Snip
REMOTE · SNIP.LINK
Free QR codes that never expire and free short links with click stats.
Available components
Last scanned (7 hours ago)
Scores higher than 57% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Marketing and SEO
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (delete_link). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability60
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3843 tokens (~320/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management50
- Stability observed for 15 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 98% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 0
- Tool “delete_link” rewrote its description, which is the text the model reads security
- Tool “list_domains” rewrote its description, which is the text the model reads security
- Tool “shorten_link” rewrote its description, which is the text the model reads security
- “delete_link” reworded the description of “link” cosmetic
- “get_link_stats” reworded the description of “link” cosmetic
- “shorten_link” reworded the description of “ending” cosmetic
- “update_link” reworded the description of “link” cosmetic
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.
- 29 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “make_qr_code” rewrote its description, which is the text the model reads security
- Tool “save_collection” rewrote its description, which is the text the model reads security
- Tool “save_page” rewrote its description, which is the text the model reads security
- Tool “delete_link” rewrote its description, which is the text the model reads security
- Tool “get_account_stats” rewrote its description, which is the text the model reads security
- Tool “get_link_stats” rewrote its description, which is the text the model reads security
- Tool “list_collections” rewrote its description, which is the text the model reads security
- Tool “list_domains” rewrote its description, which is the text the model reads security
- Tool “list_links” rewrote its description, which is the text the model reads security
- Tool “shorten_link” rewrote its description, which is the text the model reads security
- Tool “update_link” rewrote its description, which is the text the model reads security
- “shorten_link” reworded the description of “ending” cosmetic
- “shorten_link” reworded the description of “routes” cosmetic
- “shorten_link” reworded the description of “title” cosmetic
- “update_link” reworded the description of “routes” cosmetic
- “update_link” reworded the description of “watch” cosmetic
- 27 Oct 26 0
- Tool “save_page” rewrote its description, which is the text the model reads security
- Tool “shorten_link” rewrote its description, which is the text the model reads security
- “save_page” added an optional parameter “presets” cosmetic
- “shorten_link” added an optional parameter “expires_in_days” cosmetic
- “shorten_link” added an optional parameter “forward_query” cosmetic
- “shorten_link” added an optional parameter “presets” cosmetic
- “shorten_link” added an optional parameter “preview” cosmetic
- “shorten_link” added an optional parameter “qr_style” cosmetic
- “shorten_link” added an optional parameter “snapshots” cosmetic
- “shorten_link” added an optional parameter “stats_public” cosmetic
- “shorten_link” added an optional parameter “track” cosmetic
- “save_page” reworded the description of “fresh” cosmetic
- 26 Oct 26 +1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “drop_file” rewrote its description, which is the text the model reads security
- Tool “list_links” rewrote its description, which is the text the model reads security
- “list_links” added an optional parameter “cursor” cosmetic
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://snip.link/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=snip.link | CN=WE1,O=Google Trust Services,C=US | 5 Nov 2026 | 3 Feb 2027 | ECDSA 256 | ECDSA-SHA256 | cafc9ab62b985320eb86edf62443a93 |
| SANs: snip.link, go.snip.link, *.go.snip.link | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of snip.link. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| link. | present | 16766 | 13 | Verified |
| snip.link. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=15552000 |
| content-security-policy | default-src 'self'; script-src 'self' 'sha256-v2/WSreELrWL5kDKul5CVQhBPoyr/iAg6dIqvWERMuA=' 'sha256-KzwBrFqhZRX2M5EOg02H7tKc1x8ajnbsDTL8bOMDNIg=' https://plausible.io https://www.googletagmanager.com https://clerk.snip.link https://*.clerk.accounts.dev https://challenges.cloudflare.com https://*.protect.clerk.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://snip.link https://go.snip.link https://snipcontent.com https://www.googletagmanager.com https://*.google-analytics.com https://img.clerk.com; media-src 'self' blob: https://snip.link https://go.snip.link https://snipcontent.com; font-src 'self'; connect-src 'self' https://plausible.io https://www.googletagmanager.com https://*.google-analytics.com https://clerk.snip.link https://*.clerk.accounts.dev https://*.protect.clerk.com:*; frame-src 'self' https://challenges.cloudflare.com https://*.protect.clerk.com; worker-src 'self' blob:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-req |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=(), payment=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://snip.link/mcp | Verified | 200 | |
| http (plaintext) | http://snip.link/mcp | HTTPS enforced | 301 | https://snip.link/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
delete_link Delete a link ~151
Permanently deletes one of the user's Snip.link links and its click history; its current and previous short URLs stop working within a minute and its current and previous endings remain reserved indefinitely, including for the same account. There is no automatic release, restore or reuse operation. Needs the user signed in to Snip.link. Confirm with the user first; to pause every ending instead, use update_link with disabled true.
| Name | Type | Req | Description |
|---|---|---|---|
| link | string | yes | The full short URL (https://go.snip.link/abc123 or https://snip.link/r/abc123), its ending (abc123) or its id. Full URLs are scoped to their host; they never select a same-ending link on another doma… |
No output schema declared.
No examples provided.
drop_file Share a file with a short link ~306
Put a file on the web and get a short snip.link link to it, free. Send text (a note, Markdown, CSV, JSON, code) as `content`, or any other file (a PDF, a picture, a document) as `content_base64`, with its file name. The link opens a page that shows the file with a download button and a QR code; the link with the file's extension is the file itself, and file.formats lists its available conversion URLs. Supported pairs, MIME types and fidelity notes are at https://snip.link/convert/formats.json; outputs depend on the file and engine limits. A pending conversion returns 202 with Retry-After. Files are at most 10 MB through this tool; use the REST API for larger files. Use this when the user wants to share, send, publish, host or link to a file, or wants something you wrote available as a link or a QR code. Files shared without an account stay up for 30 days unless the user keeps them with a free account.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | – | The file's text, for text files. |
| content_base64 | string | – | The file's bytes in base64, for anything else. |
| name | string | yes | The file name with its extension, which decides how it is shown: notes.md, prices.csv, photo.png. |
| title | string | – | A title for the user's dashboard (signed in only). |
No output schema declared.
No examples provided.
get_account_stats Get account stats ~127
Clicks and QR scans across every link in the user's Snip.link account: totals, by day, the busiest links, and the top countries, referring sites and devices. Needs the user signed in to Snip.link. Use this for questions like "how are my links doing" or "which link got the most scans this week".
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | How many days back, up to the plan's limit (30 on Free, a year on Pro). Default 30. |
| links | integer | – | How many of the busiest links to list. Default 10. |
No output schema declared.
No examples provided.
get_link_stats Get link stats ~184
Clicks and QR scans for one of the user's own Snip.link links: totals, by day, by hour of the day on plans with time-of-day analytics, and the top countries, referring sites and devices. Needs the user signed in to Snip.link (the account endpoint or an API key). Pass the short link, its ending or its id. For every link at once, use get_account_stats.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | How many days back, up to the plan's limit (30 on Free, a year on Pro). Default 30. |
| link | string | yes | The full short URL (https://go.snip.link/abc123 or https://snip.link/r/abc123), its ending (abc123) or its id. Full URLs are scoped to their host; they never select a same-ending link on another doma… |
No output schema declared.
No examples provided.
list_collections List collections ~67
The user's Snip.link collections: links grouped by hand, each with how many links it holds and its public page (snip.link/c/<address>, one button per live link) when that is on. Needs the user signed in to Snip.link. Change one with save_collection.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_domains List own domains ~82
The user's own domains (go.yourbrand.com), their state, CNAME target and account-specific TXT ownership proof. Pass a live one as domain to shorten_link. New connections need both DNS records; an old CNAME alone does not prove control. Needs the user signed in to Snip.link; add domains in the dashboard or POST /v1/domains.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_links List links ~119
The user's Snip.link links, newest first, with their destinations and click counts. Needs the user signed in to Snip.link. Pass a search to match an ending, a destination or a title. To continue, pass the answer's next_cursor as cursor with the same search.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | The previous answer's next_cursor, for the next page with the same search. |
| limit | integer | – | How many to return. Default 20. |
| search | string | – | Text to match against the ending, destination and title. |
No output schema declared.
No examples provided.
make_qr_code Make a QR code ~264
Make a static QR code for a link, text, Wi-Fi network, contact card, email, phone number or SMS, free and with no account. Returns a PNG and an SVG download link that the user can open, save or print; show the PNG link to the user. Static codes hold the content in the pattern, so they never expire and keep working without Snip.link. Use this whenever the user asks for a QR code.
| Name | Type | Req | Description |
|---|---|---|---|
| bg | string | – | Background colour, #rrggbb. Default #ffffff. |
| data | string | yes | What the QR code holds: a web address, plain text, a WIFI:T:WPA;S:<name>;P:<password>;; string, a vCard, mailto:, tel: or sms:. For a link the user may want to change or track later, call shorten_lin… |
| ecc | string | – | Error correction: L 7%, M 15% (default), Q 25%, H 30% of the code can be damaged and still scan. |
| fg | string | – | Dark colour, #rrggbb, for example #111111. Default #111111. |
| style | string | – | Dot shape. Default rounded. |
No output schema declared.
No examples provided.
save_collection Create or change a collection ~253
Creates a collection of the user's Snip.link links, or changes one (pass collection, its id from list_collections): its name, the line under it, its links in order, and whether it has a public page at snip.link/c/<address> that shows one button per live link, link-in-bio style. links replaces the collection's links in that order; leave it out to keep them. Free on every plan; the links themselves never change. Needs the user signed in to Snip.link.
| Name | Type | Req | Description |
|---|---|---|---|
| collection | string | – | The id of the collection to change. Leave it out to create one. |
| description | string|null | – | One line under the name on the page. null removes it. |
| links | array | – | The links in order, each by short URL, ending or id (see list_links). Replaces the collection's links. |
| name | string | – | The collection's name, shown on its page. |
| public | boolean | – | true switches the public page on, false off. Off by default. |
| slug | string | – | The page's address after /c/: lowercase letters, digits and dashes. Left out, one is made from the name. |
No output schema declared.
No examples provided.
save_page Save and read a web page ~226
Read a public web page as clean Markdown and save a copy, subject to retention and access settings. Returns the page's text, a short link, QR code and saved-format URLs (.md, .txt, .jpg, .pdf, .mhtml). Successful public copies also return archive_url for the exact version and cite with APA 7, MLA 9, Chicago and BibTeX citations preserving the original source. Those fields are null until a public copy is available. Saving a page does not verify its claims. No account is required. A page saved in the last day may be reused; pass fresh for a new capture.
| Name | Type | Req | Description |
|---|---|---|---|
| formats | array | – | Only these formats (faster for just the text). Default: all of them. |
| fresh | boolean | – | Load the page again even if it was saved in the last day. Default false. |
| presets | array | – | Owned Library ids, one per kind. Omit for account defaults; [] skips Library defaults. Explicit link settings win. |
| url | string | yes | The http or https page to save. |
No output schema declared.
No examples provided.
shorten_link Shorten a link ~739
Turn a long web address into a short snip.link link, free, and get a QR code for it. Use this when the user wants a short link, a link they can change after printing, click and scan counts, or a YouTube, Spotify or Amazon link that opens the app when tapped inside Instagram, TikTok or Facebook (every Snip.link link does that on its own). When the user is not signed in to Snip.link the link works at once and the answer includes a claim link the user can open to keep it in a free Snip.link account and see its clicks. When they are signed in (the account endpoint or an API key) the link is saved to their account, and a custom ending (go.snip.link/your-ending) is allowed.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | – | One of the user's own live domains (go.yourbrand.com, see list_domains) to put the link on instead of snip.link. Needs the user signed in on a plan with own domains. |
| ending | string | – | Custom ending for go.snip.link/<ending>, also available at snip.link/r/<ending>: 3 to 40 ASCII letters, digits, dashes or underscores, with no spaces. Free with a Snip.link account. Omit or send an e… |
| expires_in_days | integer|null | – | Expiry from creation; null means no expiry. |
| forward_query | boolean | – | Override query-parameter forwarding. |
| presets | array | – | Owned Library ids, one per kind. Omit for account defaults; [] skips Library defaults. Explicit link settings win. |
| preview | object|null | – | Social preview; null clears a Library preview. |
| qr_style | object|null | – | QR settings; null clears a Library QR style. |
| routes | array | – | Rules that send some visits elsewhere, tried in order; the first match wins and everyone else goes to url. Free with a Snip.link account. Each rule: conditions joined by when (all or any) and its own… |
| snapshots | string | – | – |
| stats_public | boolean | – | Whether aggregate stats are public. Explicit false overrides a saved template. |
| title | string | – | A name for the link in the user's dashboard. Needs the user signed in to Snip.link. |
| track | boolean | – | Override the default for visit tracking. |
| url | string | yes | The http or https address to shorten. |
No output schema declared.
No examples provided.
update_link Update a link ~836
Changes the ending, destination, title, rules, schedule (go-live time, expiry, click limit) or link preview (the title, line and picture chat apps and social sites show when the link is pasted) of one of the user's Snip.link links, switches it off and on, or watches its page for changes. Custom endings and renaming are free with an account. Previous short URLs and printed QR codes keep working, follow the latest destination and share the same analytics until the link is disabled or deleted. A link keeps up to 20 previous endings. Needs the user signed in to Snip.link. Pass only the fields to change.
| Name | Type | Req | Description |
|---|---|---|---|
| disabled | boolean | – | True switches the link off (it answers 404); false switches it back on. |
| ending | string | – | The new ending: 3 to 40 ASCII letters, digits, dashes or underscores, with no spaces. Reusing this link's previous ending or changing only its case does not use another previous-ending slot. |
| expires_at | string|null | – | When the link stops working, as an ISO date and time. After it, visits see an expired page. null: never. |
| link | string | yes | The full short URL (https://go.snip.link/abc123 or https://snip.link/r/abc123), its ending (abc123) or its id. Full URLs are scoped to their host; they never select a same-ending link on another doma… |
| max_clicks | integer|null | – | Stop the link after this many counted visits in total (bots and repeat taps within a minute are not counted). null: no limit. |
| preview | object|null | – | The link's own preview card for chats and posts. Any field left out shows the page's own. image is an https picture address or screenshot (the page's first screen). null removes it. Free on every pla… |
| routes | array | – | Rules that send some visits elsewhere, tried in order; the first match wins and everyone else goes to url. Free with a Snip.link account. Each rule: conditions joined by when (all or any) and its own… |
| starts_at | string|null | – | When the link goes live, as an ISO date and time (2026-11-01T09:00:00Z). Before it, visits see a not live yet page and are not counted. null: live now. |
| title | string | – | A new name for the dashboard. |
| track | boolean | – | false: only count visits, without recording when, where or on what device. true: record them. |
| url | string | – | The new http or https destination. |
| watch | string | – | Watch the destination page: Snip.link saves a fresh copy daily or weekly and emails the user what was added and what went when its words change. off stops. A paid plan feature; the error says which p… |
No output schema declared.
No examples provided.
How do I install the Snip MCP server?
Snip is a hosted endpoint at https://snip.link/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · snip.link
claude mcp add --transport http link-snip-snip 'https://snip.link/mcp'
What is the Snip MCP server?
Snip is an MCP server listed in the public MCP registry as link.snip/snip. Free QR codes that never expire and free short links with click stats. This page covers its hosted endpoint (https://snip.link/mcp).
Is the Snip MCP server safe to use?
Snip scores 71 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Snip MCP server expose?
Snip exposes 12 tools: make_qr_code, shorten_link, save_page, drop_file, get_link_stats, and 7 more. Their descriptions and schemas cost roughly 3,354 tokens of context every time the server is loaded.
Does the Snip MCP server require authentication?
No. We connected to Snip without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Snip MCP server still maintained?
Snip is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.