@drop2run/mcp 0.1.0

package/README.md

@@ -0,0 +1,74 @@
+# @drop2run/mcp
+
+An MCP server that publishes to [Drop2Run](https://dropto.run) from inside a chat. Three tools:
+
+| Tool | What it does |
+|---|---|
+| `publish_html` | Takes one HTML document, publishes it as a whole site, returns the URL |
+| `publish_dir` | Takes an absolute folder path and publishes it |
+| `list_sites` | Lists the account's sites, so a publish can go to one of them |
+
+## Getting a token
+
+The server authenticates with a personal access token — there is no browser in a chat, so there is no
+cookie to use. Create one at <https://dropto.run/account/tokens>. It is shown once and stored as a hash,
+so it cannot be recovered afterwards.
+
+Then either put it in the environment:
+
+```
+DROP2RUN_TOKEN=d2r_...
+```
+
+or in `~/.config/drop2run/config.json`:
+
+```json
+{ "token": "d2r_..." }
+```
+
+The environment wins. That file is deliberately the same one the `drop2run` CLI reads, so
+`drop2run login` covers both — and so the two can never disagree about which account is yours.
+
+Point it at a different API with `DROP2RUN_API_URL`, or `apiBaseUrl` in the same file.
+
+## Wiring it up
+
+```json
+{
+	"mcpServers": {
+		"drop2run": {
+			"command": "npx",
+			"args": ["-y", "@drop2run/mcp"]
+		}
+	}
+}
+```
+
+That is the whole configuration — `npx` fetches the package, and there is nothing to install globally.
+
+To run it from a checkout instead, build first, because `dist/` is not in the repository:
+
+```bash
+cd packages/mcp && npm run build
+node bin/drop2run-mcp.mjs
+```
+
+## Two decisions worth knowing about
+
+**Publishing without naming a site creates a new one.** The obvious alternative — reuse the most recent —
+would silently replace whatever the account last published, and a tool a model calls on somebody's
+behalf is the worst place for that default. "Put this online" is not "and overwrite my last site".
+
+**A token never reaches the storage host.** The bearer credential goes to the control plane only. The
+file uploads are PUTs to presigned URLs on another host, which need nothing from us — a token attached
+there would be an account credential handed to a service that never asked. There is a test for it,
+because it is the kind of thing a later refactor tidies into a shared header helper.
+
+## What the tarball contains
+
+`bin/` and `dist/` only. `dist/index.js` is a bundle: the publish engine this package shares with the
+`drop2run` CLI is folded in at build time, so nothing in the published files imports a package npm
+cannot fetch.
+
+The two real dependencies — the MCP SDK and zod — stay external and are installed by npm. Inlining an
+SDK would mean shipping a copy that never gets a security update.

package/bin/drop2run-mcp.mjs

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+/**
+ * Entry point for `npx @drop2run/mcp`.
+ *
+ * Loads the built server. Kept as a separate file with nothing in it because a `bin` has to survive the
+ * build: `files` publishes `bin` and `dist`, and this is the one part of the package whose path an MCP
+ * client's configuration names.
+ */
+import { main } from "../dist/index.js";
+
+main().catch((error) => {
+	// stderr, never stdout: stdout is the MCP transport, and a stray line on it corrupts the protocol
+	// rather than showing up anywhere a person reads.
+	console.error(error instanceof Error ? error.message : error);
+	process.exit(1);
+});

package/dist/index.js

@@ -0,0 +1,688 @@
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, relative, sep } from "node:path";
+import { realpath, readdir, stat, readFile } from "node:fs/promises";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+async function call(credentials, path, init = {}) {
+  const response = await fetch(`${credentials.apiBaseUrl}/${path}`, {
+    ...init,
+    headers: {
+      ...init.headers,
+      Authorization: `Bearer ${credentials.token}`,
+      ...init.body === void 0 ? {} : { "Content-Type": "application/json" }
+    }
+  });
+  if (!response.ok) {
+    const problem = await response.json().catch(() => null);
+    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
+  }
+  return await response.json();
+}
+async function listSites(credentials) {
+  const body = await call(credentials, "sites");
+  return body.sites;
+}
+async function createSite(credentials) {
+  const created = await call(
+    credentials,
+    "sites",
+    { method: "POST", body: JSON.stringify({}) }
+  );
+  return { ...created, name: null };
+}
+const TOKEN_VARIABLE = "DROP2RUN_TOKEN";
+function configPath() {
+  return join(homedir(), ".config", "drop2run", "config.json");
+}
+const DEFAULT_API_BASE_URL = "https://dropto.run/api";
+function loadCredentials(env = process.env, read = (path) => readFileSync(path, "utf8")) {
+  let stored = {};
+  try {
+    stored = JSON.parse(read(configPath()));
+  } catch {
+  }
+  const token = env[TOKEN_VARIABLE]?.trim() || stored.token?.trim();
+  if (!token) return null;
+  return {
+    token,
+    apiBaseUrl: env.DROP2RUN_API_URL?.trim() || stored.apiBaseUrl?.trim() || DEFAULT_API_BASE_URL
+  };
+}
+function missingCredentialsMessage() {
+  return [
+    "No Drop2Run access token.",
+    "",
+    "Run `drop2run login` to sign in through a browser, which stores one for you.",
+    "",
+    "For CI, or where no browser can be opened, create a token at",
+    "https://dropto.run/account/tokens and either:",
+    `  - set ${TOKEN_VARIABLE} in the environment, or`,
+    `  - put it in ${configPath()} as {"token": "d2r_..."}`,
+    "",
+    "The token is shown once when it is created and cannot be recovered afterwards."
+  ].join("\n");
+}
+class DeployError extends Error {
+  /**
+   * @param code Stable code, either an API error type (`quota_exceeded`, `unsafe_path`, …) or one of
+   *   the client-side codes in {@link ClientErrorCode}.
+   * @param message Text safe to show the user.
+   * @param detail Anything extra worth logging, such as the RFC 9457 body from the API.
+   */
+  constructor(code, message, detail) {
+    super(message);
+    this.code = code;
+    this.detail = detail;
+    this.name = "DeployError";
+  }
+}
+const ClientErrorCode = {
+  /** The drop held no files once junk was filtered out. */
+  Empty: "empty_drop",
+  /** No `index.html` at the root of the drop. */
+  MissingIndex: "missing_index",
+  /** The drop is larger than the plan allows; the server enforces this too. */
+  TooLarge: "too_large",
+  /** A single file is larger than the plan allows. */
+  FileTooLarge: "file_too_large",
+  /** More files than the plan allows. */
+  TooManyFiles: "too_many_files",
+  /**
+   * A zip claims to expand to more than the plan allows.
+   *
+   * Distinct from {@link TooLarge}, which is about a drop whose files have already been read. This one
+   * is raised from the archive's own directory before anything is decompressed, so the numbers in it
+   * are what the zip declared rather than what was measured.
+   */
+  ZipTooLarge: "zip_too_large",
+  /** The user cancelled. */
+  Cancelled: "cancelled",
+  /** An upload kept failing after every retry. */
+  UploadFailed: "upload_failed"
+};
+const CLAIM_TOKEN_HEADER = "X-Claim-Token";
+async function prepareDeploy(siteId, files, options, signal) {
+  const manifest = files.map((file) => ({
+    path: file.path,
+    sha256: file.sha256,
+    size: file.bytes.length
+  }));
+  const prepared = await request(
+    `sites/${encodeURIComponent(siteId)}/deploys/prepare`,
+    { files: manifest },
+    options
+  );
+  return { ...prepared, uploadUrl: absolute(prepared.uploadUrl, options.baseUrl) };
+}
+function absolute(uploadUrl, baseUrl) {
+  if (/^[a-z][a-z0-9+.-]*:/i.test(uploadUrl)) return uploadUrl;
+  if (baseUrl === void 0 || !/^[a-z][a-z0-9+.-]*:/i.test(baseUrl)) return uploadUrl;
+  return new URL(uploadUrl, baseUrl).toString();
+}
+async function completeDeploy(siteId, deployId, options, signal, name) {
+  return request(
+    `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/complete`,
+    // A bodyless POST when there is no name to send, which is what this call has always been. The
+    // server treats an absent body and an absent field identically, so nothing depends on which of
+    // the two a client picks.
+    name === null || name === void 0 ? void 0 : { name },
+    options
+  );
+}
+async function request(path, body, options, signal) {
+  const doFetch = options.fetch ?? globalFetch$1();
+  const base = options.baseUrl ?? "/api";
+  const headers = {};
+  if (body !== void 0) headers["Content-Type"] = "application/json";
+  if (options.claimToken) headers[CLAIM_TOKEN_HEADER] = options.claimToken;
+  if (options.token) headers.Authorization = `Bearer ${options.token}`;
+  const response = await doFetch(`${base}/${path}`, {
+    method: "POST",
+    headers,
+    ...body === void 0 ? {} : { body: JSON.stringify(body) },
+    ...{}
+  });
+  if (!response.ok) throw await problemToError(response);
+  return await response.json();
+}
+function globalFetch$1() {
+  return globalThis.fetch.bind(globalThis);
+}
+async function problemToError(response) {
+  let problem = {};
+  try {
+    problem = await response.json();
+  } catch {
+    return new DeployError(
+      `http_${response.status}`,
+      `The server responded with ${response.status}.`
+    );
+  }
+  const code = typeof problem.type === "string" ? problem.type : `http_${response.status}`;
+  const message = typeof problem.detail === "string" ? problem.detail : typeof problem.title === "string" ? problem.title : `The server responded with ${response.status}.`;
+  return new DeployError(code, message, problem);
+}
+async function sha256Hex(bytes) {
+  const digest = await crypto.subtle.digest("SHA-256", bytes.slice().buffer);
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function hashAll(files, onProgress, signal) {
+  const hashed = [];
+  for (const [index, file] of files.entries()) {
+    hashed.push({ ...file, sha256: await sha256Hex(file.bytes) });
+    onProgress?.(index + 1, files.length);
+  }
+  return hashed;
+}
+const IGNORED_EXACT = /* @__PURE__ */ new Set([".DS_Store", "Thumbs.db", "desktop.ini", ".gitignore", ".gitkeep"]);
+const IGNORED_DIRECTORIES = [
+  "__MACOSX",
+  ".git",
+  "node_modules",
+  ".svn",
+  ".hg",
+  ".idea",
+  ".vscode",
+  ".claude"
+];
+function shouldIgnore(path) {
+  const segments = path.split("/");
+  const name = segments.at(-1) ?? "";
+  if (name === "" || IGNORED_EXACT.has(name)) return true;
+  if (name.startsWith("._")) return true;
+  return segments.some((segment) => IGNORED_DIRECTORIES.includes(segment));
+}
+const REQUIRED_INDEX = "index.html";
+const DOCUMENT_EXTENSIONS = [".md", ".markdown", ".pdf"];
+function isDocumentPath(path) {
+  const lower = path.toLowerCase();
+  return DOCUMENT_EXTENSIONS.some((extension) => lower.endsWith(extension));
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+  return `${(bytes / (1024 * 1024 * 1024)).toFixed(1)} GB`;
+}
+function checkLimits(files, limits) {
+  if (files.length === 0) {
+    throw new DeployError(
+      ClientErrorCode.Empty,
+      "That drop contained no files to deploy. Folders like .git and node_modules are skipped."
+    );
+  }
+  const hasIndex = files.some((file) => file.path === REQUIRED_INDEX);
+  if (!hasIndex && !files.some((file) => isDocumentPath(file.path))) {
+    throw new DeployError(
+      ClientErrorCode.MissingIndex,
+      `A site needs an ${REQUIRED_INDEX} at its top level, or at least one .md or .pdf file to publish as a documents site. Drop the folder that contains it, not the folder above.`
+    );
+  }
+  if (!limits) return;
+  if (files.length > limits.maxFiles) {
+    throw new DeployError(
+      ClientErrorCode.TooManyFiles,
+      `That is ${files.length} files, and this plan allows ${limits.maxFiles}.`,
+      { limit: limits.maxFiles, actual: files.length }
+    );
+  }
+  const oversized = files.find(
+    (file) => file.bytes.length > limits.maxFileBytes
+  );
+  if (oversized) {
+    throw new DeployError(
+      ClientErrorCode.FileTooLarge,
+      `${oversized.path} is ${formatBytes(oversized.bytes.length)}, and this plan allows ${formatBytes(limits.maxFileBytes)} per file.`,
+      {
+        path: oversized.path,
+        limit: limits.maxFileBytes,
+        actual: oversized.bytes.length
+      }
+    );
+  }
+  const total = totalBytes(files);
+  if (limits.maxSiteBytes !== null && total > limits.maxSiteBytes) {
+    throw new DeployError(
+      ClientErrorCode.TooLarge,
+      `That drop is ${formatBytes(total)}, and this plan allows ${formatBytes(limits.maxSiteBytes)}.`,
+      { limit: limits.maxSiteBytes, actual: total }
+    );
+  }
+}
+function totalBytes(files) {
+  return files.reduce((sum, file) => sum + file.bytes.length, 0);
+}
+const MAX_NAME_LENGTH = 60;
+const HEAD_BYTES = 64 * 1024;
+const TITLE_SEPARATORS = ["|", "·", "—", "–", " - "];
+function suggestSiteName(files) {
+  const index = files.find((file) => file.path === "index.html");
+  if (index === void 0) return null;
+  try {
+    return nameFromHtml(decodeHead(index.bytes));
+  } catch {
+    return null;
+  }
+}
+function decodeHead(bytes) {
+  return new TextDecoder("utf-8", { fatal: false }).decode(
+    bytes.subarray(0, HEAD_BYTES)
+  );
+}
+function nameFromHtml(html) {
+  const document = parse(html);
+  const candidates = document ? [
+    document.querySelector('meta[property="og:site_name"]')?.getAttribute("content"),
+    document.querySelector("title")?.textContent,
+    document.querySelector("h1")?.textContent
+  ] : [matchOgSiteName(html), matchTag(html, "title"), matchTag(html, "h1")];
+  for (const candidate of candidates) {
+    const name = clean(candidate);
+    if (name !== null) return name;
+  }
+  return null;
+}
+function parse(html) {
+  const parser = globalThis.DOMParser;
+  if (parser === void 0) return null;
+  try {
+    return new parser().parseFromString(html, "text/html");
+  } catch {
+    return null;
+  }
+}
+function matchTag(html, tag) {
+  const match = new RegExp(`<${tag}[^>]*>([\\s\\S]*?)</${tag}\\s*>`, "i").exec(
+    html
+  );
+  return match?.[1] ?? null;
+}
+function matchOgSiteName(html) {
+  const patterns = [
+    /<meta[^>]*property\s*=\s*["']og:site_name["'][^>]*content\s*=\s*["']([^"']*)["']/i,
+    /<meta[^>]*content\s*=\s*["']([^"']*)["'][^>]*property\s*=\s*["']og:site_name["']/i
+  ];
+  for (const pattern of patterns) {
+    const match = pattern.exec(html);
+    if (match?.[1] !== void 0) return match[1];
+  }
+  return null;
+}
+const INVISIBLE = new RegExp(
+  `[${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}-${String.fromCharCode(159)}${String.fromCharCode(8203)}-${String.fromCharCode(8207)}${String.fromCharCode(8232)}-${String.fromCharCode(8238)}${String.fromCharCode(8288)}-${String.fromCharCode(8292)}${String.fromCharCode(8294)}-${String.fromCharCode(8303)}${String.fromCharCode(65279)}]`,
+  "g"
+);
+function clean(raw) {
+  if (raw === null || raw === void 0) return null;
+  if (raw.includes("<") || raw.includes(">")) return null;
+  const collapsed = raw.replace(INVISIBLE, " ").replace(/\s+/g, " ").trim();
+  const name = trimSuffix(collapsed);
+  if (name.length === 0) return null;
+  if (PLACEHOLDERS.has(name.toLowerCase())) return null;
+  return name.length > MAX_NAME_LENGTH ? name.slice(0, MAX_NAME_LENGTH).trimEnd() : name;
+}
+const PLACEHOLDERS = /* @__PURE__ */ new Set([
+  "document",
+  "untitled",
+  "untitled document",
+  "index",
+  "home",
+  "new page",
+  "my site",
+  "vite app",
+  "vite + react",
+  "react app",
+  "create next app",
+  "svelte app",
+  "webpack app",
+  "hello world",
+  "title"
+]);
+function trimSuffix(title) {
+  for (const separator of TITLE_SEPARATORS) {
+    const at = title.lastIndexOf(separator);
+    if (at <= 0) continue;
+    const before = title.slice(0, at).trim();
+    const after = title.slice(at + separator.length).trim();
+    if (before.length > 0 && after.length > 0) return after;
+  }
+  return title;
+}
+const DEFAULT_CONCURRENCY = 8;
+const DEFAULT_RETRIES = 3;
+const BACKOFF_MS = [1e3, 2e3, 4e3];
+async function uploadAll(targets, uploadUrl, files, onProgress, signal, deps = {}) {
+  const doFetch = deps.fetch ?? globalFetch();
+  const delay = deps.delay ?? defaultDelay;
+  const concurrency = deps.concurrency ?? DEFAULT_CONCURRENCY;
+  const retries = deps.retries ?? DEFAULT_RETRIES;
+  const byPath = new Map(files.map((file) => [file.path, file]));
+  let nextIndex = 0;
+  let done = 0;
+  let uploadedBytes = 0;
+  const worker = async () => {
+    for (; ; ) {
+      const index = nextIndex++;
+      const target = targets[index];
+      if (target === void 0) return;
+      const file = byPath.get(target.path);
+      if (file === void 0) {
+        throw new DeployError(
+          ClientErrorCode.UploadFailed,
+          `The server asked for ${target.path}, which is not in the manifest.`,
+          { path: target.path }
+        );
+      }
+      await uploadOne(target, file, {
+        doFetch,
+        delay,
+        retries,
+        signal,
+        uploadUrl
+      });
+      done += 1;
+      uploadedBytes += file.bytes.length;
+      onProgress?.(done, targets.length, uploadedBytes);
+    }
+  };
+  const workers = Array.from(
+    { length: Math.min(concurrency, targets.length) },
+    worker
+  );
+  try {
+    await Promise.all(workers);
+  } catch (error) {
+    throw asDeployError(error);
+  }
+}
+async function uploadOne(target, file, context) {
+  let lastError;
+  for (let attempt = 0; attempt <= context.retries; attempt++) {
+    context.signal?.throwIfAborted();
+    if (attempt > 0) {
+      await context.delay(BACKOFF_MS[attempt - 1] ?? BACKOFF_MS.at(-1) ?? 1e3);
+      context.signal?.throwIfAborted();
+    }
+    try {
+      const response = await context.doFetch(context.uploadUrl, {
+        method: "PUT",
+        body: new Blob([file.bytes.slice().buffer]),
+        // The permit is the whole request. `Content-Length` is required by the Worker and cannot
+        // be set here — it is a forbidden header name — but the browser derives it from the body,
+        // which is exactly the length the token names.
+        headers: { Authorization: `Bearer ${target.token}` },
+        ...context.signal ? { signal: context.signal } : {}
+      });
+      if (response.ok) return;
+      if (response.status === 401 || response.status === 403 || response.status === 429) {
+        throw new DeployError(
+          ClientErrorCode.UploadFailed,
+          `Upload of ${target.path} was refused. The upload window may have expired — try deploying again.`,
+          { path: target.path, status: response.status }
+        );
+      }
+      lastError = new Error(`HTTP ${response.status}`);
+    } catch (error) {
+      if (error instanceof DeployError) throw error;
+      if (isAbort(error)) throw cancelled();
+      lastError = error;
+    }
+  }
+  throw new DeployError(
+    ClientErrorCode.UploadFailed,
+    `Could not upload ${target.path} after ${context.retries + 1} attempts.`,
+    { path: target.path, cause: String(lastError) }
+  );
+}
+function globalFetch() {
+  return globalThis.fetch.bind(globalThis);
+}
+function defaultDelay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function isAbort(error) {
+  return error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
+}
+function cancelled() {
+  return new DeployError(ClientErrorCode.Cancelled, "Deploy cancelled.");
+}
+function asDeployError(error) {
+  if (error instanceof DeployError) return error;
+  if (isAbort(error)) return cancelled();
+  return new DeployError(
+    ClientErrorCode.UploadFailed,
+    error instanceof Error ? error.message : "Upload failed.",
+    error
+  );
+}
+async function deploy(source, siteId, onProgress, signal, options = {}) {
+  try {
+    const files = await source(signal);
+    onProgress({ type: "collecting", files: files.length });
+    const hashed = await hashAll(
+      files,
+      (done, total) => onProgress({ type: "hashing", done, total }),
+      signal
+    );
+    checkLimits(hashed, options.limits ?? null);
+    onProgress({ type: "preparing" });
+    const prepared = await prepareDeploy(siteId, hashed, options, signal);
+    if (prepared.unchanged) {
+      onProgress({ type: "unchanged", url: prepared.url ?? "" });
+      return;
+    }
+    await uploadAll(
+      prepared.upload,
+      prepared.uploadUrl,
+      hashed,
+      (done, _total, bytes) => onProgress({
+        type: "uploading",
+        done: prepared.reused + done,
+        total: prepared.total,
+        bytes,
+        reused: prepared.reused
+      }),
+      signal,
+      options.upload
+    );
+    onProgress({ type: "completing", reused: prepared.reused });
+    const completed = await completeDeploy(
+      siteId,
+      prepared.deployId,
+      options,
+      signal,
+      suggestSiteName(files)
+    );
+    onProgress({ type: "done", url: completed.url, name: completed.name });
+  } catch (error) {
+    const failure = asDeployError(error);
+    onProgress({
+      type: "error",
+      code: failure.code,
+      message: failure.message,
+      ...failure.detail === void 0 ? {} : { detail: failure.detail }
+    });
+    throw failure;
+  }
+}
+const MAX_FILES = 2e4;
+function directorySource(root) {
+  return async () => {
+    const base = await realpath(root);
+    const files = [];
+    await walk(base, base, files);
+    return files;
+  };
+}
+async function walk(root, directory, into) {
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    const full = join(directory, entry.name);
+    const path = relative(root, full).split(sep).join("/");
+    if (shouldIgnore(path)) continue;
+    if (entry.isSymbolicLink()) {
+      const target = await realpath(full).catch(() => null);
+      if (target === null || escapesRoot(root, target)) continue;
+      const targeted = await stat(target);
+      if (targeted.isDirectory()) {
+        await walk(root, target, into);
+        continue;
+      }
+      if (!targeted.isFile()) continue;
+    } else if (entry.isDirectory()) {
+      await walk(root, full, into);
+      continue;
+    } else if (!entry.isFile()) {
+      continue;
+    }
+    if (into.length >= MAX_FILES) {
+      throw new Error(
+        `This folder holds more than ${MAX_FILES.toLocaleString()} files. Publish a build output directory rather than a whole project.`
+      );
+    }
+    into.push({ path, bytes: new Uint8Array(await readFile(full)) });
+  }
+}
+function escapesRoot(root, candidate) {
+  const inside = relative(root, candidate);
+  return inside === "" || inside.startsWith("..");
+}
+async function resolveSite(credentials, site) {
+  if (site === void 0) return await createSite(credentials);
+  const wanted = site.trim().toLowerCase();
+  const found = (await listSites(credentials)).find(
+    (candidate) => candidate.siteId.toLowerCase() === wanted || candidate.subdomain.toLowerCase() === wanted
+  );
+  if (found === void 0) {
+    throw new Error(
+      `No site of yours is called "${site}". Leave the site out to publish to a new one, or use list_sites to see what exists.`
+    );
+  }
+  return found;
+}
+async function publish(credentials, source, site) {
+  const target = await resolveSite(credentials, site);
+  let files = 0;
+  let url = target.url;
+  let unchanged = false;
+  let failure = null;
+  let failureDetail;
+  const record = (event) => {
+    if (event.type === "collecting") files = event.files;
+    if (event.type === "unchanged") {
+      unchanged = true;
+      url = event.url || target.url;
+    }
+    if (event.type === "done") url = event.url;
+    if (event.type === "error") {
+      failure = event.message;
+      failureDetail = event.detail;
+    }
+  };
+  await deploy(source, target.siteId, record, void 0, {
+    baseUrl: credentials.apiBaseUrl,
+    token: credentials.token
+  }).catch((error) => {
+    const thrown = new Error(
+      failure ?? (error instanceof Error ? error.message : String(error))
+    );
+    thrown.detail = failureDetail ?? error?.detail;
+    throw thrown;
+  });
+  return { url, siteId: target.siteId, subdomain: target.subdomain, files, unchanged };
+}
+function publishDirectory(credentials, directory, site) {
+  return publish(credentials, directorySource(directory), site);
+}
+function publishHtml(credentials, html, site) {
+  const bytes = new TextEncoder().encode(html);
+  return publish(credentials, async () => [{ path: "index.html", bytes }], site);
+}
+function say(text, isError = false) {
+  return { content: [{ type: "text", text }], ...isError ? { isError: true } : {} };
+}
+async function withCredentials(work) {
+  const credentials = loadCredentials();
+  if (credentials === null) return say(missingCredentialsMessage(), true);
+  try {
+    return say(await work(credentials));
+  } catch (error) {
+    return say(error instanceof Error ? error.message : String(error), true);
+  }
+}
+function describe(result) {
+  const what = result.unchanged ? "Already live — every file matched what the site already serves, so no new version was published." : `Published ${result.files.toLocaleString()} ${result.files === 1 ? "file" : "files"}.`;
+  return [
+    what,
+    "",
+    result.url,
+    "",
+    `Site ${result.subdomain} (${result.siteId}). Reaching every edge takes up to about a minute.`
+  ].join("\n");
+}
+function createServer() {
+  const server = new McpServer(
+    { name: "drop2run", version: "0.0.0" },
+    {
+      instructions: [
+        "Publishes static sites to Drop2Run.",
+        "",
+        "Use publish_html for a single page you have written, and publish_dir for a folder that is",
+        "already built. Leave `site` unset to publish to a brand-new site; pass a subdomain to",
+        "publish over an existing one. list_sites shows what already exists.",
+        "",
+        "Publishing over an existing site replaces what it serves, so ask before doing that to a",
+        "site the person did not name."
+      ].join("\n")
+    }
+  );
+  server.registerTool(
+    "publish_html",
+    {
+      title: "Publish a page",
+      description: "Publishes one HTML page as a whole site and returns its URL. The page becomes index.html.",
+      inputSchema: {
+        html: z.string().min(1).describe("The complete HTML document to publish."),
+        site: z.string().optional().describe("Subdomain or site id to publish over. Omit to create a new site.")
+      }
+    },
+    ({ html, site }) => withCredentials(async (credentials) => describe(await publishHtml(credentials, html, site)))
+  );
+  server.registerTool(
+    "publish_dir",
+    {
+      title: "Publish a folder",
+      description: "Publishes a folder of static files and returns its URL. The folder needs an index.html at its root, or .md and .pdf files, which are served through the reader.",
+      inputSchema: {
+        path: z.string().min(1).describe("Absolute path of the folder to publish."),
+        site: z.string().optional().describe("Subdomain or site id to publish over. Omit to create a new site.")
+      }
+    },
+    ({ path, site }) => withCredentials(
+      async (credentials) => describe(await publishDirectory(credentials, path, site))
+    )
+  );
+  server.registerTool(
+    "list_sites",
+    {
+      title: "List sites",
+      description: "Lists the sites on this account, so a publish can go to one of them.",
+      inputSchema: {}
+    },
+    () => withCredentials(async (credentials) => {
+      const sites = await listSites(credentials);
+      if (sites.length === 0) {
+        return "No sites on this account yet. Publishing without a `site` creates one.";
+      }
+      return sites.map((site) => `${site.subdomain} — ${site.url}${site.name ? ` — ${site.name}` : ""}`).join("\n");
+    })
+  );
+  return server;
+}
+async function main() {
+  await createServer().connect(new StdioServerTransport());
+}
+export {
+  main
+};

package/package.json

@@ -0,0 +1,50 @@
+{
+	"name": "@drop2run/mcp",
+	"version": "0.1.0",
+	"description": "MCP server that publishes a folder or a page to Drop2Run from inside a chat.",
+	"license": "MIT",
+	"type": "module",
+	"bin": {
+		"drop2run-mcp": "bin/drop2run-mcp.mjs"
+	},
+	"files": [
+		"bin",
+		"dist"
+	],
+	"engines": {
+		"node": ">=20"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"homepage": "https://dropto.run",
+	"keywords": [
+		"mcp",
+		"ai",
+		"claude",
+		"agent",
+		"llm",
+		"static-site",
+		"deploy",
+		"hosting"
+	],
+	"scripts": {
+		"prepublishOnly": "npm run build && npm test",
+		"typecheck": "tsc --noEmit",
+		"test": "vitest run",
+		"lint": "biome check .",
+		"format": "biome check --write .",
+		"build": "vite build"
+	},
+	"dependencies": {
+		"@modelcontextprotocol/sdk": "^1.30.0",
+		"zod": "^4.1.12"
+	},
+	"devDependencies": {
+		"@biomejs/biome": "^2.5.11",
+		"@types/node": "^26.4.0",
+		"typescript": "^5.9.3",
+		"vitest": "^4.1.11",
+		"vite": "^7.2.1"
+	}
+}