{
  "markdown": "# @htmldrop.app/mcp\n\nModel Context Protocol server for [htmldrop](https://htmldrop.app) — publish HTML or Markdown to a real hosted URL straight from Claude Code, Claude Desktop, Cursor, Cline, or any MCP-aware client.\n\n> **Note:** this is htmldrop.app. An unrelated project also called \"htmldrop\" exists at htmldrop.link (npm `htmldrop-mcp`) — different product, different API.\n\n## Quick start — remote server (recommended)\n\nNo install, no API keys. Add the hosted server and sign in with OAuth in your browser:\n\n```\nclaude mcp add --transport http htmldrop https://htmldrop.app/mcp\n```\n\nThe first time the model publishes, your browser opens a sign-in — approve once and you're done. Works the same in any MCP client that supports remote (streamable HTTP) servers with OAuth; see the per-client pages on [htmldrop.app/agents](https://htmldrop.app/agents/).\n\nThen just ask: *\"Make a single-page HTML CV for Alex Rivera and publish it to htmldrop.\"* The model calls `htmldrop_publish` and replies with the live URL.\n\n## Interactive clients — always use the remote\n\nClaude Code (above), **Claude Desktop** (Settings → Connectors → Add custom connector → `https://htmldrop.app/mcp`), **Cursor** (Settings → MCP → Add remote server), and other remote-capable clients should all use the hosted URL. You sign in once in the browser; no credential is ever written to a config file. Per-client walkthroughs: [htmldrop.app/agents](https://htmldrop.app/agents/).\n\n## CI, scripts, and headless use — local server (stdio)\n\nAutomation can't do a browser sign-in, so the stdio server authenticates with an API token — created at [htmldrop.app/dashboard/settings](https://htmldrop.app/dashboard/settings) → API tokens (`hsk_live_…`, shown once). **Store it in your secret manager or CI's encrypted secrets and reference it — never write the literal value into a config file or repository.**\n\nGitHub Actions example:\n\n```yaml\n- name: Publish report page\n  env:\n    HTMLDROP_API_TOKEN: ${{ secrets.HTMLDROP_API_TOKEN }}\n  run: |\n    npx -y @htmldrop.app/mcp &   # stdio server for your MCP-driving tool\n    # …or call the REST API directly: https://docs.htmldrop.app/api/authentication\n```\n\nShell/session example (token from your OS keychain or secret manager, not typed inline):\n\n```\nexport HTMLDROP_API_TOKEN=\"$(security find-generic-password -s htmldrop -w)\"  # macOS Keychain\nnpx -y @htmldrop.app/mcp\n```\n\nIf a client genuinely can't speak remote MCP *and* isn't automation (rare now), the classic `mcpServers` JSON block with an env entry works — accept that it stores the token in that client's config file, and prefer the `.mcpb` bundle for Claude Desktop, which keeps the token in the OS keychain instead.\n\n## Tools\n\n| Tool | What it does |\n|---|---|\n| `htmldrop_publish` | Publish an HTML or Markdown document. Returns the public share URL, site id, and slug. Accepts an optional `slug` and `title`. |\n| `htmldrop_list` | List every site the authenticated tenant owns. |\n| `htmldrop_delete` | Delete a site by id. |\n\n## Configuration (local server)\n\n| Env var | Default | Purpose |\n|---|---|---|\n| `HTMLDROP_API_TOKEN` | *(required for stdio)* | The `hsk_live_…` token minted in your dashboard. The remote server uses OAuth instead. |\n| `HTMLDROP_API_URL` | `https://htmldrop.app/api/v1` | Override for staging or self-hosted htmldrop instances. |\n| `HTMLDROP_PUBLIC_URL` | *(derived from `HTMLDROP_API_URL`)* | User-facing origin for share links (`…/s/<slug>`). Only needed when `HTMLDROP_API_URL` points at a non-public address; set it to e.g. `https://htmldrop.app`. |\n\n## Plan limits\n\nThe MCP server hits the same API your dashboard does, so plan caps apply — free accounts keep 3 drops, paid plans (from $5/mo) raise caps and add permanence, password protection, version history, and custom domains. Current numbers: [htmldrop.app/#pricing](https://htmldrop.app/#pricing). When you hit a cap the tool call returns a clear error (`plan_limit`) that the model surfaces in chat — no silent failure.\n\n## Security notes\n\n- The remote server (`https://htmldrop.app/mcp`) follows the MCP authorization spec: OAuth 2.1 with PKCE, discovery via RFC 9728 protected-resource metadata, and short-lived tokens your client refreshes automatically. Tokens are never passed in URLs. This is the recommended path for humans in MCP clients — no static credential exists anywhere.\n- Local-server API tokens (`hsk_live_…`) carry full tenant privileges — treat them like a password. Keep them out of source control, store them in a secret manager or your CI's encrypted secrets (not a committed config file), and revoke from Settings → API tokens the moment one may have leaked (revocation is effective immediately). The `.mcpb` one-click install for Claude Desktop stores the token in your OS keychain rather than a plaintext file.\n- The stdio server runs on your machine. No traffic flows through htmldrop other than the API calls the tool makes on your behalf.\n\n## Development\n\n```\nnpm ci\nnpm test        # builds + runs the node:test suite\n```\n\nThis repository is a read-only mirror of the `mcp/` directory in htmldrop's main (private) repository — the source of truth. Issues and PRs are welcome here; accepted changes are applied upstream and sync back automatically.\n\n## License\n\nMIT — © Middle East Software Solutions Limited",
  "bytes": 5310,
  "sha": "6076a46207ce834254b2f835acbedf482c1db61074adffa333001a07f6f588a2",
  "repo_slug": "middleeastsoftware/htmldrop-mcp",
  "fonte": "npm",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_app_htmldrop_mcp_c65bc8b7/readme"
}