Name: Appy smart links
Author: appy

Appy smart links MCP

Create and edit Appy smart links for apps, and read their click and install stats.

Tool-list grade A Remote · Streamable HTTP API key 11 tools v1.0.0

No reviews yet by appy The publisher’s own endpoint — this marketplace is not in the path

93/100

tool-list score

tools declared

remote

at its publisher

—

calls last 7d

What it does

Create and edit Appy smart links for apps, and read their click and install stats.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --transport http appy-smart-links-mcp https://mcp.appy.to --header 'Authorization: Bearer ${AUTHORIZATION}'

# 2 — ask your agent for something these tools do
#   create_link, delete_link, get_account and 8 more

It needs AUTHORIZATION (Bearer appy_sk_... secret key from a Business or Enterprise account. Listing tools works without it; calling them needs it): this sends it in the Authorization header from your environment, so export it first — its endpoint answers 401 without it.

Appy smart links costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

appy1 server

1 category

All 1 server

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.

Claude Codedeclared by this listing

This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it. Claude Code reads AUTHORIZATION (Bearer appy_sk_... secret key from a Business or Enterprise account. Listing tools works without it; calling them needs it) from your environment each time it connects and sends it in the Authorization header — its endpoint answers 401 without it — so the key stays out of its config: export it in your shell profile (macOS, Linux), or run setx AUTHORIZATION … and open a new terminal (Windows).

claude mcp add --scope user --transport http appy-smart-links-mcp https://mcp.appy.to --header 'Authorization: Bearer ${AUTHORIZATION}'

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add — but its publisher asks for a key of their own on every call.

What it asks of you

It reaches a system of yours, so it needs your own credential rather than the publisher’s: Authorization header — Bearer appy_sk_... secret key from a Business or Enterprise account. Listing tools works without it; calling them needs it.. You set it in your own client’s config, on your machine — this marketplace never holds it.

What it writes

One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.

What you approve

11 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Create a smart link. Only fallbackUrl is required; add targets for app stores, countryRules for per-country Android stores, a deeplinkUrl to open the installed app, a socialPreview for how the link looks when shared, and a slug for a readable URL. Returns the new link with its public url.

Parameter	Type	Required	Notes
slug	string	no	custom slug of 5 to 64 lowercase letters, digits or hyphens; omit for a random one
fallbackUrl	string	yes	http(s) page for desktop visitors and anyone without a matching target
title	string	no	name shown in the dashboard, up to 200 characters
deeplinkUrl	string	no	in-app URL that opens the installed app, for example acme://product/42
targets	object	no	store or app page URL per platform; allowed keys: iphone, ipad, android, huawei, samsung (Galaxy Store), xiaomi (GetApps), rustore (RuStore, used for Android visitors in Russia)
countryRules	array	no	up to 50 rules, one per country, that send Android visitors from that country to their own URL; huawei, samsung and xiaomi targets still win, and a rule for RU wins over the rustore target
parameterForwarding	boolean	no	pass the query string of each click on to the destination (Business and Enterprise)
socialPreview	object	no	title, description and image that WhatsApp, iMessage, Slack, X, LinkedIn and other apps show when the link is shared; leave it out to show the destination's own preview

Delete a link. It stops redirecting immediately, so confirm with the user first.

Parameter	Type	Required	Notes
slug	string	yes	the link slug, the last part of the link URL

Plan of the account behind the API key, the features it includes (api, mcp, sdk), its link limit (null means unlimited) and how many links it has.

No parameter schema on file.

Clicks across all of the account's links over a date range, with the same daily series and breakdowns as get_link_stats.

Parameter	Type	Required	Notes
start	string	no	first day, YYYY-MM-DD in UTC; default 29 days before end
end	string	no	last day, YYYY-MM-DD in UTC; default today

Read one link by slug: its public url, fallbackUrl, deeplinkUrl, per-platform targets, country rules and settings.

Parameter	Type	Required	Notes
slug	string	yes	the link slug, the last part of the link URL

Clicks for one link over a date range: total and unique clicks, clicks per day, and breakdowns by country, operating system, device, browser, referrer and outcome (app store, app opened, fallback page).

Parameter	Type	Required	Notes
slug	string	yes	the link slug
start	string	no	first day, YYYY-MM-DD in UTC; default 29 days before end
end	string	no	last day, YYYY-MM-DD in UTC; default today

Clicks per day for one link over a date range, without the breakdowns. Use it for trends and charts.

Parameter	Type	Required	Notes
slug	string	yes	the link slug
start	string	no	first day, YYYY-MM-DD in UTC; default 29 days before end
end	string	no	last day, YYYY-MM-DD in UTC; default today

The account's links ranked by clicks over a date range, best first. Use it to answer which links or campaigns performed best.

Parameter	Type	Required	Notes
start	string	no	first day, YYYY-MM-DD in UTC; default 29 days before end
end	string	no	last day, YYYY-MM-DD in UTC; default today
limit	integer	no	how many links to return, 1 to 100, default 10

The account's custom domains (for example go.acme.com) with their status (pending, verifying, active, error), the DNS record to add, which domain is the default for link URLs, and how many domains the plan allows (limits.used and limits.max). Business and Enterprise plans.

No parameter schema on file.

List the account's links, newest first, with their destinations and targets. Use search to find a link by slug or title.

Parameter	Type	Required	Notes
search	string	no	only links whose slug or title contains this text
limit	integer	no	page size from 1 to 100, default 20
offset	integer	no	number of links to skip when paging

Change an existing link. Only the fields you send change; the slug itself cannot be changed. Returns the updated link.

Parameter	Type	Required	Notes
slug	string	yes	slug of the link to change
fallbackUrl	string	no	new fallback page
title	string	no	new title; an empty string removes it
deeplinkUrl	string	no	new in-app URL; an empty string removes it
targets	object	no	targets to change per platform (iphone, ipad, android, huawei, samsung, xiaomi, rustore); an empty string removes that platform, platforms not listed stay as they are
countryRules	array	no	the complete new list of country rules; it replaces the current list, an empty list removes every rule, leave it out to keep the rules as they are
parameterForwarding	boolean	no	turn parameter forwarding on or off
socialPreview	object	no	the complete new social preview; it replaces the current one, an empty title removes the preview, leave it out to keep it; send the current imageUrl back to keep an image uploaded in the dashboard

Free

$0 forever

Every tool — any call limit is its publisher’s, not ours
No card, and mcprush charges nothing for it
Runs at its publisher’s own address — this marketplace is not in the path
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Appy smart links or to call it, at any volume.

ATool-list grade · score 93 / 100

Release 1.0.0 · scanned 28 Oct 2026

Graded from the tools this server lists, not from its source code.

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score93

Findings0 threat · 0 capability

Capabilitymoderate

Coveragemanifest

Verificationnot in this report

Surface digest134cf4210c5c276fb3f8b0235c2f19c279c20d911e998c613e6185b09b2c00b7

Score vectorthreat 100 → client 93

Term	Level	What it prices	Points
capability-exposure	moderate	capability blast radius (moderate) — client exposure if the model is manipulated	−3
coverage-honesty	manifest	inspection depth (manifest) — how much of the target the scan could see	−4

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.

Tool surfaceread

Implementation sourcenot available

Package metadatanot available

Live transportnot available

The implementation source was not read — this reflects the declared tool metadata only.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.

Tool	Capability tags	Why the tag was assigned
create_link	state-write	state-write: declares readOnlyHint: false
delete_link	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
get_account	no tags
get_account_stats	no tags
get_link	no tags
get_link_stats	no tags
get_link_timeseries	no tags
get_top_links	no tags
list_domains	no tags
list_links	no tags
update_link	state-write	state-write: declares readOnlyHint: false, destructiveHint: true

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.

Supply chain and provenance

Integrityfirst-seen

Surface digest134cf4210c5c276f

Scanned2026-10-28

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.