{
  "markdown": "# justdrop-mcp\n\nGive your AI agent a way to hand you files — live, end-to-end encrypted, nothing stored.\n\n`justdrop-mcp` is an MCP (Model Context Protocol) server for [JustDrop](https://justdrop.ai). Your agent creates a room, you scan a QR or open a link on any device, and the files move — encrypted before they leave the machine, decrypted only on yours, gone when the room closes. No account on either end. The receiving device needs nothing installed: just a browser.\n\n```\nYou:    \"drop dist/report.pdf to my phone\"\nAgent:  Room code: brave-otter-4821\n        Link: https://justdrop.ai/app#join=brave-otter-4821\n        [QR code]\nYou:    *scan, tap, done — the room self-destructs*\n```\n\nIt works the other way too: \"grab the screenshot from my phone\" gives you a QR; whatever you drop from the phone lands decrypted in your working directory, and the agent keeps working with it.\n\n## Install\n\nRequires Node.js 20+.\n\n```bash\nclaude mcp add justdrop -- npx -y justdrop-mcp\n```\n\nOr in `.mcp.json` / any MCP client config:\n\n```json\n{\n  \"mcpServers\": {\n    \"justdrop\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"justdrop-mcp\"],\n      \"env\": {\n        \"JUSTDROP_ROOT\": \"C:/path/to/allowed/folder\"\n      }\n    }\n  }\n}\n```\n\n## Tools\n\n| Tool | What it does |\n|---|---|\n| `drop` | Send files/folders. Returns room code + link + QR immediately; the transfer runs automatically when the recipient opens the link. Pass `room_code` to send into an existing room instead. |\n| `receive` | Receive files into a directory. Creates a room (code + link + QR) and saves anything dropped into it, decrypted, automatically. Pass `room_code` to join a room someone else created. |\n| `status` | Live progress: peer presence, per-file state, saved paths. |\n| `cancel` | Destroys a room this session created (files + metadata deleted), or leaves a joined room. |\n\n## Configuration\n\n| Env var | Default | Meaning |\n|---|---|---|\n| `JUSTDROP_BASE_URL` | `https://justdrop.ai` | Backend to talk to (point at `http://localhost:3000` for local dev). |\n| `JUSTDROP_ROOT` | server's working directory | The **only** directory the server may read from / save into. |\n| `JUSTDROP_DEFAULT_EXPIRY_MINUTES` | `60` | Room lifetime when a tool doesn't specify one (1–1440). |\n\n## Safety model\n\nAn MCP server that reads local files is a prompt-injection target, so the guardrails are structural, not polite suggestions:\n\n- **Root jail** — every path (sent or saved) must resolve inside `JUSTDROP_ROOT`. Anything else is refused.\n- **Credential refusal** — dotfiles (`.env`, `.npmrc`, …), SSH/TLS keys, keystores, cloud credential files, and shell histories are never sent, even when named explicitly. There is no override flag.\n- **Explicit manifests** — every `drop` result lists exactly which files were queued, so the user sees what's leaving.\n- **Server-side blocklist parity** — extensions JustDrop rejects (`.exe`, `.bat`, …) are refused up front with a hint to zip instead.\n- **Ephemeral by default** — rooms carry an expiry (default 60 min) and self-destruct after delivery.\n\n## How the transfer works\n\n1. `drop` creates a room and registers an RSA-2048 public key; the tool returns the code/link/QR immediately.\n2. When the recipient opens the link, their browser registers its own key. Rooms are one-to-one by design — treat the room code like the secret it is.\n3. Each file gets a fresh AES-256-GCM key, encrypted for both parties' RSA keys. The encrypted blob is relayed through short-lived signed URLs — the relay never sees plaintext or keys.\n4. Delivery is observed live; the room (and everything in it) is destroyed afterwards.\n\nFiles are encrypted in one shot in memory (format parity with the web app), so very large files need commensurate RAM. The hard cap is 2GB per file.\n\n## Local development\n\n```bash\nnpm install\nnpm run verify   # builds, boots ../justdrop-simple dev server, runs both test suites\n\n# or piecewise, against a server you started yourself:\nnpm run build\nnode test/e2e.mjs http://localhost:3000        # core roundtrip (both directions + SSE)\nnode test/mcp-smoke.mjs http://localhost:3000  # full MCP stdio protocol exercise\n```\n\n## License\n\nMIT\n",
  "bytes": 4152,
  "sha": "4a1f64aa736fa3d987fa51e8efc015a5e3660be4aed8bf0697b2a37f2c454240",
  "repo_slug": "managed-digital-llc/justdrop-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_ai_justdrop_mcp_3f2ab8b5/readme"
}