Strait MCP server
Straight to the screen. On the record.
A tap on a Strait link goes straight to the exact screen in your app (Straight), and every tap is recorded (Stamped).
Docs ·
Platform status ·
Talk to the Strait team
@straitlink/mcp (preview)
Use Strait from AI tools such as Claude Code, Cursor and Claude Desktop: create, find, pause and resume deep links,
get their QR codes, read and compare analytics, see recent taps and conversion events, manage custom link domains,
look after webhooks (list, deliveries, test, redeliver), check App Links / Universal Links files or any vendor's link,
see where taps on a link go and search the Strait docs.
It is a local stdio server with 32 tools. Eleven of them write (create_link, batch_create_links, update_link,
pause_link, resume_link, deactivate_link, record_event, add_domain, remove_domain, test_webhook,
redeliver_webhook_delivery); the other twenty-one only read. check_app_links, check_link, search_docs and demo
trace_tap work without a key; every other tool needs your secret key. Other deep-link vendors also ship MCP servers
that can create links, so this README makes no "first" or "only" claim; it describes what this server does today.
iPhone is in beta. iPhone install matching (deferred deep linking on iOS) is in beta; Android uses the Play
Install Referrer. On iPhone the workspace chooses the method in Dashboard → Settings → iPhone installs (device
matching, paste handoff, both or neither), and the SDK reads that choice at runtime. Device matching is off for new
workspaces. The tools report iPhone results the same way, but treat iPhone install attribution as beta.
Hosted server. The same tools are served at https://strait.link/mcp (Streamable HTTP, since 24 Oct 2026):
claude mcp add --transport http strait https://strait.link/mcp --header "Authorization: Bearer st_live_your_key".
It takes a secret key in the Authorization header (60 requests burst, then 1 a second, per key); OAuth sign-in is
not there yet. The engine serves it with this package's createStraitServer() (library entry, 0.3.0).
Tools
A read-only secret key (Dashboard → Settings → Secret keys, access "Read only") is offered only the tools that read
(0.5.1; the hosted server already did this). Full and links-only keys see every tool; the API still refuses anything
outside the key's access.
Every tool carries MCP annotations (readOnlyHint, destructiveHint, …) and the descriptions of the 0.2 and 0.3
tools start with "Read-only." or "Write.". update_link, pause_link, deactivate_link and remove_domain are
destructive. Every write except create_link, batch_create_links and test_webhook shows a preview first and acts
only with confirm: true. create_link and
batch_create_links write new links but never change existing ones. There is no delete tool: a deactivated link
keeps its history.
Prompts
Clients that show MCP prompts (Claude Code: type /) offer six starters. All but get_started and migrate_firebase_links only read, and those two create links only after you answer yes:
Keys
The server needs a secret key (st_live_…) from Dashboard → Settings → Secret keys. A secret key can change your
links, so:
- Create a separate key for your AI tools, so you can revoke it on its own.
- Keep it in the MCP client's config or environment, never in app or website code.
- A publishable key (
st_pub_live_…) does not work here: it is for the SDKs in your apps.
- The server sends the key only as an
Authorization: Bearer header to STRAIT_API_URL, never logs it, and
replaces anything shaped like a secret key in tool output or errors with st_…[redacted].
Without a key, check_app_links, search_docs and demo trace_tap still work.
Install
Claude Code plugin (hosted server + setup skill)
(On older Claude Code: /plugin marketplace add strait-link/strait-mcp, then /plugin install strait@strait-link.) It asks
for a secret key when you enable it and keeps it in your system's credential store. It connects to the hosted server
https://strait.link/mcp and adds the strait-setup skill, which sets Strait up in an app. Privacy:
https://straitlink.in/legal/privacy/
Claude Code
Cursor
~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project; don't commit a key):
Claude Desktop
Settings → Developer → Edit config, then add the same "strait" entry under mcpServers and restart.
From a checkout
In Cursor or Claude Desktop use "command": "node", "args": ["/absolute/path/to/mcp-server/dist/stdio.js"].
Try it
- "Create a Strait link
summer to https://shop.hilltop.example/summer with the title Summer sale."
- "Which channel brought the most installs last month?"
- "My links open the browser instead of the app. Check hilltop.strait.link and shop.hilltop.example."
- "What happens when someone taps
summer inside Instagram on an iPhone?"
- "How do I receive links in Expo Router?"
- "How much of this month's plan have we used?"
- "My webhook stopped firing. Show me its last deliveries, send it a test, and resend the failed ones."
- "Turn off the
spring-sale link." (you'll see a preview first)
- "Which referral codes brought the most installs in October?"
- "How did this week do against last week, by channel?"
- "Which links point at /summer? Pause the old ones."
- "Did my test tap on
summer just now get recorded, and did it open the app?"
- "Give me a QR code for
summer in dark grey."
- "Is links.hilltop.example set up yet? Which DNS records are missing?"
- "Check https://hilltop.page.link/abc before we migrate it."
Hilltop Shoes (hilltop.strait.link, *.hilltop.example) is a made-up shop used in examples.
MCP registry listing
server.json and the mcpName field in package.json list this server on the
official MCP registry as in.straitlink/mcp. The registry checks that mcpName in the published npm package matches server.json name
(package types).
- Namespace
in.straitlink/mcp. Reverse-DNS of straitlink.in, proven with HTTP authentication
(authentication):
the site serves the Ed25519 public key at https://straitlink.in/.well-known/mcp-registry-auth
(v=MCPv1; k=ed25519; p=<public key>, written by the site's lib/seo.mjs), and the private key is the
MCP_REGISTRY_PRIVATE_KEY Actions secret of this repo. No DNS change and no personal login.
remotes lists the hosted server https://strait.link/mcp (Streamable HTTP, Authorization: Bearer secret key,
live since 24 Oct 2026), and repository points at github.com/strait-link/strait-mcp. The OAuth Worker
(mcp.strait.link) is not listed until it is deployed.
- New version: release it to npm first (release workflow), then run Actions → MCP registry → Run workflow.
It checks
server.json against package.json, the npm package and the registry schema, then logs in and publishes.
Without the secret it only validates and stops.
- New key:
openssl genpkey -algorithm Ed25519 -out key.pem (OpenSSL 3, not macOS LibreSSL); the public line is
v=MCPv1; k=ed25519; p=$(openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64) (put it in the
site's lib/seo.mjs and deploy the site); the secret is the hex private key,
openssl pkey -in key.pem -noout -text | grep -A3 "priv:" | tail -n +2 | tr -d ' :\n'. Delete key.pem after.
Licence
MIT. See LICENSE.
OAuth remote server (built, not deployed)
The hosted server above (strait.link/mcp) needs a key in a header. This Worker is the later, OAuth version.
src/worker.ts is a Cloudflare Worker serving MCP over Streamable HTTP at https://mcp.strait.link/mcp. It answers
404 everywhere unless REMOTE_MCP=on (only env.production in wrangler.jsonc turns it on).
- Bearer-key mode:
Authorization: Bearer st_live_… on /mcp, for clients that take a header.
- OAuth (
@cloudflare/workers-oauth-provider): dynamic client registration (/register), /authorize, /token,
authorization-server metadata and RFC 9728 protected-resource metadata
(/.well-known/oauth-protected-resource/mcp). PKCE, registered redirect URIs only.
- The consent page asks for a secret key, checks it with
GET /v1/links?limit=1, and keeps it only inside the
grant, which the provider encrypts with the token (a test checks that KV never holds the key in plain text).
It shows where the user is sent back to, has a Cancel button (access_denied back to the client), and sends
X-Frame-Options: DENY, a strict CSP and Cache-Control: no-store.
- Access tokens last 1 hour; refresh tokens 30 days.
- Next step before a wide launch: replace the paste-a-key page with dashboard sign-in that mints a scoped key.
/healthz returns { ok, service, version, mcp } with no upstream call, for the post-deploy check.
Try it locally
Deploy the remote server (Strait team only)
Agents prepare this; only the Strait team deploys. Needs the Cloudflare account that holds the strait.link zone
(CLOUDFLARE_API_TOKEN / CLOUDFLARE_ACCOUNT_ID from redirect-engine/.env work). The bundle is about 1.9 MB
(360 KB gzipped), inside the free plan's size limit; Workers Paid (already planned) is recommended for its higher
CPU time per request.
Roll back with npx -y wrangler@4 rollback --env production, or switch it off by setting REMOTE_MCP to "off"
in env.production.vars and deploying again (every route then answers 404). Revoking the secret key a user pasted
cuts that connection off at the API.
Claude Code skill
skills/strait-setup/SKILL.md teaches Claude Code how to add Strait to an app (React Native / Expo, Flutter,
Android, iOS, Unity, Capacitor, web, and a Node server). Copy the folder into ~/.claude/skills/ or a project's
.claude/skills/, or download it from https://straitlink.in/ai/strait-setup/SKILL.md.
The site repo owns it (site/lib/skill.mjs, fed by site.config.json, so install lines and versions match the
docs). Don't edit this copy by hand: run npm run skill:sync (needs ../site or SITE_DIR). The site's tests fail
when this copy drifts.
Develop
The end-to-end test (test/integration.test.ts) starts the real engine from ../redirect-engine (or
ENGINE_DIR) with its in-memory store, runs this server over stdio as a child process, creates a link and reads
it back. It is skipped when no engine checkout with installed dependencies is next to this repo.
Docs and support