@htmldrop.app/mcp

Model Context Protocol server for htmldrop — publish HTML or Markdown to a real hosted URL straight from Claude Code, Claude Desktop, Cursor, Cline, or any MCP-aware client.

Note: this is htmldrop.app. An unrelated project also called "htmldrop" exists at htmldrop.link (npm htmldrop-mcp) — different product, different API.

Quick start — remote server (recommended)

No install, no API keys. Add the hosted server and sign in with OAuth in your browser:

claude mcp add --transport http htmldrop https://htmldrop.app/mcp

The first time the model publishes, your browser opens a sign-in — approve once and you're done. Works the same in any MCP client that supports remote (streamable HTTP) servers with OAuth; see the per-client pages on htmldrop.app/agents.

Then just ask: "Make a single-page HTML CV for Alex Rivera and publish it to htmldrop." The model calls htmldrop_publish and replies with the live URL.

Interactive clients — always use the remote

Claude Code (above), Claude Desktop (Settings → Connectors → Add custom connector → https://htmldrop.app/mcp), Cursor (Settings → MCP → Add remote server), and other remote-capable clients should all use the hosted URL. You sign in once in the browser; no credential is ever written to a config file. Per-client walkthroughs: htmldrop.app/agents.

CI, scripts, and headless use — local server (stdio)

Automation can't do a browser sign-in, so the stdio server authenticates with an API token — created at htmldrop.app/dashboard/settings → API tokens (hsk_live_…, shown once). Store it in your secret manager or CI's encrypted secrets and reference it — never write the literal value into a config file or repository.

GitHub Actions example:

- name: Publish report page
  env:
    HTMLDROP_API_TOKEN: ${{ secrets.HTMLDROP_API_TOKEN }}
  run: |
    npx -y @htmldrop.app/mcp &   # stdio server for your MCP-driving tool
    # …or call the REST API directly: https://htmldrop.app/docs/api

Shell/session example (token from your OS keychain or secret manager, not typed inline):

export HTMLDROP_API_TOKEN="$(security find-generic-password -s htmldrop -w)"  # macOS Keychain
npx -y @htmldrop.app/mcp

If a client genuinely can't speak remote MCP and isn't automation (rare now), the classic mcpServers JSON block with an env entry works — accept that it stores the token in that client's config file, and prefer the .mcpb bundle for Claude Desktop, which keeps the token in the OS keychain instead.

Tools

Tool	What it does
htmldrop_publish	Publish an HTML or Markdown document. Returns the public share URL, site id, and slug. Accepts an optional slug and title.
htmldrop_list	List every site the authenticated tenant owns.
htmldrop_delete	Delete a site by id.

Configuration (local server)

Env var	Default	Purpose
HTMLDROP_API_TOKEN	(required for stdio)	The hsk_live_… token minted in your dashboard. The remote server uses OAuth instead.
HTMLDROP_API_URL	https://htmldrop.app/api/v1	Override for staging or self-hosted htmldrop instances.
HTMLDROP_PUBLIC_URL	(derived from HTMLDROP_API_URL)	User-facing origin for share links (…/s/<slug>). Only needed when HTMLDROP_API_URL points at a non-public address; set it to e.g. https://htmldrop.app.

Plan limits

The MCP server hits the same API your dashboard does, so plan caps apply — free accounts keep 3 drops, paid plans (from $5/mo) raise caps and add permanence, password protection, version history, and custom domains. Current numbers: htmldrop.app/#pricing. When you hit a cap the tool call returns a clear error (plan_limit) that the model surfaces in chat — no silent failure.

Security notes

• The remote server (https://htmldrop.app/mcp) follows the MCP authorization spec: OAuth 2.1 with PKCE, discovery via RFC 9728 protected-resource metadata, and short-lived tokens your client refreshes automatically. Tokens are never passed in URLs. This is the recommended path for humans in MCP clients — no static credential exists anywhere.
• Local-server API tokens (hsk_live_…) carry full tenant privileges — treat them like a password. Keep them out of source control, store them in a secret manager or your CI's encrypted secrets (not a committed config file), and revoke from Settings → API tokens the moment one may have leaked (revocation is effective immediately). The .mcpb one-click install for Claude Desktop stores the token in your OS keychain rather than a plaintext file.
• The stdio server runs on your machine. No traffic flows through htmldrop other than the API calls the tool makes on your behalf.

Development

npm ci
npm test        # builds + runs the node:test suite

This repository is a read-only mirror of the mcp/ directory in htmldrop's main (private) repository — the source of truth. Issues and PRs are welcome here; accepted changes are applied upstream and sync back automatically.

License

MIT — © Middle East Software Solutions Limited