Manage your QR codes by asking an AI assistant

MCP — the Model Context Protocol — is an open standard for letting an AI assistant talk to a service on your behalf. You point the assistant at an address once and approve it, and from then on it can call a fixed set of operations that service has published. It is not a plugin, a browser automation, or the assistant "having your password": it is a defined list of things it may do, and nothing outside that list is reachable.

Anthropic published it and it has been adopted well beyond Claude — ChatGPT, Cursor, Windsurf, Zed and others all speak it. Which means one connection here works with whichever assistant you already use, and keeps working if you switch.

A dynamic QR code has one property that makes it unusually well suited to being managed by conversation: the expensive part already happened. The code is printed. It is on a poster, a menu, a bag, a window. What remains is a small number of decisions about where it should point and whether it is on — and those are exactly the decisions that are annoying to make through a dashboard, because they are quick, occasional, and always come up when you are doing something else.

"The autumn menu is up, point the table codes at it" is one sentence. Through a dashboard it is a login, a search, a form and a save, times however many table codes there are. The dashboard is not badly built; the task is just badly shaped for a dashboard.

An assistant connected to your account can read your codes, folders and scan analytics; create a code of any type with the full set of options — expiry, password, folder, client, custom short link, campaign tags, scan alerts, webhooks, geofencing, A/B split and styling — one at a time or a hundred from a spreadsheet; change any of those settings later; restyle a code in the QR Studio designer and save the look as a brand template; make a folder and file codes into it; change where a code points; pause or resume one, or bring one back from the trash; publish the page a code lands on — an offer, a menu, an event, a link page, a business card; compare codes, export their scans and read the webhook log; add clients and assign codes to them; issue tickets; and reschedule or pause a report.

What it does not do is as deliberate. It never prints a client’s portal link or a ticket’s token — each is the whole credential for what it opens — and exported scans leave without the scanner’s IP address.

It cannot delete anything — there is no delete operation published, so this is a property of the connection rather than a promise about behaviour. It cannot see or change your password, your billing details or your subscription. It cannot reach another customer’s account: every operation runs against your own records, so somebody else’s code is not "refused", it simply does not exist as far as your connection is concerned.

Every assistant you connect is listed on your dashboard with what it is and when it last did anything — whether you connected it by signing in or with a token — and each is withdrawn on its own without touching the rest. Withdrawing takes effect on the next request it makes, and it is never refused, whatever your plan is doing.

Describing a look is far easier than picking one. QR Studio gives a code its own module shapes, eye shapes, colours, gradient and frame, and in the designer that is a grid of swatches you click through until something looks right. In a sentence it is "make the café menu code match our branding — warm browns, something that looks handmade", and you get it back in one go.

What stops that being a lottery is that the assistant is not mixing six colours from scratch. It starts from one of eighteen complete looks — a colour pair, a shape family and an error-correction level chosen together — and adjusts from there, the way anyone sensible uses a swatch book rather than a paint mixer. Every one of those looks is checked against the scannability rules before it ships: contrast, quiet zone, and light-on-dark, which is the classic way a beautiful code turns out to be an unreadable one.

And you see it. The code comes back drawn, in the conversation, so "rounder", "darker", "try it without the gradient" is a normal back-and-forth rather than a description you have to take on trust. If something you asked for would hurt scanning, it says so rather than quietly refusing — a code read from 10cm away can get away with things a code on a billboard cannot.

Restyling never moves where a code points. The destination, the short link and the scan history are untouched, and every copy already printed carries on working — a change of clothes, not a change of address. Logos are the one thing that stays in the studio, because an assistant has no file to upload; a code that already has one keeps it, and it appears in the picture.

Folders are how an account stays legible once there are more than a few dozen codes in it — per campaign, per venue, per season. An assistant can make one and file codes into it, by name: "create an Autumn Menu folder and put the four table codes in it", or one at a time, "file the Table 4 code under Events".

Two details make that safe to ask for casually. Asking for a folder that already exists uses it rather than making a second one with the same name — a duplicate folder is the tidy-up nobody notices until they are looking for something. And filing a code changes nothing a scanner sees: the destination, the short URL and the scan history all stay exactly as they were, because a folder is your filing rather than anything the code carries.

Renaming and deleting folders stay in the dashboard. Deleting one unfiles every code in it and renaming changes what every later instruction means by that name, and both are decisions worth making while looking at the list.

The request this is built for is not a single code. It is something like: "Create 50 QR codes from this CSV, put them in a folder called Morocco Campaign, and report the scans from last week." Attach the spreadsheet, say that, and the assistant does it as three steps rather than fifty.

The codes are made in one go. The CSV goes over as it is — a header row naming the columns (name, url, type, a campaign tag, an expiry date, or any of the fields a WiFi, vCard or WhatsApp code takes) and a row per code. Comma, semicolon or tab, with or without the byte-order mark Excel adds, because a spreadsheet saved in Casablanca or Paris does not look like one saved in Chicago. Every row goes through exactly the checks the create form applies, and they are all checked before the first code is written: one broken URL on row 38 creates nothing, and comes back as "row 38: that is not a valid URL" so it can be fixed and the file sent again. Forty-nine codes and a guess about the fiftieth is the outcome it exists to prevent.

The folder is made if it does not exist, and used if it does — "morocco campaign" finds "Morocco Campaign" rather than making a second one. The whole batch has to fit your plan, too, or none of it is made: the first forty of fifty is a campaign with ten posters pointing nowhere.

Then the report. "Last week" means what a person means by it — Monday to Sunday of the week before this one, in your own timezone — not the last seven days in UTC. It comes back with the total against the week before, unique visitors, the day-by-day line, countries and devices, and every code in the folder with its own count. And when the codes were only made a minute ago, it says so: every code in this folder was created after last week ended, so none of them could have been scanned yet — which is a very different sentence from "0 scans".

An assistant reading different figures from the ones on your own screen would be worse than useless, so it does not: the analytics it reports come from the same code that draws your dashboard, over the same periods.

That includes the bot filtering. Link previews, crawlers, uptime monitors and prefetches are excluded from every count, and reported separately when asked, so a quiet week has an explanation rather than just a smaller number.