: fail → pass ▲ security
- First check of Authorization: pass security
- The server rewrote its instructions, which are the text every model session reads security
- Tool “deactivate_url” now declares an output schema ▲ functional
- Tool “get_url” now declares an output schema ▲ functional
- Tool “get_url_stats” now declares an output schema ▲ functional
- Tool “get_usage” now declares an output schema ▲ functional
- Tool “list_urls” now declares an output schema ▲ functional
- Tool “shorten_url” now declares an output schema ▲ functional
- Tool “update_url” now declares an output schema ▲ functional
- First check of Tool coverage: 100 functional
- Schema quality: excellent → good functional
- 16 Oct 26 +1
- Tool “get_url_stats” rewrote its description, which is the text the model reads security
- Schema quality: good → excellent functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 25 Oct 2026 · Probed https://gajo.io/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=gajo.io | CN=Amazon RSA 2048 M01,O=Amazon,C=US | 24 Aug 2026 | 9 Mar 2027 | RSA 2048 | SHA256-RSA | 9b3631ca32e688a014cfa69d7cd6e26 |
| SANs: gajo.io, *.gajo.io | ||||||
| CN=Amazon RSA 2048 M01,O=Amazon,C=US (CA) | CN=Amazon Root CA 1,O=Amazon,C=US | 23 Aug 2022 | 23 Aug 2030 | RSA 2048 | SHA256-RSA | 77312380b9d6688a33b1ed9bf9ccda68e0e0f |
| CN=Amazon Root CA 1,O=Amazon,C=US (CA) | CN=Starfield Services Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US | 25 May 2015 | 31 Dec 2037 | RSA 2048 | SHA256-RSA | 67f944a2a27cdf3fac2ae2b01f908eeb9c4c6 |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of gajo.io. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| io. | present | 38690, 57355 | 8, 8 | Verified |
| gajo.io. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer resource_metadata="https://gajo.io/.well-known/oauth-protected-resource/mcp", scope="links"
Bearer resource_metadata="https://gajo.io/.well-known/oauth-protected-resource/mcp", scope="links"| Header | Value |
|---|---|
| content-security-policy | frame-ancestors 'self'; object-src 'none'; base-uri 'self' |
Protected resource metadata
| Document | https://gajo.io/.well-known/oauth-protected-resource/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://gajo.io/mcp |
| Authorisation server | https://gajo.io |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://gajo.io/mcp | Verified | 200 | |
| http (plaintext) | http://gajo.io/mcp | HTTPS enforced | 301 | https://gajo.io/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
create_app_link Create an app store link ~358
Pro only: create one short link for a mobile app. iPhones and iPads that open it go to the app's App Store page, Android devices to its Google Play page, and any other device (such as a desktop) sees a Gajo page with a QR code to scan with a phone. Use it for a link that should send people to the right app store; for an ordinary link use shorten_url.
| Name | Type | Req | Description |
|---|---|---|---|
| androidUrl | string | yes | Where Android devices go: the app's Google Play page (https://play.google.com/store/apps/details?id=...) or a Google Play test link (https://play.google.com/apps/internaltest/... or /apps/testing/...… |
| appName | string | – | The app's name for the page. Optional: looked up from the App Store when omitted. |
| customCode | string | – | Optional custom code (3-50 letters, digits, or hyphens) for a gajo.io/c/{code} link. |
| iosUrl | string | yes | Where iPhones and iPads go: the app's App Store page (https://apps.apple.com/.../id...) or, for a beta, its TestFlight link (https://testflight.apple.com/join/...). |
| otherwise | string | yes | The page every other device (such as a desktop) sees, always with a QR code of the link to scan with a phone: mobile_only says the link must be opened in a mobile browser; store_links lists both stor… |
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | – |
| appLink | object | – | App links only: where iOS and Android go, and the page other devices see. |
| clickCount | integer | – | – |
| createdDate | string | – | ISO-8601 instant. |
| expiresDate | string|null | – | ISO-8601 instant; null when the link never expires. |
| fallbackUrl | string|null | – | – |
| isCustomCode | boolean | – | – |
| originalUrl | string | yes | – |
| shortCode | string | yes | – |
| shortUrl | string | yes | Ready-to-share short link. |
No examples provided.
deactivate_url Deactivate a short link ~90
Turn off one of your short links so it stops redirecting, keeping its destination and clicks. Generated codes are never reassigned; use reactivate_url to turn the link back on, or delete_url to erase it for good.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | The link's short code (e.g. AbCdEf, or launch for gajo.io/c/launch). A full short URL also works. |
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | yes | – |
| shortCode | string | yes | – |
No examples provided.
delete_url Delete a short link permanently ~114
Permanently delete one of your short links: its destination and click history are erased and it stops redirecting. It can't be undone or reactivated, and the code is never given to anyone else. Use it when a destination shouldn't be kept, e.g. a URL with a private token; to just switch a link off, use deactivate_url.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | The link's short code (e.g. AbCdEf, or launch for gajo.io/c/launch). A full short URL also works. |
| Name | Type | Req | Description |
|---|---|---|---|
| deleted | boolean | yes | – |
| shortCode | string | yes | – |
No examples provided.
get_url Get a short link ~78
Look up one of your short links by code: destination, click count, status, and expiry. Use get_url_stats for clicks per day and where they came from.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | The link's short code (e.g. AbCdEf, or launch for gajo.io/c/launch). A full short URL also works. |
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | – |
| appLink | object | – | App links only: where iOS and Android go, and the page other devices see. |
| clickCount | integer | – | – |
| createdDate | string | – | ISO-8601 instant. |
| expiresDate | string|null | – | ISO-8601 instant; null when the link never expires. |
| fallbackUrl | string|null | – | – |
| isCustomCode | boolean | – | – |
| originalUrl | string | yes | – |
| shortCode | string | yes | – |
| shortUrl | string | yes | Ready-to-share short link. |
No examples provided.
get_url_stats Get click stats ~100
Get click analytics for one of your links, bots excluded: total clicks and clicks per day (7 days on Free, 90 on Basic, every day since the link was created on Pro). Basic and Pro also get referrers, devices, countries, and regions.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | The link's short code (e.g. AbCdEf, or launch for gajo.io/c/launch). A full short URL also works. |
| Name | Type | Req | Description |
|---|---|---|---|
| clicksByDay | array | yes | – |
| deviceBreakdown | array | – | – |
| historyDays | integer | yes | Days of history in clicksByDay. |
| shortCode | string | yes | – |
| topCountries | array | – | – |
| topReferrers | array | – | – |
| topRegions | array | – | – |
| totalClicks | integer | yes | – |
No examples provided.
get_usage Check plan and quota ~58
Shows your plan and quota: links created and remaining this month, maximum link lifetime, and API requests per minute. Call it before creating many links or after a monthly-limit error; the allowance resets on the 1st of each month (UTC).
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| maxLinkLifetimeDays | integer|null | – | null when links never expire. |
| plan | string | yes | – |
| requestsPerMinute | integer | yes | – |
| totalClicks | integer | – | – |
| totalUrls | integer | – | – |
| urlsCreatedThisMonth | integer | yes | – |
| urlsMonthlyLimit | integer | yes | – |
| urlsRemaining | integer | yes | – |
No examples provided.
list_urls List your short links ~83
List your short links, newest first, with click counts. Use it to browse or to find a link's code; for one known code use get_url, and for clicks over time get_url_stats. Returns one page; use page to see more.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Links per page. |
| page | integer | – | Page number, starting at 1. |
| Name | Type | Req | Description |
|---|---|---|---|
| hasMore | boolean | yes | – |
| limit | integer | yes | – |
| links | array | yes | – |
| page | integer | yes | – |
| total | integer | yes | – |
No examples provided.
reactivate_url Reactivate a short link ~88
Turn a link you deactivated back on, with its same code and destination. Expired links, links disabled as unsafe, and custom codes that were unassigned can't be reactivated; create a new link instead.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | The link's short code (e.g. AbCdEf, or launch for gajo.io/c/launch). A full short URL also works. |
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | – |
| appLink | object | – | App links only: where iOS and Android go, and the page other devices see. |
| clickCount | integer | – | – |
| createdDate | string | – | ISO-8601 instant. |
| expiresDate | string|null | – | ISO-8601 instant; null when the link never expires. |
| fallbackUrl | string|null | – | – |
| isCustomCode | boolean | – | – |
| originalUrl | string | yes | – |
| shortCode | string | yes | – |
| shortUrl | string | yes | Ready-to-share short link. |
No examples provided.
shorten_url Shorten a URL ~180
Create a gajo.io short link for a URL and return it as shortUrl. Links follow your plan's code length and lifetime and count against its monthly quota. Pro plans can pass customCode for a branded gajo.io/c/{code} link, or shorten app deep links (myapp://...) with a web fallbackUrl.
| Name | Type | Req | Description |
|---|---|---|---|
| customCode | string | – | Pro only: custom code (3-50 letters, digits, or hyphens). Can't be combined with lifetimeDays. |
| fallbackUrl | string | – | Pro, deep links only: web URL used when the app isn't installed. |
| lifetimeDays | integer | – | Days until the link expires; capped at your plan maximum. |
| url | string | yes | The long URL to shorten (http, https, mailto, tel, ftp, sftp; Pro: app deep links). |
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | – |
| appLink | object | – | App links only: where iOS and Android go, and the page other devices see. |
| clickCount | integer | – | – |
| createdDate | string | – | ISO-8601 instant. |
| expiresDate | string|null | – | ISO-8601 instant; null when the link never expires. |
| fallbackUrl | string|null | – | – |
| isCustomCode | boolean | – | – |
| originalUrl | string | yes | – |
| shortCode | string | yes | – |
| shortUrl | string | yes | Ready-to-share short link. |
No examples provided.
update_app_link Change an app store link ~318
Pro only: change an app link's App Store or Google Play URL, its app name, or the page other devices see. Only the fields you pass change. For an ordinary link's destination use update_url.
| Name | Type | Req | Description |
|---|---|---|---|
| androidUrl | string | – | Where Android devices go: the app's Google Play page (https://play.google.com/store/apps/details?id=...) or a Google Play test link (https://play.google.com/apps/internaltest/... or /apps/testing/...… |
| appName | string | – | The app's name for the page. Optional: looked up from the App Store when omitted. |
| code | string | yes | The link's short code (e.g. AbCdEf, or launch for gajo.io/c/launch). A full short URL also works. |
| iosUrl | string | – | Where iPhones and iPads go: the app's App Store page (https://apps.apple.com/.../id...) or, for a beta, its TestFlight link (https://testflight.apple.com/join/...). |
| otherwise | string | – | The page every other device (such as a desktop) sees, always with a QR code of the link to scan with a phone: mobile_only says the link must be opened in a mobile browser; store_links lists both stor… |
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | – |
| appLink | object | – | App links only: where iOS and Android go, and the page other devices see. |
| clickCount | integer | – | – |
| createdDate | string | – | ISO-8601 instant. |
| expiresDate | string|null | – | ISO-8601 instant; null when the link never expires. |
| fallbackUrl | string|null | – | – |
| isCustomCode | boolean | – | – |
| originalUrl | string | yes | – |
| shortCode | string | yes | – |
| shortUrl | string | yes | Ready-to-share short link. |
No examples provided.
update_url Change a link's destination ~73
Pro only: point an existing short link at a new destination URL. Takes effect immediately.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | The link's short code (e.g. AbCdEf, or launch for gajo.io/c/launch). A full short URL also works. |
| url | string | yes | The new destination URL. |
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | – |
| appLink | object | – | App links only: where iOS and Android go, and the page other devices see. |
| clickCount | integer | – | – |
| createdDate | string | – | ISO-8601 instant. |
| expiresDate | string|null | – | ISO-8601 instant; null when the link never expires. |
| fallbackUrl | string|null | – | – |
| isCustomCode | boolean | – | – |
| originalUrl | string | yes | – |
| shortCode | string | yes | – |
| shortUrl | string | yes | Ready-to-share short link. |
No examples provided.
How do I install the Gajo URL Shortener MCP server?
Gajo URL Shortener is a hosted endpoint at https://gajo.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · gajo.io
claude mcp add --transport http io-gajo-url-shortener 'https://gajo.io/mcp'
What is the Gajo URL Shortener MCP server?
Gajo URL Shortener is an MCP server listed in the public MCP registry as io.gajo/url-shortener. Shorten URLs, manage gajo.io short links, and read click analytics. Free account, no credit card. This page covers its hosted endpoint (https://gajo.io/mcp).
Is the Gajo URL Shortener MCP server safe to use?
Gajo URL Shortener scores 83 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Gajo URL Shortener MCP server expose?
Gajo URL Shortener exposes 11 tools: shorten_url, create_app_link, list_urls, get_url, get_url_stats, and 6 more. Their descriptions and schemas cost roughly 1,540 tokens of context every time the server is loaded.
Does the Gajo URL Shortener MCP server require authentication?
Yes. Gajo URL Shortener asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Gajo URL Shortener MCP server still maintained?
Gajo URL Shortener is still listed as active in the MCP registry. We last reached this channel on 25 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.