Running QR codes from an AI agent

Connect it in three steps

1. Make a key. In taproute, open API and create one. It starts with tr_. Choose read and your assistant can look at your codes but not spend anything · choose write when you want it to make things. You can set a daily credit ceiling on the key at the same time.
2. Tell your assistant where taproute is. Find your app below and copy the block into it. It is the same address and the same key every time · only the file each app reads is different.
3. Ask it for something. Restart the app so it picks up the change, then try one of the sentences further down. If it worked, your assistant will list taproute among its tools.

Claude Code

Run this in a terminal, with your key in place of $TAPROUTE_KEY:

claude mcp add --transport http taproute https://taproute.io/mcp \
  --header "Authorization: Bearer $TAPROUTE_KEY"

# --scope user puts it on every project on this machine.
# --scope project writes .mcp.json instead, for the whole team.

For a project your team shares, commit a .mcp.json that names an environment variable instead of the key itself, so the file is safe to check in:

{
  "mcpServers": {
    "taproute": {
      "type": "http",
      "url": "https://taproute.io/mcp",
      "headers": { "Authorization": "Bearer ${TAPROUTE_KEY}" }
    }
  }
}

claude mcp list tells you whether it connected.

Claude Desktop

Open Settings, Developer, Edit config, and paste this into the file it opens. Restart Claude afterwards. The key sits in the file as written, so a read-scope key is the safer choice here:

// ~/Library/Application Support/Claude/claude_desktop_config.json
// %APPDATA%\Claude\claude_desktop_config.json on Windows
{
  "mcpServers": {
    "taproute": {
      "type": "http",
      "url": "https://taproute.io/mcp",
      "headers": { "Authorization": "Bearer tr_..." }
    }
  }
}

Cursor

Paste into ~/.cursor/mcp.json, or .cursor/mcp.json for one project:

// ~/.cursor/mcp.json, or .cursor/mcp.json for one project
{
  "mcpServers": {
    "taproute": {
      "url": "https://taproute.io/mcp",
      "headers": { "Authorization": "Bearer ${env:TAPROUTE_KEY}" }
    }
  }
}

VS Code · Copilot

Paste into .vscode/mcp.json. This one asks you for the key the first time and remembers it, so nothing secret is written into the file:

// .vscode/mcp.json
{
  "inputs": [
    { "type": "promptString", "id": "taproute-key", "description": "taproute API key", "password": true }
  ],
  "servers": {
    "taproute": {
      "type": "http",
      "url": "https://taproute.io/mcp",
      "headers": { "Authorization": "Bearer ${input:taproute-key}" }
    }
  }
}

Something else

Any assistant that speaks MCP can connect. Point it at https://taproute.io/mcp and have it send the header Authorization: Bearer tr_.... If it asks for a transport, the answer is Streamable HTTP, and there is nothing to install.

Under the hood it is JSON-RPC over Streamable HTTP, protocol versions 2024-11-05 through 2025-06-18, and the full tool list with schemas is on the API and MCP reference, generated from the same source the server runs.

Things to ask it

Plain sentences work. You do not need to know what the tools are called · that is the assistant's job. These are real requests, in the order most people need them:

• Make one. "Make me a QR code for my menu at example.com/menu and show me the image." You get a code and a downloadable image back.
• Change where it goes. "The code on my table tents points at the old menu. Point it at example.com/autumn instead." The printed code does not change · what it opens does. This is the one people do not believe until they see it.
• See who scanned. "How many people scanned my window sticker this week, and on what kind of phone?" Counts and devices, no cookies, no personal data.
• Build the page behind it. "Make a page for that code with our hours, the phone number and a WhatsApp button." It builds the page and points the code at it.
• Do it in bulk. "I need forty codes for the table tents, numbered, as one batch." One request, forty codes, priced before it starts.

A billable request is quoted before it happens: the assistant can read the price out of the tool it is about to call, so you hear "this will cost 1 credit" rather than finding out afterwards.

What it costs

What stops an agent spending your money

An agent with a write key is holding a wallet. Four things sit between it and your balance, and none of them is a promise about model behaviour · they are all enforced server-side.

• Scope on the key · a read-scope key can call the 29 read tools and nothing else. It is not a filter the agent can talk its way past; the billable tools are not in the list it is given.
• A daily credit budget per key · set at key creation, counted per UTC day, and enforced at the moment the wallet is debited rather than reconciled in a report afterwards. A key that has spent its ceiling stops, whatever the wallet holds.
• A price inside every billable tool's description · 10 of the 55 tools can spend credits, and each states its own cost where the agent reads it, before it decides. Creating a code is 1 credit, once, and 1 credit per scan after that.
• A purchase step no agent can complete · when the balance is short, a billable call fails with a 402 and get_topup_link returns a checkout URL for the agent to hand to you. There is no card on file, so there is nothing for an agent to charge.

The two 402s are deliberately distinguishable. One names the key's budget and is fixed under Settings; the other names the wallet and is fixed by buying credits. An agent that confuses them sends its user to the wrong screen, so the error says which.

What an agent deliberately cannot reach

Some things are absent by decision rather than by omission, and it is worth knowing which before you plan a workflow around them.

• Dashboard only · creating API keys, workspace members, billing checkout, agency client budgets, and registering a GS1 Company Prefix. The last one is a legal attestation, and an API key has no person behind it to be accountable for the declaration.
• REST only · removing a custom domain, because it takes every printed code on that hostname with it; AI art, because the caller has to supply a rasterised code; turning on smart pages, because it changes what every future scan costs; and reading page lead submissions, because those are somebody else's personal data.
• Rate limits · hourly, per credential, split between read and write, scaling with the workspace's credit pack. A refused call says so in plain text with the seconds until reset, so the correct response is to wait that long rather than retry.

Is this unusual?

No, and we stopped claiming otherwise in August 2026. Several vendors in this category ship an MCP server, and a page telling you ours exists would be selling something that stopped being scarce. The comparison worth making is narrower: whether the key carries a scope, whether it carries a spending ceiling, whether each tool tells the agent what it costs before it calls, and whether a purchase can complete without a human.

There is also an installable skill at /skill/SKILL.md for clients that support the format. It carries the part a tool list cannot: when to reach for taproute at all, what to confirm with a person before spending credits, and which failures mean something other than what they look like. The MCP server stays the interface; the skill is the routing layer above it.

Questions

Is there an MCP server for QR codes?

Yes. taproute runs one at https://taproute.io/mcp, over Streamable HTTP, with 55 tools covering links, routing, hosted pages, analytics and the GS1 catalogue. It is included on every account at no extra charge, and it authenticates with the same API key the REST API uses.

Can an AI agent spend my money without asking?

Only up to a ceiling you set. A key can carry a daily credit budget, enforced when the wallet is debited rather than reconciled afterwards, and a read-scope key cannot reach a billable tool at all. Of the 55 tools, 10 can spend credits and 29 are read-only. Each billable tool states its price inside its own description, so the agent knows the cost before it calls.

Can an agent buy credits for me?

No, and that is deliberate. When the wallet is short, a billable call fails with a 402 and the agent can call get_topup_link, which returns a checkout URL for it to hand to you. A human completes every purchase. There is no card on file for an agent to charge.

What happens when the key budget runs out but the wallet has credits?

You get a 402 that names the budget rather than the wallet. The two failures read differently on purpose: one is fixed by raising the budget under API, where the key was made, and the other by buying credits. An agent that cannot tell them apart sends you to the wrong place.

Is an MCP server unusual for a QR or link platform?

Not any more. Several vendors in this category ship one, and we stopped treating it as a differentiator in August 2026. What is worth comparing is what governs the spend: scope on the key, a per-key daily ceiling, prices stated per tool, and a purchase step no agent can complete.

What can an agent not do?

Create API keys, add or remove workspace members, complete a checkout, set an agency client budget, or register a GS1 Company Prefix, which is a legal attestation that has to record a real person. Four more actions are REST-only because an agent cannot use them well unattended, including removing a custom domain, which takes every printed code on that hostname with it.