# qart.uk QR studio (remote · qart.uk)

qart.uk MCP server: resolve scanned codes, browse the free pool, and buy QR artwork.

- Trust score: 62/100 (medium)
- Change this week: +5
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-20

## Components

- remote · `qart.uk`: 62/100 (this document), [markdown](https://verifymcp.io/servers/uk-qart-qart/api-mcp.md), [page](https://verifymcp.io/servers/uk-qart-qart/api-mcp)

## Channel facts

- Endpoint: `https://qart.uk/api/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-20.

- **Endpoint Security**: 49/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 8 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC is configured correctly; the domain's records validate against the full chain to the root.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 64/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2925 tokens (~365/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 33/100
  - Stability observed for 10 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### Claude

```bash
claude mcp add --transport http uk-qart-qart https://qart.uk/api/mcp
```

### Codex

```toml
[mcp_servers.uk-qart-qart]
url = "https://qart.uk/api/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "uk-qart-qart": {
      "type": "remote",
      "url": "https://qart.uk/api/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add uk-qart-qart --url https://qart.uk/api/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  uk-qart-qart:
    url: "https://qart.uk/api/mcp"
```

### Other

```json
{
  "mcpServers": {
    "uk-qart-qart": {
      "type": "http",
      "url": "https://qart.uk/api/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-19 (score 62, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-17 (score 61, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-16 (score 60, 0)

- [functional regression] Schema quality: 319 → 365
- [cosmetic] “get_qr_matrix” added an optional parameter “allDay”
- [cosmetic] “get_qr_matrix” added an optional parameter “amount”
- [cosmetic] “get_qr_matrix” added an optional parameter “description”
- [cosmetic] “get_qr_matrix” added an optional parameter “end”
- [cosmetic] “get_qr_matrix” added an optional parameter “handle”
- [cosmetic] “get_qr_matrix” added an optional parameter “location”
- [cosmetic] “get_qr_matrix” added an optional parameter “start”
- [cosmetic] “get_qr_matrix” added an optional parameter “username”
- [cosmetic] “preview_qr_encoding” added an optional parameter “allDay”
- [cosmetic] “preview_qr_encoding” added an optional parameter “amount”
- [cosmetic] “preview_qr_encoding” added an optional parameter “description”
- [cosmetic] “preview_qr_encoding” added an optional parameter “end”
- [cosmetic] “preview_qr_encoding” added an optional parameter “fields”
- [cosmetic] “preview_qr_encoding” added an optional parameter “handle”
- [cosmetic] “preview_qr_encoding” added an optional parameter “location”
- [cosmetic] “preview_qr_encoding” added an optional parameter “message”
- [cosmetic] “preview_qr_encoding” added an optional parameter “start”
- [cosmetic] “preview_qr_encoding” added an optional parameter “title”
- [cosmetic] “preview_qr_encoding” added an optional parameter “username”
- [cosmetic] “get_qr_matrix” reworded the description of “message”
- [cosmetic] “get_qr_matrix” reworded the description of “phone”
- [cosmetic] “get_qr_matrix” reworded the description of “title”
- [cosmetic] “preview_qr_encoding” reworded the description of “payloadKind”
- [cosmetic] “preview_qr_encoding” reworded the description of “phone”

### 2026-08-15 (score 60, +2)

- [functional improvement] MCP protocol: fail → pass
- [functional] MCP protocol version: 2025-06-18 → 2026-07-28

### 2026-08-14 (score 58, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-12 (score 57, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-11 (score 56, +2)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-08-10 (score 54)

First indexed and scored.

## MCP tools (8)

### `browse_free_pool` (~121 tokens)

List the QR artwork currently claimable for free on qart.uk, one per style, with a preview image URL for each. This is the ANONYMOUS shelf — the same selection every signed-out visitor sees, and these codes are what a guest can claim. Use it to show someone what is available or to describe the styles on offer. If you are acting for a signed-in account and want codes THAT account can actually claim, use browse_my_pool instead — the two storefronts differ, and a code from here may 403 on a claim.

### `buy_qr_outright` (~277 tokens)

How to buy ONE finished QR artwork with no account at all, paying from your own wallet over x402. Returns the live price and the exact request to make. 

This is the right tool when you have a wallet but no qart.uk account: get_credit_packs buys CREDITS, which still need an account to spend, and the Studio tools all require an OAuth token. This path requires neither — you GET https://qart.uk/api/v1/qr?url=..., it answers 402, you retry with a PAYMENT-SIGNATURE header, and the PNG comes back in the response body.

You are charged ONLY if a real QR detector decodes the image: settlement runs after the scan verdict, so a request that produces nothing scannable is never settled and costs you nothing. Pay in USDC on Base — you do not need ETH, because the facilitator submits the transaction.

Cannot be performed through MCP itself: a payment rides in an HTTP header and there is nowhere to put one here. This tool tells you the call; you make it.

Input parameters:

- `size` (integer): Pixel size. 1024 costs more. Defaults to 768.
- `url` (string): The https destination you want the QR to encode. Optional — without it you get the price and the call shape.

### `explain_qart` (~85 tokens)

Explain how qart.uk works: scan verification, retargeting a printed code, the free claim pool and its daily allowances, Studio pricing, and what happens to credits when a run is stopped or fails. Use this before guessing at product details — pricing and allowances change and this returns the current text.

Input parameters:

- `topic` (string): Which aspect to explain. Defaults to overview.

### `get_credit_packs` (~133 tokens)

What Studio credits cost: the packs on sale, their price in USD, and roughly how many images each buys. Anonymous — this is a price list. Read it rather than quoting a price from memory; packs change.

An agent that runs out mid-task can top up WITHOUT a human, paying from its OWN wallet: POST /api/qart/x402/credits?pack=... with a qart:purchase bearer token. The money comes from the application's wallet, never the user's card. Stripe checkout (POST /api/qart/checkout) remains human-only; hand the user the purchase URL for that.

### `get_dither_qr_parameters` (~210 tokens)

The complete parameter contract for qart.uk's dithered photo QR recipe — an error-diffused technique (after andrew-t) that dithers a photograph into the space around each QR module, so the finished 1-bit image reads as a picture and still scans.

THIS TOOL GENERATES NOTHING. There is no API for the technique and no endpoint that will run it for you: it is a browser-side generator, and this tool returns the parameters, ranges, defaults and algorithm order so that YOU can implement it or instruct someone who will. Pair it with get_qr_matrix, which supplies the module grid and the function-pattern map the algorithm needs.

It also returns the honest limits, which matter before anyone prints anything: no scan verdict is computed anywhere in this path, error correction wants to stay at H, and stricter detectors (zbar) reject output that phone-grade detectors accept. Treat a dithered code as untested until someone scans the actual printed sheet.

### `get_qr_matrix` (~823 tokens)

Return the actual QR MODULE GRID for a payload — the black/white matrix, plus a per-module map of which modules are function patterns (finder, separator, timing, alignment, format info, version info, dark module) and which carry data. Both come back as one row string per row. Costs nothing, mints nothing, stores nothing.

Use this when you are going to RENDER or transform a QR yourself: dithering a photo into it, drawing it as an SVG, laying it out for print, or reasoning about which modules are safe to alter. The function-pattern map is the point — any technique that paints over a QR has to know which modules a scanner uses to FIND the code (finder, timing, alignment) versus which merely carry bits.

Do NOT use it to check whether a payload fits — preview_qr_encoding is smaller and answers that. Do NOT use it to get a qart.uk product: this is a plain standards QR, with no artwork, no scan verdict and no alias behind it. The matrix is canonical and untransformed: invert, rotation, mirror and any subpixel scaling are yours to apply afterwards.

Input parameters:

- `address` (string): For 'vcard': postal address.
- `allDay` (boolean): For 'event': all-day (DATE values).
- `amount` (string): For 'paypal': optional amount.
- `auth` (string): For 'wifi': security type. Defaults to WPA.
- `body` (string): For 'mailto': message body.
- `description` (string): For 'event': description.
- `ecc` (string): Error correction level. Defaults to H, which is what any paint-over-the-code technique needs.
- `email` (string): Email address, for 'vcard'/'mecard'/'mailto'.
- `end` (string): For 'event': end datetime.
- `handle` (string): For social kinds (instagram, twitter, youtube, facebook, tiktok, linkedin, paypal): handle or profile URL.
- `hidden` (boolean): For 'wifi': hidden network.
- `lat` (number): For 'geo': latitude.
- `lng` (number): For 'geo': longitude.
- `location` (string): For 'event': location.
- `mask` (string): Which of the 8 standard mask patterns to apply. 'auto' (default) picks the lowest-penalty one, exactly as the encoder in the browser does. All 8 are legal and scan identically; they differ only in ho…
- `message` (string): For 'sms'/'whatsapp': message text.
- `name` (string): For 'vcard'/'mecard': full name.
- `org` (string): For 'vcard': organization.
- `password` (string): For 'wifi': network password.
- `payloadKind` (string): What the code should contain. Defaults to url.
- `phone` (string): Phone number, for 'vcard'/'mecard'/'tel'/'sms'/'whatsapp'.
- `ssid` (string): For 'wifi': network name.
- `start` (string): For 'event': start datetime (YYYY-MM-DDTHH:MM).
- `subject` (string): For 'mailto': subject line.
- `text` (string): For 'text': the literal text.
- `title` (string): For 'vcard': job title. For 'event': event title.
- `url` (string): For 'url': the destination. For 'vcard'/'mecard': the website.
- `username` (string): For 'telegram': username or t.me URL.
- `version` (integer): Force a QR version (1-40, size 21-177 modules). Omit for the smallest that fits. Pinning BELOW the fit is impossible and is raised to the fit, matching the Studio.

### `preview_qr_encoding` (~604 tokens)

Work out how a payload will encode as a QR code, without creating anything. Returns the exact string the pixels would carry, its byte length, the QR version and module count required, the capacity remaining at that version, and any warnings. Costs nothing and mints nothing.

Use this to answer questions like "will this URL fit at error correction level H" or "how much does a long Wi-Fi password cost me in QR density". Higher ECC survives damage better but needs more modules for the same data; more modules print smaller and get harder to scan.

payloadKind 'qart_code' sizes the RETARGETABLE variant instead: the pixels carry a 16-byte qart.uk/_ link rather than your data, which is usually several versions smaller. Compare the two before committing to a print.

This returns metadata only, never the module grid. For the actual black/white matrix, call get_qr_matrix.

Input parameters:

- `allDay` (boolean): For 'event': all-day (DATE values).
- `amount` (string): For 'paypal': optional amount.
- `description` (string): For 'event': description.
- `ecc` (string): Error correction level, lowest to highest. Defaults to the Studio default if omitted.
- `email` (string): For payloadKind 'vcard': email address.
- `end` (string): For 'event': end datetime.
- `fields` (object): Payload fields for the kind. Flat sibling properties (url, phone, handle, …) are also accepted, matching get_qr_matrix.
- `handle` (string): For social kinds: handle or profile URL.
- `location` (string): For 'event': location.
- `message` (string): For 'sms'/'whatsapp': message text.
- `name` (string): For payloadKind 'vcard': full name.
- `password` (string): For payloadKind 'wifi': network password.
- `payloadKind` (string, required): What the code should contain. 'qart_code' sizes the retargetable variant — a 16-byte qart.uk/_ link instead of your data. whatsapp/telegram/event/social kinds assemble a standard URL or VCALENDAR; th…
- `phone` (string): Phone, for vcard/mecard/tel/sms/whatsapp.
- `ssid` (string): For payloadKind 'wifi': network name.
- `start` (string): For 'event': start datetime (YYYY-MM-DDTHH:MM).
- `text` (string): For payloadKind 'text': the literal text.
- `title` (string): For 'event': title. For 'vcard': job title.
- `url` (string): For payloadKind 'url': the destination.
- `username` (string): For 'telegram': username or t.me URL.
- `version` (integer): Force a QR version (size). Omit to use the smallest that fits.

### `resolve_qart_code` (~135 tokens)

Resolve a scanned qart.uk code to the URL it currently points at. Accepts the alias ('_ab12cde'), or a full qart.uk URL to pull it out of. Returns targetUrl, or disabledReason if the owner retired it. This does not count as a scan and will not affect the owner's statistics. Only the '_' code class resolves here; older qart.uk links of other shapes are not in this pool.

Input parameters:

- `code` (string, required): The code to resolve — '_ab12cde', '/_ab12cde', or 'https://qart.uk/_ab12cde'.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/uk-qart-qart/api-mcp#diagnostics

## Score history

- 2026-08-20: 62
- 2026-08-19: 62
- 2026-08-18: 61
- 2026-08-17: 61
- 2026-08-16: 60
- 2026-08-15: 60
- 2026-08-14: 58
- 2026-08-13: 57
- 2026-08-12: 57
- 2026-08-11: 56
- 2026-08-10: 54

## Links

- Remote endpoint: https://qart.uk/api/mcp
- Changelog RSS feed: https://verifymcp.io/servers/uk-qart-qart/api-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/uk-qart-qart/api-mcp.json
- HTML version of this page: https://verifymcp.io/servers/uk-qart-qart/api-mcp