dropthis-mcp

# @dropthis/mcp

Official [MCP](https://modelcontextprotocol.io) server for [dropthis](https://dropthis.app) — publish content (HTML, files, or a URL to fetch) and get back a permanent public URL, from any MCP-compatible agent (Claude Code, Claude Desktop, Cursor, Windsurf, opencode, ChatGPT, n8n, …).

Two ways to connect:

- **Local (stdio)** — `npx @dropthis/mcp`, authenticated with your `sk_` API key. Best for coding agents.
- **Remote (hosted)** — `https://mcp.dropthis.app/mcp` over Streamable HTTP, with OAuth for chat clients or a static `sk_` Bearer for automation. Best for ChatGPT / claude.ai / n8n.

## Local / stdio

Add to your MCP client config:

```json
{
  "mcpServers": {
    "dropthis": {
      "command": "npx",
      "args": ["-y", "@dropthis/mcp"],
      "env": { "DROPTHIS_API_KEY": "sk_..." }
    }
  }
}
```

Get an API key from your dropthis account. The server reads `DROPTHIS_API_KEY` (and optional `DROPTHIS_BASE_URL`). Claude Desktop users can install the one-click `.mcpb` bundle instead (the API key is stored in your OS keychain).

See [docs/setup.md](docs/setup.md) for per-client instructions (Claude Code, Cursor, Windsurf, VS Code, …).

## Remote (hosted) connector

Point an MCP-capable client at the hosted endpoint:

```
https://mcp.dropthis.app/mcp
```

- **Chat clients (ChatGPT, claude.ai)** authenticate via OAuth 2.1 — add the connector URL and approve the login (a 6-digit email code; no password).
- **Automation (n8n, CI, custom agents)** sends a static `Authorization: Bearer sk_...` header and skips OAuth. See [docs/n8n.md](docs/n8n.md).

## Tools

| Tool | Purpose |
|------|---------|
| `dropthis_publish` | Publish new content (`content` \| `source_url` \| `files` \| `file`/`paths`) → permanent URL |
| `dropthis_update_content` | Publish a new content version to an existing drop, keeping its URL |
| `dropthis_update_settings` | Update a drop's settings (title, visibility, password, noindex, expiry, metadata) |
| `dropthis_get` | Fetch one drop's metadata |
| `dropthis_get_content` | Read back what a drop is serving — its file manifest, or one file's content (the read half of the edit loop) |
| `dropthis_list` | List your drops (paginated) |
| `dropthis_list_deployments` | List a drop's deployment (version) history |
| `dropthis_delete` | Delete a drop (requires `confirm: true`) |
| `dropthis_account` | Authenticated account profile (id, email, status) including the account's limits for preflight sizing |
| `dropthis_domains_connect` | Connect a custom domain (`path` or `dedicated` mode) and get the CNAME record to create |
| `dropthis_domains_verify` | Re-check a domain's DNS/TLS and advance its status toward `live` |
| `dropthis_domains_get` | Read one domain's stored state and DNS instructions (no live DNS check) |
| `dropthis_domains_list` | List the account's custom domains and which is the default publish target |
| `dropthis_domains_update` | Repoint a dedicated domain to another drop, or set/clear the default path domain |
| `dropthis_domains_delete` | Disconnect a custom domain (requires `confirm: true`) |

`file`/`paths` are local/stdio only — the hosted Worker omits them from the tool schemas entirely. `dropthis_update_content` accepts the same content inputs as `dropthis_publish`; a `source_url` is fetched server-side (SSRF-guarded) and stored as the new version. The id-based tools want the `drop_…` id from the publish response, but a drop URL or slug is auto-resolved when that's all you have. Connections whose OAuth grant lacks the `drops:write` scope see only the read tools.

`dropthis_account` returns your account's exact limits.

## Develop

```bash
npm install
npm run dev          # tsx src/bin.ts (needs DROPTHIS_API_KEY)
npm run dev:worker   # wrangler dev (remote Worker)
npm test             # vitest (node) + vitest-pool-workers
npm run typecheck    # tsc (node + worker tsconfigs)
npm run lint         # biome
npm run build        # tsup → dist/bin.cjs (the npm package)
npm run build:worker # wrangler deploy --dry-run (bundle check)
```

One TypeScript codebase, two outputs: the stdio npm package and the Cloudflare Worker. Both are thin clients over the dropthis REST API (`@dropthis/node` for stdio, `@dropthis/node/edge` for the Worker); tool handlers are unit-tested against an injected fake client.

## License

MIT