Connect an AI assistant with MCP
Lynkarr runs an MCP server. One URL, one API token, and Claude or another assistant can make QR codes, repoint them and read the analytics.
What MCP is
Lynkarr runs an MCP server. MCP — the Model Context Protocol — is the standard way an AI assistant talks to a service it does not have built in. Connect it once and the assistant can work in your account directly: make a code, change where an existing one points, read how a campaign is doing.
The useful case is the one that is awkward in any interface: the poster is printed, the destination has moved, and you want to say so rather than find the code, open it, edit the field and save. The assistant does that in one sentence, and nothing is reprinted.
What you need
An API token, which is the same token the REST API uses. Make one in Settings, API tokens. Give it only the scopes you want the assistant to have — this is the whole of the security model, so it is worth a moment's thought.
An assistant that supports remote MCP servers over HTTP. Claude does, as do several others; the setting is usually called connectors, integrations or MCP servers.
Connecting it
Once, and it stays connected. If you later want to change what the assistant may do, make a new token with different scopes rather than editing this one — a token's scopes are fixed when it is created.
- Sign in and open Settings, then API tokens.
- Create a token. Name it after the assistant so you know what to revoke later.
- Choose scopes. Read-only is codes:read, links:read and analytics:read. Add codes:write only if you want the assistant to create and repoint codes.
- Copy the token. It is shown once and never again.
- In your assistant, add a remote MCP server with the URL https://lynkarr.com/mcp.
- Set the authentication to a bearer token and paste the token in.
- Ask it something simple to check: “list my QR codes”.
What it can do
Thirty-one tools covering most of the product, and each needs the matching scope. QR codes and short links: list, read, create, repoint, archive. Digital cards, landing pages and forms: list, read, create and edit, publish and unpublish. GS1 Digital Links, the media library, campaigns and tags, who is on the team, and the scan analytics.
The scopes are the control, and they are per token. Grant codes:read and the assistant can look at your codes and nothing else. Grant forms:read and it can also read what people submitted, which is a deliberate choice rather than a side effect — see the article on the tools.
It will only be offered the tools your token actually allows. A token with codes:read and nothing else sees the reading tools and is not shown the others at all, so it cannot try and fail.
What it cannot do
Anything the API cannot do, which is deliberate: every tool is a call to the same REST API, subject to the same scopes, the same rate limit and the same monthly quota. There is no back door in which the assistant is more powerful than a script would be.
It cannot see who scanned a code, because that is not recorded anywhere — no cookies, no stored addresses.
It cannot change your plan, your billing or your account settings. It cannot invite anybody, change a role, suspend or remove a person: team access is read only, always, whatever scopes a token holds. Those are the three things that turn a leaked token into a lost account, so no token can do them.
It cannot upload files, and it cannot delete a form submission or an enquiry — one removed by an assistant is one nobody can get back.
Things worth knowing before you turn it on
Archiving stops a code resolving. If the code is on something already printed, that is a dead poster. The tool says so in its own description and a good assistant will ask first, but a token without codes:write cannot do it at all, which is the reliable version of that guarantee.
Static codes cannot be repointed. The destination is in the pattern, so the only fix is a reprint. The assistant will tell you this rather than appear to succeed.
The token is a credential. Anyone who has it has the scopes it carries, so treat it like a password and revoke it in Settings, API tokens the moment you stop using that assistant.