OpenQR
REMOTE · OPENQR.UK · 2 COMPONENTS · SCANNED OCT 9
Generate, edit and track dynamic (editable) QR codes with scan analytics. Hosted MCP and REST API.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 20 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability84
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 1772 tokens (~70/item across 25 items; 20 tools + 5 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage97
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 90% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_dynamic_qr" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the OpenQR MCP server?
OpenQR is a hosted endpoint at https://openqr.uk/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · openqr.uk
claude mcp add --transport http uk-openqr-qr 'https://openqr.uk/mcp'
{
"mcpServers": {
"uk-openqr-qr": {
"url": "https://openqr.uk/mcp"
}
}
} {
"servers": {
"uk-openqr-qr": {
"type": "http",
"url": "https://openqr.uk/mcp"
}
}
} [mcp_servers.uk-openqr-qr] url = "https://openqr.uk/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"uk-openqr-qr": {
"type": "remote",
"url": "https://openqr.uk/mcp",
"enabled": true
}
}
} openclaw mcp add uk-openqr-qr --url 'https://openqr.uk/mcp' --transport streamable-http
mcp_servers:
uk-openqr-qr:
url: "https://openqr.uk/mcp" {
"McpServers": {
"uk-openqr-qr": {
"Transport": "http",
"Url": "https://openqr.uk/mcp"
}
}
} assistant mcp add uk-openqr-qr -t streamable-http -u 'https://openqr.uk/mcp'
{
"mcpServers": {
"uk-openqr-qr": {
"type": "http",
"url": "https://openqr.uk/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 28 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 17 Sept 26 +1
- Stability: 0.97 → pass security
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 0
- New tool “list_link_aliases” functional
- New tool “create_link_alias” functional
- “update_dynamic_qr” reworded the description of “status” cosmetic
- 9 Sept 26 +1
- “update_dynamic_qr” reworded the description of “status” cosmetic
1 cosmetic change on this day. Switch on “Show cosmetic changes” to see it.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 9 Oct 2026 · Probed https://openqr.uk/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=openqr.uk | CN=WE1,O=Google Trust Services,C=US | 21 Aug 2026 | 19 Nov 2026 | ECDSA 256 | ECDSA-SHA256 | e26186b2c53ac3f4133424197d954ac8 |
| SANs: openqr.uk, *.openqr.uk | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of openqr.uk. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| uk. | present | 43876 | 8 | Verified |
| openqr.uk. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains; preload |
| content-security-policy | default-src 'self'; script-src 'self' 'unsafe-inline' https://accounts.google.com https://analytics.clinicalwebdesign.co.uk; style-src 'self' 'unsafe-inline' https://accounts.google.com; frame-src 'self' https://accounts.google.com; img-src 'self' data: blob: https://*.basemaps.cartocdn.com; font-src 'self' data:; connect-src 'self' https://analytics.clinicalwebdesign.co.uk https://nominatim.openstreetmap.org https://accounts.google.com; worker-src 'self' blob:; manifest-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests |
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | geolocation=(self), camera=(self), microphone=(), browsing-topics=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://openqr.uk/mcp | Verified | 200 | |
| http (plaintext) | http://openqr.uk/mcp | HTTPS enforced | 301 | https://openqr.uk/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
bulk_create_dynamic_qr ~57
Create up to 200 dynamic QR codes at once. Requires an OpenQR API key.
| Name | Type | Req | Description |
|---|---|---|---|
| codes | array | yes | Codes to create. |
| theme | string | – | A saved theme id or name applied to every code created. |
No output schema declared.
No examples provided.
clear_subdomain ~52
Release the branded subdomain. Codes stay live on the plain short link; only the {name}.oqr.to form stops resolving. The name becomes claimable by someone else. Requires an OpenQR API key.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
create_dynamic_qr ~79
Create an editable (dynamic) QR code whose destination you can change later without reprinting. Requires an OpenQR API key.
| Name | Type | Req | Description |
|---|---|---|---|
| destination | string | yes | The http(s) URL the code should point to. |
| label | string | – | Optional label. |
| theme | string | – | A saved theme id or name to style the code with. |
No output schema declared.
No examples provided.
create_folder ~29
Create a folder to organise codes. Requires an OpenQR API key.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | – |
No output schema declared.
No examples provided.
create_link_alias ~123
Create an extra short link (link alias) that resolves where one of your dynamic codes points: share a different slug per channel while the QR keeps its own slug, so QR scans and link clicks are counted separately. Free accounts have no alias allowance; Pro includes 10. Requires an OpenQR API key.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The dynamic code id the alias should point at. |
| slug | string | – | Optional custom back-half (oqr.to/<slug>): 3–48 letters, numbers or hyphens. Omit for a random one. |
No output schema declared.
No examples provided.
create_static_qr ~232
Save a static QR code to your library from structured fields: wifi, contact (vCard), email, SMS, WhatsApp, location, text, phone or URL. Static codes bake the content into the code itself — no short link, no scan analytics, not editable later. Render the returned payload with generate_qr. Requires an OpenQR API key.
| Name | Type | Req | Description |
|---|---|---|---|
| fields | object | yes | Field names depend on type. url: url. text: text. email: email, subject?, body?. phone: phone. sms: phone, message?. whatsapp: phone (country code, digits only), message?. wifi: ssid, password?, encr… |
| label | string | – | Optional label for your dashboard. |
| theme | string | – | A saved theme id or name to style the code with. |
| type | string | yes | The payload type. |
No output schema declared.
No examples provided.
create_theme ~77
Save a reusable style theme. `style` is a QR style object (fgColor, bgColor, dotType, cornerSquareType, etc.). Requires an OpenQR API key.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | – |
| style | object | yes | QR style JSON (colours, dot/corner shapes, logo, gradient, frame…). |
No output schema declared.
No examples provided.
delete_dynamic_qr ~42
Permanently delete a dynamic QR code. The short link stops working. Requires an OpenQR API key.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The dynamic code id. |
No output schema declared.
No examples provided.
delete_folder ~36
Delete a folder (its codes are un-filed, not deleted). Requires an OpenQR API key.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
delete_theme ~36
Delete a saved theme. Codes already styled with it keep their look. Requires an OpenQR API key.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
generate_qr ~108
Generate a static QR code from any text/URL. Returns a PNG image (or SVG markup). Requires an OpenQR API key.
| Name | Type | Req | Description |
|---|---|---|---|
| data | string | yes | The content to encode (URL or text). |
| format | string | – | Output format (default png). |
| size | number | – | Pixel size, 96–2048 (default 512). |
| theme | string | – | A saved theme id or name. Applies the theme's colours; full styling applies to dynamic codes. |
No output schema declared.
No examples provided.
get_dynamic_qr ~58
Get the full details of one of your QR codes by id: destination, short link, label, type, tags, folder, status and created date. Requires an OpenQR API key.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The code id. |
No output schema declared.
No examples provided.
get_scans ~36
Get scan statistics for a dynamic QR code. Requires an OpenQR API key.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The dynamic code id. |
No output schema declared.
No examples provided.
get_subdomain ~61
Show the branded subdomain on this account ({name}.oqr.to). Reports whether it is currently suspended — a suspended subdomain redirects to the plain short link instead of serving, which happens when a Pro plan lapses. Requires an OpenQR API key.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_dynamic_qr ~57
List your dynamic (editable) QR codes — id, short URL, destination, label and status. Requires an OpenQR API key.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max codes to return, 1–500 (default 200). |
No output schema declared.
No examples provided.
list_folders ~24
List your folders (id and name). Requires an OpenQR API key.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_link_aliases ~37
List the link aliases of one dynamic code. Requires an OpenQR API key.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The dynamic code id. |
No output schema declared.
No examples provided.
list_themes ~45
List your saved style themes (id, name) — apply one by passing its id or name as `theme` to generate/create/update tools. Requires an OpenQR API key.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
set_subdomain ~84
Claim or change the branded subdomain so codes also resolve at {name}.oqr.to. Pro only. Codes keep working on the plain short link either way, so changing this never breaks anything already printed. Requires an OpenQR API key.
| Name | Type | Req | Description |
|---|---|---|---|
| subdomain | string | yes | 3–32 letters, numbers or hyphens, e.g. "acme". |
No output schema declared.
No examples provided.
update_dynamic_qr ~423
Edit a dynamic QR code: change its destination, label, custom short link (slug), tags or folder. Pass only the fields you want to change. Requires an OpenQR API key.
| Name | Type | Req | Description |
|---|---|---|---|
| android_destination | string|null | – | App links: Android scanners follow this http(s) URL instead of destination (e.g. the Google Play page). Pass null to clear. |
| destination | string | – | New http(s) URL. |
| folder_id | string|null | – | Move into a folder id, or null to un-file. |
| id | string | yes | The dynamic code id. |
| ios_destination | string|null | – | App links: iOS scanners follow this http(s) URL instead of destination (e.g. the App Store page). Pass null to clear. Applies to the plain redirect only. |
| label | string | – | New label. |
| lock_hint | string|null | – | Optional hint shown on the unlock page, e.g. "Ask at the bar". Max 60 characters. |
| password | string|null | – | Pro: require this password before the code redirects (min 4 characters). Pass null to remove all protection. |
| pause_until | string|null | – | ISO 8601 timestamp: schedule a pause until then (scanners see the inactive page; the code self-resumes at the deadline). Pass null to clear the schedule. Future timestamps only, active codes only. |
| pin | string|null | – | Pro: require a 4-digit PIN before the code redirects. Exactly 4 digits. Pass null to remove all protection. |
| slug | string | – | Custom short-link back-half (oqr.to/<slug>): 3–48 letters, numbers or hyphens. |
| status | string | – | Pause the code (it stops resolving — scanners see an inactive page) or reactivate it. Free allows 1 active code; Pro 25. |
| tags | array | – | Replace the code's tags (max 10). |
| theme | string | – | A saved theme id or name to restyle the code with. |
No output schema declared.
No examples provided.
What is the OpenQR MCP server?
OpenQR is an MCP server listed in the public MCP registry as uk.openqr/qr. Generate, edit and track dynamic (editable) QR codes with scan analytics. Hosted MCP and REST API. This page covers its hosted endpoint (https://openqr.uk/mcp).
Is the OpenQR MCP server safe to use?
OpenQR scores 81 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the OpenQR MCP server expose?
OpenQR exposes 20 tools: generate_qr, create_dynamic_qr, create_static_qr, update_dynamic_qr, get_dynamic_qr, and 15 more. Their descriptions and schemas cost roughly 1,696 tokens of context every time the server is loaded.
Does the OpenQR MCP server require authentication?
No. We connected to OpenQR without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the OpenQR MCP server still maintained?
OpenQR is still listed as active in the MCP registry. We last reached this channel on 9 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.