@drop2run/mcp 0.1.0 → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Drop2Run
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,37 +1,19 @@
 # @drop2run/mcp
 
-An MCP server that publishes to [Drop2Run](https://dropto.run) from inside a chat. Three tools:
+An MCP server that lets Claude — or any MCP client — publish a static site to
+[Drop2Run](https://dropto.run). Give it a folder or an HTML document; it returns a live HTTPS URL.
 
-| Tool | What it does |
-|---|---|
-| `publish_html` | Takes one HTML document, publishes it as a whole site, returns the URL |
-| `publish_dir` | Takes an absolute folder path and publishes it |
-| `list_sites` | Lists the account's sites, so a publish can go to one of them |
-
-## Getting a token
+Full documentation at [dropto.run/docs/mcp](https://dropto.run/docs/mcp).
 
-The server authenticates with a personal access token — there is no browser in a chat, so there is no
-cookie to use. Create one at <https://dropto.run/account/tokens>. It is shown once and stored as a hash,
-so it cannot be recovered afterwards.
+## Setup
 
-Then either put it in the environment:
+**Claude Code** — one command:
 
+```bash
+claude mcp add drop2run -s user -- npx -y @drop2run/mcp
 ```
-DROP2RUN_TOKEN=d2r_...
-```
-
-or in `~/.config/drop2run/config.json`:
-
-```json
-{ "token": "d2r_..." }
-```
-
-The environment wins. That file is deliberately the same one the `drop2run` CLI reads, so
-`drop2run login` covers both — and so the two can never disagree about which account is yours.
-
-Point it at a different API with `DROP2RUN_API_URL`, or `apiBaseUrl` in the same file.
 
-## Wiring it up
+**Claude Desktop** — add this to `claude_desktop_config.json`, then restart the app:
 
 ```json
 {
@@ -44,31 +26,80 @@ Point it at a different API with `DROP2RUN_API_URL`, or `apiBaseUrl` in the same
 }
 ```
 
-That is the whole configuration — `npx` fetches the package, and there is nothing to install globally.
+That file is at `~/Library/Application Support/Claude/claude_desktop_config.json` on macOS, and
+`%APPDATA%\Claude\claude_desktop_config.json` on Windows.
+
+Nothing is installed globally either way — `npx` fetches the package when the client starts it.
+
+## Sign in
 
-To run it from a checkout instead, build first, because `dist/` is not in the repository:
+The server has no browser and no dashboard session, so it authenticates with a personal access token.
+Two ways to give it one.
+
+Through the CLI, which stores it in `~/.config/drop2run/config.json` with mode `0600`:
 
 ```bash
-cd packages/mcp && npm run build
-node bin/drop2run-mcp.mjs
+npx drop2run login
 ```
 
-## Two decisions worth knowing about
+Or create a token at <https://dropto.run/account/tokens> and set it in the environment:
 
-**Publishing without naming a site creates a new one.** The obvious alternative — reuse the most recent —
-would silently replace whatever the account last published, and a tool a model calls on somebody's
-behalf is the worst place for that default. "Put this online" is not "and overwrite my last site".
+```
+DROP2RUN_TOKEN=d2r_...
+```
+
+A token is shown once and stored as a hash, so it cannot be read back later — create a new one if you
+lose it. The environment takes precedence over the file, and the file is the one the `drop2run` CLI
+reads, so signing in once covers both.
+
+The token is read on every call rather than at startup, so one added while the client is running takes
+effect without a restart.
+
+## The tools
+
+| Tool | What it does |
+|---|---|
+| `publish_files` | Publishes files Claude wrote — a page, a markdown note, several files together |
+| `publish_dir` | Publishes a folder, given its absolute path |
+| `list_sites` | Lists the sites on the account |
+
+Both publish tools take an optional `site` — a subdomain or site id to publish over. Leave it out and a
+new site is created.
+
+## Behaviour worth knowing
+
+**Publishing without a `site` creates a new one.** It never replaces your most recent site by default:
+"put this online" is not "and overwrite what I published last time".
+
+**A site can be documents instead of a built site.** A publish needs an `index.html` at the top level,
+or at least one `.md`, `.markdown` or `.pdf` file — those are served through the reader. So a single
+note is a whole site, and Claude does not have to wrap it in HTML to publish it.
+
+**`publish_files` is text.** A PDF or an image has to come off a disk with `publish_dir`, because these
+files arrive as JSON strings.
+
+**The URL comes back immediately; every edge has it in about a minute.** The reply also says whether a
+new version was published, or every file already matched what the site serves.
+
+**Default subdomains are not indexed.** Anything on `*.dropto.live` is served with
+`X-Robots-Tag: noindex`. Attach a custom domain if you want the site in search results.
+
+**Your token only ever reaches the Drop2Run API.** Files are uploaded to a separate storage host that
+needs no credential from us, and none is sent there.
+
+## Environment
+
+| Variable | Effect |
+|---|---|
+| `DROP2RUN_TOKEN` | The personal access token. Takes precedence over the config file |
+| `DROP2RUN_API_URL` | Point at a different API. Defaults to `https://dropto.run/api` |
 
-**A token never reaches the storage host.** The bearer credential goes to the control plane only. The
-file uploads are PUTs to presigned URLs on another host, which need nothing from us — a token attached
-there would be an account credential handed to a service that never asked. There is a test for it,
-because it is the kind of thing a later refactor tidies into a shared header helper.
+## If something is wrong
 
-## What the tarball contains
+**"No Drop2Run access token."** — the server is running but has no token. Run `npx drop2run login`, or
+set `DROP2RUN_TOKEN`. No restart needed.
 
-`bin/` and `dist/` only. `dist/index.js` is a bundle: the publish engine this package shares with the
-`drop2run` CLI is folded in at build time, so nothing in the published files imports a package npm
-cannot fetch.
+**Claude Desktop cannot start it** — Desktop does not inherit your shell's `PATH`. Use the absolute path
+to `npx` (`which npx`) as `command`.
 
-The two real dependencies — the MCP SDK and zod — stay external and are installed by npm. Inlining an
-SDK would mean shipping a copy that never gets a security update.
+Needs Node 20 or newer. MIT licensed.

package/dist/index.js

@@ -595,10 +595,32 @@ async function publish(credentials, source, site) {
 function publishDirectory(credentials, directory, site) {
   return publish(credentials, directorySource(directory), site);
 }
-function publishHtml(credentials, html, site) {
-  const bytes = new TextEncoder().encode(html);
-  return publish(credentials, async () => [{ path: "index.html", bytes }], site);
+function cleanPath(path) {
+  const cleaned = path.trim().replaceAll("\\", "/").replace(/^\.?\//, "");
+  if (cleaned === "" || cleaned.endsWith("/")) {
+    throw new Error(`"${path}" does not name a file.`);
+  }
+  if (cleaned.split("/").includes("..") || /^[a-zA-Z]:/.test(cleaned)) {
+    throw new Error(
+      `"${path}" is not a path inside the site. Give a path relative to the site's root, such as index.html or docs/guide.md.`
+    );
+  }
+  return cleaned;
 }
+async function publishFiles(credentials, files, site) {
+  const encoder = new TextEncoder();
+  const collected = files.map((file) => ({
+    path: cleanPath(file.path),
+    bytes: encoder.encode(file.content)
+  }));
+  const seen = /* @__PURE__ */ new Set();
+  for (const file of collected) {
+    if (seen.has(file.path)) throw new Error(`Two files were given the same path: ${file.path}`);
+    seen.add(file.path);
+  }
+  return publish(credentials, async () => collected, site);
+}
+const SERVER_VERSION = "0.2.0";
 function say(text, isError = false) {
   return { content: [{ type: "text", text }], ...isError ? { isError: true } : {} };
 }
@@ -623,14 +645,19 @@ function describe(result) {
 }
 function createServer() {
   const server = new McpServer(
-    { name: "drop2run", version: "0.0.0" },
+    { name: "drop2run", version: SERVER_VERSION },
     {
       instructions: [
         "Publishes static sites to Drop2Run.",
         "",
-        "Use publish_html for a single page you have written, and publish_dir for a folder that is",
-        "already built. Leave `site` unset to publish to a brand-new site; pass a subdomain to",
-        "publish over an existing one. list_sites shows what already exists.",
+        "Use publish_files for anything you wrote here — a page, a markdown note, several files",
+        "together — and publish_dir for a folder that already exists on disk. Leave `site` unset to",
+        "publish to a brand-new site; pass a subdomain to publish over an existing one. list_sites",
+        "shows what already exists.",
+        "",
+        "A site needs an index.html at its top level, or at least one .md, .markdown or .pdf file,",
+        "which publishes as a documents site and is read through a viewer. So one page goes at",
+        "index.html, and a single note is a whole publish that needs no wrapping in HTML.",
         "",
         "Publishing over an existing site replaces what it serves, so ask before doing that to a",
         "site the person did not name."
@@ -638,16 +665,23 @@ function createServer() {
     }
   );
   server.registerTool(
-    "publish_html",
+    "publish_files",
     {
-      title: "Publish a page",
-      description: "Publishes one HTML page as a whole site and returns its URL. The page becomes index.html.",
+      title: "Publish files you wrote",
+      description: "Publishes one or more files written here — markdown, HTML, CSS, JSON — as a site, and returns its URL. A single page goes at index.html; a single .md, .markdown or .pdf file is a site on its own, served through the documents viewer. Text only: a PDF or an image has to be published from disk with publish_dir.",
       inputSchema: {
-        html: z.string().min(1).describe("The complete HTML document to publish."),
+        files: z.array(
+          z.object({
+            path: z.string().min(1).describe("Path inside the site, such as index.html or docs/guide.md."),
+            content: z.string().describe("The file's contents.")
+          })
+        ).min(1).describe("The files to publish."),
         site: z.string().optional().describe("Subdomain or site id to publish over. Omit to create a new site.")
       }
     },
-    ({ html, site }) => withCredentials(async (credentials) => describe(await publishHtml(credentials, html, site)))
+    ({ files, site }) => withCredentials(
+      async (credentials) => describe(await publishFiles(credentials, files, site))
+    )
   );
   server.registerTool(
     "publish_dir",

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@drop2run/mcp",
-	"version": "0.1.0",
-	"description": "MCP server that publishes a folder or a page to Drop2Run from inside a chat.",
+	"version": "0.2.0",
+	"description": "MCP server that publishes a folder or an HTML page to Drop2Run and returns a live URL.",
 	"license": "MIT",
 	"type": "module",
 	"bin": {