@dropthis/mcp
Advanced tools
+1
-1
| { | ||
| "name": "@dropthis/mcp", | ||
| "version": "0.31.0", | ||
| "version": "0.32.0", | ||
| "description": "Official MCP server for dropthis — publish content and get a permanent URL from any MCP-compatible agent.", | ||
@@ -5,0 +5,0 @@ "license": "MIT", |
+10
-1
@@ -28,3 +28,3 @@ <p align="center"><img src="https://dropthis.app/icon-512.png" width="76" height="76" alt="dropthis" /></p> | ||
| Get an API key from your dropthis account. The server reads `DROPTHIS_API_KEY` (and optional `DROPTHIS_BASE_URL`). Set `DROPTHIS_READ_ONLY=true` to register only the read tools — a safe way to give an agent read access to your drops with no write/delete risk. Claude Desktop users can install the one-click `.mcpb` bundle instead (the API key is stored in your OS keychain). | ||
| Get an API key from your dropthis account. The server reads `DROPTHIS_API_KEY` (and optional `DROPTHIS_BASE_URL`). Set `DROPTHIS_READ_ONLY=true` to register only the read tools — a safe way to give an agent read access to your drops with no write/delete risk. Set `DROPTHIS_TOOLSETS` (e.g. `drops`) to trim the tool surface to what a session needs ([Toolsets](#toolsets-trim-the-tool-surface)). Claude Desktop users can install the one-click `.mcpb` bundle instead (the API key is stored in your OS keychain). | ||
@@ -115,2 +115,11 @@ See [docs/setup.md](docs/setup.md) for per-client instructions (Claude Code, Cursor, Windsurf, VS Code, …). | ||
| ### Toolsets (trim the tool surface) | ||
| All 29 tools load by default, but a publish-and-edit session rarely needs the 17 domains/workspaces/members/invitations tools. Register a subset to cut the per-session tool prose: | ||
| - **Local / stdio:** set `DROPTHIS_TOOLSETS` to a comma list, e.g. `DROPTHIS_TOOLSETS=drops`. | ||
| - **Remote:** append `?toolsets=` to the endpoint (beside `?readonly=`), e.g. `https://mcp.dropthis.app/mcp?toolsets=drops` or `?toolsets=drops,account`. | ||
| Values: `drops` (the core publish/edit/read tools — 11), `domains` (6), `workspaces` (workspaces + members + invitations — 11), and `account` (1). Unset, empty, or all-unrecognized → all toolsets (the default). Unknown tokens are ignored. `?readonly=` and `?toolsets=` compose: each hides tools independently, so `?toolsets=drops&readonly=true` leaves only the drop read tools. The tool list is fixed at connect — restart the stdio server (or reconnect the remote connector) after changing the value. A hosted claude.ai connector has no query-param UI, so set it in the connector URL you add. | ||
| ### Multi-file bundles (`files` input) | ||
@@ -117,0 +126,0 @@ |
Sorry, the diff of this file is too big to display
Sorry, the diff of this file is too big to display
Potential vulnerability
Supply chain riskInitial human review suggests the presence of a vulnerability in this package. It is pending further analysis and confirmation.
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
AI-detected potential code anomaly
Supply chain riskAI has identified unusual behaviors that may pose a security risk.
Found 3 instances
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Potential vulnerability
Supply chain riskInitial human review suggests the presence of a vulnerability in this package. It is pending further analysis and confirmation.
AI-detected potential code anomaly
Supply chain riskAI has identified unusual behaviors that may pose a security risk.
Found 3 instances
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
2033149
1.09%28361
0.47%223
4.21%26
4%