qURL
Mint, resolve, audit, and rotate scope-limited expiring access links (qURLs) for AI agents.
Topics: Security
Connect
Review any command before running it. Package names and URLs come from the server's own registry entry.
Package (npm 0.10.0)
npx -y @layervai/[email protected]
Or add to your MCP client config:
{
"mcpServers": {
"qurl-mcp": {
"command": "npx",
"args": [
"-y",
"@layervai/[email protected]"
],
"env": {
"QURL_API_KEY": "<YOUR_VALUE>",
"QURL_SMTP_USERNAME": "<YOUR_VALUE>",
"QURL_SMTP_PASSWORD": "<YOUR_VALUE>"
}
}
}
}
QURL_API_KEYsecret — Optional. Without it, the tools run through the local qURL CLI (qurl), which needs no account. With it, the tools use the qURL API: a key with qurl:read, qurl:write, and/or qurl:resolve scopes from https://layerv.ai.QURL_API_URL— qURL API base URL. Defaults to https://api.layerv.ai. Override only for testing against a non-production qURL backend.QURL_CONNECTOR_URL— Connector base URL used by local-file, file-data, and text-to-PDF upload tools before minting a qURL.QURL_LINK_HOSTS— Optional comma-separated exact hostnames or IPs for uploaded-file links. No schemes, ports, or wildcards. Blank values retain any file-configured policy.QURL_MCP_CONFIG— Optional path to a shared qURL MCP config file. Both stdio and HTTP modes can read SMTP, connector, and default API settings from this file.MCP_MAX_UPLOAD_FILE_DATA_BYTES— Maximum decoded/local upload size. Accepts bytes or units such as 10mb; capped at 100mb.QURL_SMTP_HOST— SMTP hostname for optional qURL link delivery.QURL_SMTP_PORT— SMTP port for optional qURL link delivery.QURL_SMTP_SECURE— Whether SMTP uses an implicit TLS connection (true/false).QURL_SMTP_USERNAMEsecret — SMTP authentication username.QURL_SMTP_PASSWORDsecret — SMTP authentication password or app-specific credential.QURL_SMTP_FROM_EMAIL— Validated sender email address for qURL delivery.QURL_SMTP_FROM_NAME— Optional sender display name for qURL delivery.QURL_SMTP_ALLOWED_RECIPIENTS— Optional comma-separated exact recipient allowlist.QURL_SMTP_ALLOWED_RECIPIENT_DOMAINS— Optional comma-separated recipient-domain allowlist.QURL_SMTP_MAX_RECIPIENTS_PER_MESSAGE— Maximum recipients in one delivery request (default 10).QURL_SMTP_MAX_RECIPIENTS_PER_HOUR— Maximum attempted recipients per qURL key per fixed hourly window (default 100).QURL_MCP_FEEDBACK— Set to off to hide and disable outbound LayerV product feedback. Default on. Feedback is sent only by an explicit submit_feedback tool call.
Related servers
semgrep
Scan code for security vulnerabilities using Semgrep.
ida-pro-mcp
IDA Pro plugin for binary analysis: decompilation, disassembly and automatic malware analysis reports.
lauriewired/ghidramcp
Autonomous reverse engineering with Ghidra: decompile binaries, rename methods and data, and list methods, classes, imports and exports.
jadx-ai-mcp
JADX decompiler plugin providing live, LLM-assisted reverse engineering.
beelzebub
Honeypot framework for building decoy MCP tools that an agent would never use in normal work, to detect prompt injection and malicious…
SafeDep Vet MCP
Protect your AI agents and IDEs from malicious open-source packages.
Listed in punkpeye/awesome-mcp-servers (MIT)
Data from the Official MCP Registry