Home › Security › qURL

qURL

Mint, resolve, audit, and rotate scope-limited expiring access links (qURLs) for AI agents.

TypeScript Cloud macOSWindowsLinux
★ 4 stars Last pushed 2026-11-10 License: MIT

Topics: Security

Connect

Review any command before running it. Package names and URLs come from the server's own registry entry.

Package (npm 0.10.0)

npx -y @layervai/[email protected]

Or add to your MCP client config:

{
  "mcpServers": {
    "qurl-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@layervai/[email protected]"
      ],
      "env": {
        "QURL_API_KEY": "<YOUR_VALUE>",
        "QURL_SMTP_USERNAME": "<YOUR_VALUE>",
        "QURL_SMTP_PASSWORD": "<YOUR_VALUE>"
      }
    }
  }
}
  • QURL_API_KEY secret — Optional. Without it, the tools run through the local qURL CLI (qurl), which needs no account. With it, the tools use the qURL API: a key with qurl:read, qurl:write, and/or qurl:resolve scopes from https://layerv.ai.
  • QURL_API_URL — qURL API base URL. Defaults to https://api.layerv.ai. Override only for testing against a non-production qURL backend.
  • QURL_CONNECTOR_URL — Connector base URL used by local-file, file-data, and text-to-PDF upload tools before minting a qURL.
  • QURL_LINK_HOSTS — Optional comma-separated exact hostnames or IPs for uploaded-file links. No schemes, ports, or wildcards. Blank values retain any file-configured policy.
  • QURL_MCP_CONFIG — Optional path to a shared qURL MCP config file. Both stdio and HTTP modes can read SMTP, connector, and default API settings from this file.
  • MCP_MAX_UPLOAD_FILE_DATA_BYTES — Maximum decoded/local upload size. Accepts bytes or units such as 10mb; capped at 100mb.
  • QURL_SMTP_HOST — SMTP hostname for optional qURL link delivery.
  • QURL_SMTP_PORT — SMTP port for optional qURL link delivery.
  • QURL_SMTP_SECURE — Whether SMTP uses an implicit TLS connection (true/false).
  • QURL_SMTP_USERNAME secret — SMTP authentication username.
  • QURL_SMTP_PASSWORD secret — SMTP authentication password or app-specific credential.
  • QURL_SMTP_FROM_EMAIL — Validated sender email address for qURL delivery.
  • QURL_SMTP_FROM_NAME — Optional sender display name for qURL delivery.
  • QURL_SMTP_ALLOWED_RECIPIENTS — Optional comma-separated exact recipient allowlist.
  • QURL_SMTP_ALLOWED_RECIPIENT_DOMAINS — Optional comma-separated recipient-domain allowlist.
  • QURL_SMTP_MAX_RECIPIENTS_PER_MESSAGE — Maximum recipients in one delivery request (default 10).
  • QURL_SMTP_MAX_RECIPIENTS_PER_HOUR — Maximum attempted recipients per qURL key per fixed hourly window (default 100).
  • QURL_MCP_FEEDBACK — Set to off to hide and disable outbound LayerV product feedback. Default on. Feedback is sent only by an explicit submit_feedback tool call.

Related servers

Listed in punkpeye/awesome-mcp-servers (MIT)

Data from the Official MCP Registry