Connect TinyTo to your assistant

Overview

The MCP server speaks Streamable HTTP at https://tinyto.me/mcp. There is nothing to install, no token to copy and no per-client configuration file to hand-write: every client below discovers the authorization server from the endpoint itself.

What the assistant can do

Five tools. Four read, one writes. Nothing deletes or edits a link that already exists.

create_link is the only write operation and it is marked non-destructive, so clients call it without a scary confirmation. Approval of links:create on the consent screen is enforced on every call: a read-only grant gets a clear permission error instead of a link.

Connect a client

Pick your assistant. Every one of them starts with the same URL: https://tinyto.me/mcp.

Claude — web, Desktop, Cowork and mobile

Available on Free (one custom connector), Pro, Max, Team and Enterprise. No developer mode needed.

1. Open Customize → Connectors and click +, then Add custom connector.
2. Name it TinyTo and paste https://tinyto.me/mcp as the remote MCP server URL. Click Continue.
3. Leave Authentication on Sign in now and OAuth client on Use Claude's published identity. Add it.
4. Click Connect and approve the request on the TinyTo consent screen.

On Team and Enterprise, an Owner adds the connector once in Organization settings → Connectors; each member then connects their own TinyTo account from Customize → Connectors. In a chat, enable it per conversation from the + button → Connectors.

Claude Code

claude mcp add --transport http tinyto https://tinyto.me/mcp

Then run /mcp inside Claude Code, pick tinyto and choose Authenticate. The browser opens on the TinyTo consent screen and the tokens are stored outside your project files.

Useful commands:

claude mcp list              # status: connected / needs authentication
claude mcp get tinyto        # details for this server
claude mcp login tinyto      # re-authenticate from the shell
claude mcp logout tinyto     # revoke the tokens on the TinyTo side
claude mcp remove tinyto     # drop the configuration

Add --scope user to make the server available in every project, or --scope project to commit it to .mcp.json for a team.

ChatGPT

Web only, not mobile. Full MCP tool support (including create_link) requires Business, Enterprise or Edu. Pro accounts can connect custom servers for read and fetch only.

1. Go to Plugins (chatgpt.com/plugins) and click +, then Add custom MCP server. Developer mode is no longer required.
2. Name it TinyTo, and under Connection paste https://tinyto.me/mcp.
3. Set authentication to OAuth. ChatGPT finds the authorization server by itself.
4. Accept the risk warning and choose Create as a plugin. When ChatGPT scans the tools it opens the TinyTo consent screen — approve it there.
5. In a chat, type @ and pick TinyTo, then ask it to shorten something.

OpenCode

opencode mcp add tinyto --url https://tinyto.me/mcp --global
opencode mcp list                       # → needs authentication
opencode mcp auth tinyto                # opens the browser

Inside OpenCode, /mcps lets you connect, disconnect or re-authenticate. To configure it by hand, the entry lives under mcp.servers in opencode.jsonc:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "servers": {
      "tinyto": {
        "type": "remote",
        "url": "https://tinyto.me/mcp"
      }
    }
  }
}

OAuth is on by default for remote servers, so do not add an oauth: false or an Authorization header — that would switch OpenCode to static credentials and the connection would fail with 401.

Cursor

Add the server to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project):

{
  "mcpServers": {
    "tinyto": {
      "url": "https://tinyto.me/mcp"
    }
  }
}

Open Settings → Tools & MCP. The server shows Needs authentication with a Connect button: click it, approve in the browser that opens, and the tools appear in agent mode.

VS Code with GitHub Copilot

Create .vscode/mcp.json in the workspace (or use the user profile's mcp.json for every project):

{
  "servers": {
    "tinyto": {
      "type": "http",
      "url": "https://tinyto.me/mcp"
    }
  }
}

Run MCP: List Servers from the Command Palette and start tinyto. VS Code opens a browser window for the OAuth flow on first use; approve it and the tools become available in agent mode.

Codex CLI

codex mcp add tinyto --url https://tinyto.me/mcp
codex mcp login tinyto

Or edit ~/.codex/config.toml directly:

[mcp_servers.tinyto]
url = "https://tinyto.me/mcp"

Codex uses OAuth by default. The tokens go to your OS keychain, not to config.toml, and refresh without prompting.

Gemini CLI

gemini mcp add --transport http --scope user tinyto https://tinyto.me/mcp

Then start gemini and run /mcp auth tinyto. The OAuth flow is discovered automatically from the endpoint; /mcp list shows the connection state and /mcp auth alone lists the servers that still need a sign-in.

Windsurf

Open the MCP panel, choose Configure and edit ~/.codeium/windsurf/mcp_config.json. Windsurf uses serverUrl for remote servers, not url:

{
  "mcpServers": {
    "tinyto": {
      "serverUrl": "https://tinyto.me/mcp"
    }
  }
}

Save the file, click Refresh in the MCP panel and approve the OAuth prompt in the browser window that opens.

Zed

Open your settings (zed: open settings) and add the server under context_servers:

{
  "context_servers": {
    "tinyto": {
      "url": "https://tinyto.me/mcp"
    }
  }
}

Leaving out an Authorization header is what triggers Zed's OAuth flow — add one and it would send that static header instead.

Cline

Open the MCP servers panel, go to Configure and add an entry under mcpServers:

{
  "mcpServers": {
    "tinyto": {
      "type": "streamableHttp",
      "url": "https://tinyto.me/mcp",
      "disabled": false,
      "autoApprove": []
    }
  }
}

Cline starts the OAuth flow the first time it calls a tool. Keep autoApprove empty so each create_link call is confirmed.

Antigravity

From Settings → Customizations → Open MCP Config, add the server with serverUrl:

{
  "mcpServers": {
    "tinyto": {
      "serverUrl": "https://tinyto.me/mcp"
    }
  }
}

Clients that only speak stdio

Older desktop clients understand only a local command. Bridge them with mcp-remote, which proxies stdio to a remote Streamable HTTP server and handles the OAuth flow:

npx -y mcp-remote https://tinyto.me/mcp

In a JSON config for such a client that means:

{
  "mcpServers": {
    "tinyto": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://tinyto.me/mcp"]
    }
  }
}

Building a client of your own? Everything is standards-based: RFC 9728 protected resource metadata, RFC 8414 authorization server metadata, dynamic client registration, Client ID Metadata Documents, PKCE S256 and RFC 8707 resource indicators.

How sign-in works

Nothing is pre-shared between TinyTo and your assistant. The client starts from the endpoint alone and walks the discovery chain:

1. It calls /mcp without a token and gets 401 with a WWW-Authenticate header pointing at /.well-known/oauth-protected-resource.
2. That document names the authorization server, whose metadata at /.well-known/oauth-authorization-server lists the authorize, token, registration and JWKS URLs.
3. The client identifies itself — by a Client ID Metadata Document it hosts, or by registering with the server (RFC 7591) — and opens the consent screen with PKCE.
4. You sign in to TinyTo and approve. The client gets an access token (1 hour) and a rotating refresh token (30 days).

Disconnecting

Any of these stops the assistant immediately — access tokens are cut off at once, not at their next expiry:

1. Dashboard → API → Connected apps and press Disconnect next to the application. This is the one that works even if the client never tells us it is leaving.
2. Remove the connector in the client. Claude, Cursor, OpenCode and the rest usually discard their tokens locally.
3. Clients that implement revocation call POST /oauth/revoke with the refresh token.

Open Connected apps →

Troubleshooting

Security and privacy

The assistant acts as you, with the permissions you approved on the consent screen. That means a prompt-injection attack in the assistant's context could ask it to create links — so the write surface is deliberately small.

• It can read your links and their stats, and create new links. Nothing else.
• It cannot delete, edit or transfer a link, change your plan, or touch billing.
• It never sees your password. Tokens belong to the app you connected.
• Refresh tokens are stored hashed and rotate on every use; reuse is rejected.
• Access tokens are short-lived JWTs bound to this endpoint by audience.
• Revoking access is immediate, from the dashboard or from the client.

Questions or a client that is not listed here? Write to support@tinyto.me.