Name: Qrcanvas
Author: CloudCorpRecords

Qrcanvas MCP

Create and manage QR codes, short links, landing pages and forms in your Hovercode workspace.

Grade A Local · stdio No auth needed 36 tools v0.1.0 MIT

No reviews yet by CloudCorpRecordsnpm Runs on your machine, nothing hosted

99/100

trust score

tools declared

local

runs on your machine

—

downloads a day

What it does

Create and manage QR codes, short links, landing pages and forms in your Hovercode workspace.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user qrcanvas-mcp '--' npx -y @reneturcios/qrcanvas mcp

# 2 — ask your agent for something these tools do
#   list_workspaces, create_qr_code, build_page and 33 more

Qrcanvas costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

CloudCorpRecords425 servers

28 categories

All 425 servers

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Read from its source code. A server that builds its tool list when it starts can list more tools than this.

List the workspaces this account can access, with their ids; the current (default) one is marked. Tools default to the current workspace, so you only need workspace to target a different one.

No parameter schema on file.

Create a Hovercode QR code and return its details plus a rendered PNG. dynamic: true makes the destination changeable later and tracks scans; dynamic: false (the default, 'static') encodes the destination directly into the code image — it can never be retargeted or tracked, and this choice…

Parameter	Type	Required	Notes
workspace	string	no	Workspace id. Optional when the account has one workspace; use list_workspaces to resolve otherwise.
qr_data	string	yes	What the code encodes: a URL for qr_type 'Link', or the text for qr_type 'Text'. For 'vCard' send vcard instead.
qr_type	string	no	QR content type. Default 'Link'. 'vCard' encodes a contact card from vcard.
vcard	object	no	Contact details for qr_type 'vCard' (use instead of qr_data). Scanning saves the contact to the phone. dynamic: true makes the card editable later.
dynamic	boolean	no	Editable destination + scan tracking; can't be switched after creation. Counts toward the workspace's dynamic-code limit. Default false (static: fixed forever, no tracking). Ask the user if their word
display_name	string	no	Internal name to find this code later.
template	string	no	Workspace template id to apply as design defaults (list_templates).
folder	string	no	Folder id or slug to file the new code into (list_qr_codes shows each code's folder).
gps_tracking	boolean	no	Prompt scanners to share location (dynamic codes).
tags	array	no	Labels to attach (created if new) so you can find these later — list_qr_codes and list_short_links search by tag.
primary_color	string	no	Hex color for the QR pattern, e.g. #111111. Eyes and frame follow this automatically — one color request styles the whole code; only set eye_color/frame_color for a code that should use a *differe
color_scope	string	no	How far a primary_color change should reach; only relevant alongside primary_color. Default 'whole' matches whole-code language — 'make it red', 'make the QR code dark green' — so pattern, eyes, a
background_color	string	no	Hex background color, or 'transparent'.
eye_style	string	no	Corner eye shape.
eye_color	string	no	Hex color for the corner eyes, if different from primary_color (which they follow by default).
pattern	string	no	Module pattern style.
frame	string	no	Frame slug. A caption (text) works on any frame — set text without a frame and one that can show it is chosen automatically. Frames that show a caption: card, card-above, speech-bubble, speech-b
frame_color	string	no	Hex color for the frame, if different from primary_color (which it follows by default).
text	string	no	Caption text. Renders on any frame that supports one; if frame isn't also given (or the one given can't show text), a frame that can is chosen automatically.
text_secondary	string	no	Secondary caption line, where the frame supports it.

Build a rich, on-brand landing page from an ordered list of typed blocks, publish it, and return its live URL + its own QR code (qr_id; style it with the QR design args here, restyle later with update_qr_code — don't create another). This is the 'make me a page for X' tool — e.g. an event,…

Parameter	Type	Required	Notes
workspace	string	no	Workspace id. Optional when the account has one workspace; use list_workspaces to resolve otherwise.
primary_color	string	no	For the QR code this mints: Hex color for the QR pattern, e.g. #111111. Eyes and frame follow it automatically (rules as in create_qr_code).
background_color	string	no	For the QR code this mints: Hex background color, or 'transparent'.
eye_style	string	no	For the QR code this mints: Corner eye shape.
eye_color	string	no	For the QR code this mints: Hex color for the corner eyes, only if different from primary_color.
pattern	string	no	For the QR code this mints: Module pattern style.
frame	string	no	For the QR code this mints: Frame slug, as in create_qr_code. Set text without a frame and one that can show it is chosen automatically.
frame_color	string	no	For the QR code this mints: Hex color for the frame, only if different from primary_color.
text	string	no	For the QR code this mints: Caption text; a frame that can show it is chosen automatically.
text_secondary	string	no	For the QR code this mints: Secondary caption line, where the frame supports it.
has_border	boolean	no	For the QR code this mints: Draw a border around the code.
logo_url	string	no	For the QR code this mints: URL of a logo image to place in the center.
error_correction	string	no	For the QR code this mints: QR error correction level (L, M, Q, H). Leave unset: it is chosen automatically (H with a logo, Q otherwise).
color_scope	string	no	For the QR code this mints: 'whole' (default) or 'pattern_only', as in create_qr_code.
title	string	yes	The page title (browser tab + SEO).
description	string	no	Optional SEO/description text.
blocks	array	yes	Ordered page blocks. Each is {type, content}. See list_block_types.
publish	boolean	no	Publish immediately (default true). false leaves it a draft.
bg_color	string	no	Hex page background color.
text_color	string	no	Hex text color.

Create a form, define its fields, brand it, publish it, and return a shareable short link + QR in one step. Use for 'make me a form to collect X, give me a link and QR to share it'. The result's share_url is the public link and qr_id is the form's own dynamic QR code (image included) — never…

Parameter	Type	Required	Notes
workspace	string	no	Workspace id. Optional when the account has one workspace; use list_workspaces to resolve otherwise.
primary_color	string	no	For the QR code this mints: Hex color for the QR pattern, e.g. #111111. Eyes and frame follow it automatically (rules as in create_qr_code).
background_color	string	no	For the QR code this mints: Hex background color, or 'transparent'.
eye_style	string	no	For the QR code this mints: Corner eye shape.
eye_color	string	no	For the QR code this mints: Hex color for the corner eyes, only if different from primary_color.
pattern	string	no	For the QR code this mints: Module pattern style.
frame	string	no	For the QR code this mints: Frame slug, as in create_qr_code. Set text without a frame and one that can show it is chosen automatically.
frame_color	string	no	For the QR code this mints: Hex color for the frame, only if different from primary_color.
text	string	no	For the QR code this mints: Caption text; a frame that can show it is chosen automatically.
text_secondary	string	no	For the QR code this mints: Secondary caption line, where the frame supports it.
has_border	boolean	no	For the QR code this mints: Draw a border around the code.
logo_url	string	no	URL of a logo image (JPEG/PNG/GIF/WebP) to show on the form.
error_correction	string	no	For the QR code this mints: QR error correction level (L, M, Q, H). Leave unset: it is chosen automatically (H with a logo, Q otherwise).
color_scope	string	no	For the QR code this mints: 'whole' (default) or 'pattern_only', as in create_qr_code.
title	string	yes	The form's title.
description	string	no	Optional description shown above the fields.
fields	array	yes	The fields to collect, in order.
outcomes	array	no	Pathways / branching endings. After submit the first outcome whose rules match decides the ending: its own thank-you title/message and/or a redirect_url (e.g. send people to a different product page p
theme	string	no	Named color preset. Explicit colors below override it.
bg_color	string	no	Hex background color.

Scan analytics over a period: totals, unique scanners, scans-by-day, and top countries/cities/OS/browsers. Pass a QR code id for one code, or omit it for the whole workspace (which also returns the top codes). Use this to answer 'how did my codes do this month and where were people scanning?'.

Parameter	Type	Required	Notes
workspace	string	no	Workspace id. Optional when the account has one workspace; use list_workspaces to resolve otherwise.
id	string	no	QR code id for per-code analytics; omit for workspace-wide.
days	integer	no	Look-back window in days (default 30, max 365).
start	string	no	Range start, ISO date or datetime (e.g. 2026-08-03 or 2026-08-03T14:00:00Z). Use start/end together for a fixed window instead of the rolling days look-back.
end	string	no	Range end, ISO date/datetime. Defaults to now when only start is given.

List QR codes in a workspace, newest first. Optional query searches destination, name, and tags. folder narrows to one folder, include_tags adds each code's tags (its folder is always shown), and include_scans adds scan counts — use it instead of calling get_analytics once per code.

Parameter	Type	Required	Notes
workspace	string	no	Workspace id. Optional when the account has one workspace; use list_workspaces to resolve otherwise.
query	string	no	Search term (destination, display name, or tag).
folder	string	no	Folder id or slug to filter by, or 'none' for codes in no folder.
subfolders	boolean	no	With folder, also include codes in its subfolders.
include_scans	boolean	no	Add total_scans and unique_scans (lifetime) to each code.
include_tags	boolean	no	Add each code's tags. (Each code's folder is always included.)
page	integer	no	1-based page number.
page_size	integer	no	Results per page (max 200, default 25).

Create a tracked short link for a URL. It comes with its own QR code (same id; use download_qr). Supports a custom slug and a custom domain. The destination can be changed later with update_short_link, and clicks are tracked. Never shorten a link that is already a Hovercode short link, form link,…

Parameter	Type	Required	Notes
workspace	string	no	Workspace id. Optional when the account has one workspace; use list_workspaces to resolve otherwise.
link	string	yes	The destination URL to shorten.
display_name	string	no	Internal name to find this link later.
slug	string	no	Custom slug (letters/numbers/hyphens) or auto-generated.
domain	string	no	Custom short-link domain; else a default is used.
gps	boolean	no	Prompt visitors to share their location.
tags	array	no	Labels to attach (created if new) so you can find these later — list_qr_codes and list_short_links search by tag.

Switch the current (default) workspace by id or name. New codes, forms, and pages are created in the current workspace unless a tool is given an explicit workspace.

Parameter	Type	Required	Notes
workspace	string	yes	Workspace id or name to switch to.

Create many QR codes at once from a list — e.g. 'make codes for these 20 product URLs in our brand colors'. All codes share the design/options you pass (colors, pattern, frame, dynamic, template). Returns the created codes and any per-item errors. Max 100 per call.

Parameter	Type	Required	Notes
workspace	string	no	Workspace id. Optional when the account has one workspace; use list_workspaces to resolve otherwise.
items	array	yes	URLs to encode. Each item is a URL string, or an object {url, display_name}.
dynamic	boolean	no	Make all of them editable + tracked; can't be switched after creation. Free up to a per-plan limit, not paid-only — a large batch can exceed it partway through, which shows up as per-item errors, not
template	string	no	Workspace template id to apply to all.
idempotency_key	string	no	Optional client key to make retries safe: if a previous call used the same key (same workspace), the earlier result is replayed instead of creating duplicate codes. Use a fresh key per distinct batch.
tags	array	no	Labels to attach (created if new) so you can find these later — list_qr_codes and list_short_links search by tag.
primary_color	string	no	Hex color for the QR pattern, e.g. #111111. Eyes and frame follow it automatically (rules as in create_qr_code).
color_scope	string	no	'whole' (default) or 'pattern_only', as in create_qr_code.
background_color	string	no	Hex background color, or 'transparent'.
eye_style	string	no	Corner eye shape.
eye_color	string	no	Hex color for the corner eyes, only if different from primary_color.
pattern	string	no	Module pattern style.
frame	string	no	Frame slug, as in create_qr_code. Set text without a frame and one that can show it is chosen automatically.
frame_color	string	no	Hex color for the frame, only if different from primary_color.
text	string	no	Caption text; a frame that can show it is chosen automatically.
text_secondary	string	no	Secondary caption line, where the frame supports it.
has_border	boolean	no	Draw a border around the code.
logo_url	string	no	URL of a logo image to place in the center.
error_correction	string	no	QR error correction level (L, M, Q, H). Leave unset: it is chosen automatically (H with a logo, Q otherwise).

Get downloadable, print-ready image links for a QR code — a high-resolution PNG and a vector SVG (best for print/large sizes). Returns URLs you can share or save.

Parameter	Type	Required	Notes
id	string	yes	QR code id.

Create a dynamic QR code and short link for a PDF (menus, flyers, tickets). Host the PDF by passing pdf_url (a link Hovercode fetches) or pdf_base64 (the file's base64 bytes). Returns a shareable short link plus a rendered QR. Because it's dynamic you can later swap the PDF without reprinting…

Parameter	Type	Required	Notes
workspace	string	no	Workspace id. Optional when the account has one workspace; use list_workspaces to resolve otherwise.
pdf_url	string	no	URL of a PDF to fetch and host. Use this or pdf_base64.
pdf_base64	string	no	Base64-encoded PDF bytes (data-URI prefix allowed), max 20 MB. Or use pdf_url.
filename	string	no	Name for the stored file, e.g. 'menu.pdf'.
display_name	string	no	Internal name to find this code later.
domain	string	no	Custom short-link domain (list_workspaces shows the plan).
tags	array	no	Labels to attach (created if new) so you can find these later — list_qr_codes and list_short_links search by tag.

Get one QR code's details and scan analytics (total and unique scans), plus a rendered PNG.

Parameter	Type	Required	Notes
id	string	yes	QR code id.

Update a QR code in place — the same code keeps working, so it's safe for already-printed codes. Changing qr_data retargets a DYNAMIC code's destination. Design fields (colors, pattern, eye style, frame, logo) restyle the code WITHOUT replacing it. Also supports renaming, toggling location…

Parameter	Type	Required	Notes
id	string	yes	QR code id.
qr_data	string	no	New destination URL/text (dynamic codes only).
display_name	string	no	New internal name.
gps_tracking	boolean	no	Enable/disable location prompt.
folder	string	no	Move the code into this folder (id or slug from list_folders); 'none' unfiles it.
add_tags	array	no	Tag titles to add (created in the workspace if new).
remove_tags	array	no	Tags to remove from this code, by title, slug, or id.
primary_color	string	no	Hex color for the QR pattern, e.g. #111111. Eyes and frame follow this automatically — one color request styles the whole code; only set eye_color/frame_color for a code that should use a *differe
color_scope	string	no	How far a primary_color change should reach; only relevant alongside primary_color. Default 'whole' matches whole-code language — 'make it red', 'make the QR code dark green' — so pattern, eyes, a
background_color	string	no	Hex background color, or 'transparent'.
eye_style	string	no	Corner eye shape.
eye_color	string	no	Hex color for the corner eyes, if different from primary_color (which they follow by default).
pattern	string	no	Module pattern style.
frame	string	no	Frame slug. A caption (text) works on any frame — set text without a frame and one that can show it is chosen automatically. Frames that show a caption: card, card-above, speech-bubble, speech-b
frame_color	string	no	Hex color for the frame, if different from primary_color (which it follows by default).
text	string	no	Caption text. Renders on any frame that supports one; if frame isn't also given (or the one given can't show text), a frame that can is chosen automatically.
text_secondary	string	no	Secondary caption line, where the frame supports it.
has_border	boolean	no	Draw a border around the code.
logo_url	string	no	URL of a logo image to place in the center.
error_correction	string	no	QR error correction level: L, M, Q, or H (higher tolerates more damage but is denser). Already handled automatically — the renderer uses H whenever the code has a logo, Q otherwise — so leave this uns

Delete a QR code. Dynamic codes stop redirecting after deletion.

Parameter	Type	Required	Notes
id	string	yes	QR code id.

List recent scan events for a dynamic QR code (time, location, device). Use this to answer questions like where or when a code was scanned.

Parameter	Type	Required	Notes
id	string	yes	QR code id.
page	integer	no	1-based page number.
page_size	integer	no	Events per page (max 200, default 25).
start	string	no	Range start, ISO date or datetime (e.g. 2026-08-03 or 2026-08-03T14:00:00Z). Use start/end together for a fixed window instead of the rolling days look-back.
end	string	no	Range end, ISO date/datetime. Defaults to now when only start is given.

List the workspace's saved QR design templates. Pass a template id to create_qr_code to reuse its branding.

Parameter	Type	Required	Notes
workspace	string	no	Workspace id. Optional when the account has one workspace; use list_workspaces to resolve otherwise.

List the workspace's folders with their full path, code count, id and slug. Use a folder's id or slug with create_qr_code / update_qr_code (folder) to file codes, or with list_qr_codes to filter.

Parameter	Type	Required	Notes
workspace	string	no	Workspace id. Optional when the account has one workspace; use list_workspaces to resolve otherwise.

Create a folder to organise QR codes, optionally nested under a parent. Creating a folder that already exists (same name, same parent) returns the existing one, so it's safe to call repeatedly.

Parameter	Type	Required	Notes
workspace	string	no	Workspace id. Optional when the account has one workspace; use list_workspaces to resolve otherwise.
name	string	yes	Folder name.
parent	string	no	Parent folder id or slug to nest under (optional).

Rename a folder and/or move it under another folder. parent 'none' moves it to the top level. Codes inside keep their filing.

Parameter	Type	Required	Notes
id	string	yes	Folder id (from list_folders).
name	string	no	New folder name.
parent	string	no	New parent folder id or slug, or 'none' for top level.

Delete a folder. The codes in it (and in its subfolders) are NOT deleted — they become unfiled — and its subfolders move up to its parent.

Parameter	Type	Required	Notes
id	string	yes	Folder id (from list_folders).

List the workspace's tags (title + id). Tags are attached with create_qr_code (tags) or update_qr_code (add_tags / remove_tags), and list_qr_codes searches by tag.

Parameter	Type	Required	Notes
workspace	string	no	Workspace id. Optional when the account has one workspace; use list_workspaces to resolve otherwise.

Change an existing form without recreating it: edit its fields, settings (redirect, thank-you, title), or branding (theme/colors/logo), or close/reopen it. If you pass fields, provide the COMPLETE desired list — include each existing field's id (from get_form) to keep it; omit a field to…

Parameter	Type	Required	Notes
id	string	yes	Form id.
status	string	no	Close (stop responses) or reopen. When set, other edits are ignored.
title	string	no	New title.
description	string	no	New description.
fields	array	no	Complete desired field list (see note); create_form shape plus an optional id.
outcomes	array	no	Pathways / branching endings. After submit the first outcome whose rules match decides the ending: its own thank-you title/message and/or a redirect_url (e.g. send people to a different product page p
theme	string	no	Named color preset. Explicit colors below override it.
bg_color	string	no	Hex background color.
text_color	string	no	Hex text color.
button_color	string	no	Hex submit-button color.
button_text_color	string	no	Hex button-text color.
logo_url	string	no	URL of a logo image (JPEG/PNG/GIF/WebP) to show on the form.
redirect_url	string	no	URL to send respondents to after they submit.
thank_you_message	string	no	Shown after submitting (if no redirect).

List the forms in a workspace, newest first. Optional query searches by title.

Parameter	Type	Required	Notes
workspace	string	no	Workspace id. Optional when the account has one workspace; use list_workspaces to resolve otherwise.
query	string	no	Search term (matches the form title).
page	integer	no	1-based page number.
page_size	integer	no	Results per page (max 100, default 25).

Get one form's details: status, response count, share link, and QR.

Parameter	Type	Required	Notes
id	string	yes	Form id.

List a form's submissions (newest first) so you can read or summarize them — e.g. 'summarize this week's feedback' or 'any complaints in the responses?'.

Parameter	Type	Required	Notes
id	string	yes	Form id.
page	integer	no	1-based page number.
page_size	integer	no	Responses per page (max 100, default 25).

Create a published micro landing page (link-in-bio style) with a title and a list of links, and return its live URL (share_url) + its own QR code (qr_id; style it with the QR design args here; don't create another). Use this for 'make me a page with these links and a QR to share it'. The page…

Parameter	Type	Required	Notes
workspace	string	no	Workspace id. Optional when the account has one workspace; use list_workspaces to resolve otherwise.
primary_color	string	no	For the QR code this mints: Hex color for the QR pattern, e.g. #111111. Eyes and frame follow it automatically (rules as in create_qr_code).
background_color	string	no	For the QR code this mints: Hex background color, or 'transparent'.
eye_style	string	no	For the QR code this mints: Corner eye shape.
eye_color	string	no	For the QR code this mints: Hex color for the corner eyes, only if different from primary_color.
pattern	string	no	For the QR code this mints: Module pattern style.
frame	string	no	For the QR code this mints: Frame slug, as in create_qr_code. Set text without a frame and one that can show it is chosen automatically.
frame_color	string	no	For the QR code this mints: Hex color for the frame, only if different from primary_color.
text	string	no	For the QR code this mints: Caption text; a frame that can show it is chosen automatically.
text_secondary	string	no	For the QR code this mints: Secondary caption line, where the frame supports it.
has_border	boolean	no	For the QR code this mints: Draw a border around the code.
logo_url	string	no	For the QR code this mints: URL of a logo image to place in the center.
error_correction	string	no	For the QR code this mints: QR error correction level (L, M, Q, H). Leave unset: it is chosen automatically (H with a logo, Q otherwise).
color_scope	string	no	For the QR code this mints: 'whole' (default) or 'pattern_only', as in create_qr_code.
title	string	yes	The page's heading.
description	string	no	Optional text shown under the title.
links	array	no	The link buttons on the page, in order.
bg_color	string	no	Hex background color.
text_color	string	no	Hex text color.
domain	string	no	Custom page domain (else a default is used).

Get one landing page's details: status, live URL, QR, and its blocks (each block's id + type) so you can edit it with update_page.

Parameter	Type	Required	Notes
id	string	yes	Page id.

Change an existing landing page without recreating it: edit its blocks, title, description, or colors, and publish/unpublish it. Use for 'fix the typo on my page', 'add a section', or 'take the page down'. If you pass blocks, provide the COMPLETE desired list (same {type, content} shape as…

Parameter	Type	Required	Notes
id	string	yes	Page id.
title	string	no	New page title.
description	string	no	New SEO/description text.
blocks	array	no	Complete desired block list (see note); each is {type, content} + optional id.
bg_color	string	no	Hex page background color.
text_color	string	no	Hex text color.
publish	boolean	no	true = publish/re-publish so edits go live; false = take offline (draft).

Delete a landing page. Its live URL stops serving and it leaves the workspace's page list. Use for 'delete that page' / 'remove the landing page'.

Parameter	Type	Required	Notes
id	string	yes	Page id.

List the landing pages in a workspace, newest first.

Parameter	Type	Required	Notes
workspace	string	no	Workspace id. Optional when the account has one workspace; use list_workspaces to resolve otherwise.

List the page BLOCK TYPES available to build_page, each with its content JSON Schema. Call this first when composing a rich page so you know the vocabulary (header, link, text, image, button, video, gallery, faq, countdown, socials, divider, form, …).

No parameter schema on file.

Get one short link's details, destination, click counts, and QR.

Parameter	Type	Required	Notes
id	string	yes	Short link id.

List short links in a workspace, newest first. Optional query searches URL, name, and slug.

Parameter	Type	Required	Notes
workspace	string	no	Workspace id. Optional when the account has one workspace; use list_workspaces to resolve otherwise.
query	string	no	Search term (destination, name, or slug).
page	integer	no	1-based page number.
page_size	integer	no	Results per page (max 200, default 25).

Update a short link. Changing link retargets it — the short URL keeps working, it just points somewhere new. Also supports renaming and toggling location tracking.

Parameter	Type	Required	Notes
id	string	yes	Short link id.
link	string	no	New destination URL.
display_name	string	no	New internal name.
gps	boolean	no	Enable/disable the location prompt.

Delete a short link. It stops redirecting after deletion.

Parameter	Type	Required	Notes
id	string	yes	Short link id.

List recent click events for a short link (time, location, device).

Parameter	Type	Required	Notes
id	string	yes	Short link id.
page	integer	no	1-based page number.
page_size	integer	no	Events per page (max 200, default 25).
start	string	no	Range start, ISO date or datetime (e.g. 2026-08-03 or 2026-08-03T14:00:00Z). Use start/end together for a fixed window instead of the rolling days look-back.
end	string	no	Range end, ISO date/datetime. Defaults to now when only start is given.

Free

$0 forever

Every tool, no call limit
No card, and mcprush charges nothing for it
Source published under MIT
Runs on your machine — nothing of it reaches our gateway
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Qrcanvas or to call it, at any volume.

ATrust score 99 / 100

Release 0.1.0 · scanned 11 Nov 2026

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score99

Findings0 threat · 0 capability

Capabilityminimal

Coveragesource

Verificationrepo

Surface digest65c28144b34932a0945364dc8e8d30cd5c92afa64c551a90f04d2156d4b2d3d2

Score vectorthreat 100 → client 99

Term	Level	What it prices	Points
capability-exposure	minimal	capability blast radius (minimal) — client exposure if the model is manipulated	−0
verification-discount	repo	publisher verification (public source) — no provenance, but the source is public and inspectable	−1
coverage-honesty	source	inspection depth (source) — how much of the target the scan could see	−0

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

Tool surfacenot available

Implementation sourceread

Package metadataread

Live transportnot available

No tools were enumerated, so prompt-injection, capability and toxic-flow analysis had no tool surface to inspect. To grade a package’s real runtime tools, scan the running server: --command "npx -y <package>".

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. minimal is the level these add up to.

Tool	Capability tags	Why the tag was assigned
No per-tool rows for this release — see the note below.

No tool surface was enumerated, so there is nothing to attribute a capability to.

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.

Supply chain and provenance

Integrityfirst-seen

Surface digest65c28144b34932a0

Scanned2026-11-11

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

Where are you running it?

Tool surface

Release history

Qrcanvas MCP

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

What the scan could actually read

Capability — what it could do if the model were manipulated

Toxic-flow graph

Supply chain and provenance

Release history

See also