qURL™ for MCP
Secure access, built into your agent.
Give your agent tools to share private resources without opening them to the public internet. With a qURL Connector, access is checked before a connection to the app opens. Your agent can create links with an expiry and end access early when needed.
How it works
Connect hosted MCP, or run it locally.
Connect to https://mcp.connector.layerv.ai/mcp with a qURL API key in a client that supports bearer-token authentication. Hosted MCP needs a LayerV account; it needs no local MCP server, Node.js or qURL CLI installation. It manages resources through the API and cannot reach localhost or files on your computer.
# Set QURL_API_KEY in the environment where you start Codex.
# Requires a LayerV account and a client with bearer-token support.
codex mcp add qurl-hosted --url https://mcp.connector.layerv.ai/mcp --bearer-token-env-var QURL_API_KEYAgent → tool → access
For local MCP, install Node.js 22.12 or later and the qURL CLI, use the client config tab, then restart your client. No account or API key is needed. The publish_crid tool shares your local app through the CLI’s own connector. The link tools of the API-key tabs work on an existing URL configured for access through LayerV; creating a link does not start a connector or change that URL’s public exposure. To share a local app without MCP, start with the CLI quickstart, or let your coding agent do it with the qURL skill, which needs no API key.
With an API key, mint_link accepts a CRID as well as the resource IDs its URL tools return, for a resource the API key can access. To issue links from your own code, use the SDK or API examples.
Local stdio clients include Claude Desktop, Claude Code, Cursor and Codex. In Claude Code, the qURL plugin needs no MCP server at all. With an API key, follow your client’s instructions for storing credentials.
Why it’s different
Access tools your agent can call.
The agent asks for itself
The agent can call create_qurl to issue a link for a configured URL. It can resolve supported access tokens with resolve_qurl, using a credential permitted to perform that operation.
No credential to hand over
Without an API key the tools act as this machine’s qURL CLI, so there is no account key in the config. With a key, give the server only the scopes it needs. Access links are bearer credentials with the expiry, use limits, and access policy you set.
Revocation is a tool call
Use revoke_qurl_token for one link and delete_qurl to retire a resource. Handle service errors and any retry required to complete session cleanup.
Give your agents a way in.
Add the tools, configure the resource, and let your agent create access links as part of its work.