wx93.me

wx93.me

Short links for people and agents. A URL shortener whose links are plain HTTP redirects, so they work with JavaScript off, in every chat app's preview and in every terminal. Stats, QR codes, custom aliases, expiry, webhooks and custom domains, with every surface the fleet ships: web + PWA, REST API, CLI with an hqtui TUI, MCP server (stdio and hosted), Electron desktop, and /llms.txt.

Live at https://wx93.me. Links use wx93.me by default; Automation accounts can use a verified custom domain.

Pricing

Paid plans are prepaid in crypto through CoinPay (USDC on Polygon by default; Solana, Ethereum, BTC and more). Nothing renews by itself: pay for a month or a year, extend whenever. No card checkout.

Plan	Price	What you get
Free	$0	Random short codes, QR codes, expiry, total clicks. People who open a free link see a 5 second ad page first (bots, link previews and scripts get the direct redirect). 100 links/month with an account, 20/hour/address without.
Pro	$5/month or $50/year	No ad page. Custom aliases, 301/302/307/308, full stats (daily, referrers, countries, devices, browsers), God Mode API keys. 5,000 links/month.
Automation	$29/month or $290/year	Everything in Pro, plus bulk create (1,000 per request), signed webhooks on every create and click, up to 5 custom domains, 100,000 links/month. For agents and businesses on the API, CLI, MCP, PWA and desktop.
x402 (agents, no account)	$0.25 per pass	Pay per call over x402: a pass lasts 60 minutes and covers 100 links, each ad-free for a year. Past the free allowance the API answers 402 with the offer; or buy one at /x402.

Upgrading Pro to Automation credits unused Pro time.

Use it

# no account needed
curl -s https://wx93.me/api/v1/links -H 'content-type: application/json' -d '{"url":"https://example.com/long"}'

# CLI + TUI (installs under ~/.local, never sudo; brings the desktop app on a desktop)
curl -fsSL https://wx93.me/install | sh        # --cli-only | --desktop
wx93 https://example.com/long --alias launch
wx93 login        # OAuth 2.1 + PKCE in the browser (--manual over SSH)
wx93 ls | wx93 stats launch | wx93 qr launch | wx93 tui

# MCP
curl -fsSL https://wx93.me/install-mcp | sh    # installs the stdio server as wx93-mcp
npx -y @profullstack/wx93-mcp                  # stdio without installing, or: wx93 mcp
curl -s https://wx93.me/mcp -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' -H 'content-type: application/json'

Full API: https://wx93.me/docs · machine summary: https://wx93.me/llms.txt

QR codes

• Twelve kinds. Dynamic (a short link underneath, so scans are counted and the content can change after printing): website, contact card, event, link list. The last three get a hosted page with a Save contact / Add to calendar button. Static (the content sits in the code): text, Wi-Fi, email, phone, SMS, WhatsApp, location, crypto payment.
• Design. Colours, eye colour, square/rounded/dot modules, square/rounded/circle eyes, error correction, margin, transparent background, a PNG/JPEG logo. Pairs too low in contrast to scan are refused; every style is tested to decode with ZXing.
• Export. SVG, PNG (rendered by resvg) and vector PDF for print.
• Scan analytics. Codes encode <short link>?qr, so scans are counted apart from clicks. Unique visitors (a salted, daily-rotating hash; no address stored), countries and cities (DB-IP Lite), devices, OS, browsers, referrers, a weekday-by-hour heatmap in any time zone, week over week, the last hour and the latest visits.
• Everywhere. /qr (no account, nothing saved), /account/qr, /api/v1/qr, wx93 qr new|ls|get|edit|stats|rm, and MCP create_qr_code and friends.

wx93 qr new wifi ssid=Cafe password=latte --png wifi.png
wx93 qr new url url=https://example.com/menu --name Menu --dots dots --eye-frame circle --logo logo.png --pdf menu.pdf
wx93 qr stats <id> --tz America/Los_Angeles

How a short link answers

• Pro / Automation / x402-paid links: the redirect type the owner chose (302 by default). 301/308 are Cache-Control: public, max-age=3600; 302/307 are private, no-cache so every click counts.
• Free links, a person in a browser: a server-rendered page with an ad slot, a <meta http-equiv="refresh"> countdown (a CSS bar, no script) and a plain Continue link. Ads are pluggable (AD_PROVIDER=crawlproof|house|none; CrawlProof house ads by default, rendered server-side in a frame).
• Free links, a crawler, unfurler, curl or script: the plain 302, Vary: User-Agent, so previews keep working.
• wx93.me/<code>+ shows where a link goes without going there.

Abuse

Every destination is checked when it is shortened: http(s) only, no credentials in the URL, no private/loopback addresses, no other shorteners (chains hide the end), not us, the blocklist table (suffix match), the URLhaus and OpenPhish feeds (refreshed every 6 hours and swept over the last 90 days of links), and Google Safe Browsing when SAFE_BROWSING_API_KEY is set. Anonymous links that look like credential phishing need an account. Rate limits are @profullstack/throttle (with the x402 gateway as the over-limit answer), the public forms use @profullstack/form-guard, and POST /api/v1/reports (or /report) pulls a link after 3 independent reports.

Run it

Bun + Hono, Postgres, no build step.

docker compose up                      # self-host: database + app on :3000
./bin/install.sh                       # or OpenInstall on a box (systemd + nginx + TLS)
DATABASE_URL=postgres://… bun test     # tests (the DB ones skip without DATABASE_URL)

Production runs on dev2 (/home/anthony/www/wx93.me, deployed by .github/workflows/deploy-dev2.yml on every merge to main). Secrets come from the logicsrc vault wx93-me--prod, never a committed .env. Settings:

Variable
DATABASE_URL	Postgres
SITE_URL	https://wx93.me (passkey rpID comes from it)
RESEND_API_KEY, MAIL_FROM	sign-in mail
COINPAY_API_KEY, COINPAY_BUSINESS_ID, COINPAY_WEBHOOK_SECRET	plans
COINPAY_X402_KEY, X402_PAY_TO, X402_ENABLED=1	x402
CRAWLPROOF_SLOT, AD_PROVIDER	interstitial ad
SAFE_BROWSING_API_KEY	optional extra lookup
ADMIN_EMAILS, APP_SECRET	staff, form-guard/report pepper

Releases: bump version in packages/cli and packages/mcp together and merge; release.yml publishes both to npm and attaches desktop builds to the GitHub release.

Country and city lookups by DB-IP (CC BY 4.0). MIT licensed.