--- name: agentdrop description: >- Publish and update static sites (Markdown or HTML) by calling the AgentDrop HTTP API. Use whenever the user asks to host, publish, share, or deploy a page, doc, report, landing page, or HTML/Markdown site and get back a URL. --- # AgentDrop Deploy a static site (Markdown or HTML) with one HTTP call and get back a real-time, undoable URL. No SDK, no API key, no account required. **API base:** `https://api.agent-drop.co` ## How to deploy — it is just an HTTP call (there is NO CLI) AgentDrop is **only an HTTP API**. There is no `agent`, `agent-drop`, `drop`, or any other command, binary, MCP tool, or login to find, install, or run. **Do not search the machine for a deploy command and do not run one.** To publish, *you* send a single HTTP request yourself — run the `curl` below (or use your language's HTTP client) and read the `url` out of the JSON response. That is the entire deploy. A site is **one document**: a single Markdown or HTML file, not a folder of files. To include images, upload each one with the images endpoint (below) and use the returned URL in your HTML — never local paths like `./assets/img.png`. Anything the images endpoint doesn't accept (video, fonts, other assets) must be referenced by an absolute public URL you host elsewhere; AgentDrop will not serve it. ## If you speak MCP instead There is a stateless MCP server at `https://api.agent-drop.co/mcp` (Streamable HTTP, revision 2026-07-28: no session, no SSE stream, POST only). Add it to your client config and use the tools `deploy_site`, `update_site`, `undo_site`, `redo_site`, `get_site`, and `delete_site` instead of the curl calls below. Older clients that still send `initialize` are answered too. The endpoint requires authorization. An unauthenticated call answers `401` with a `WWW-Authenticate` header pointing at the OAuth metadata, so a client that speaks MCP authorization registers itself and opens a browser automatically. The person is then offered two ways through: connect an account, or continue without one. Authorization is always required, but an account is not: the consent screen offers two choices, and "continue without an account" still issues a real token. There are no long-lived API keys to paste anywhere. Connect the harness you are running in: ```bash claude mcp add --transport http agentdrop https://api.agent-drop.co/mcp # Claude Code codex mcp add agentdrop --url https://api.agent-drop.co/mcp # Codex gemini mcp add --transport http agentdrop https://api.agent-drop.co/mcp # Gemini CLI code --add-mcp '{"name":"agentdrop","type":"http","url":"https://api.agent-drop.co/mcp"}' # VS Code ``` Cursor (`~/.cursor/mcp.json`) and anything else that edits JSON: ```json { "mcpServers": { "agentdrop": { "url": "https://api.agent-drop.co/mcp" } } } ``` ## Publishing as an account Anonymous deploys are rate limited fairly tightly and the pages they make are temporary. Connect over OAuth at `https://api.agent-drop.co/mcp` and the pages become owned by that account: kept for 90 days instead of 30, private unless you ask for public, a far higher create limit, and visible on the person's dashboard. There is no API key to paste anywhere. A person who declines the account option still gets a working connection; they can claim any page afterwards from its manage link to move it onto an account. ## Private by default — ask before publishing publicly Every page takes a `visibility` of `"private"`, `"unlisted"`, or `"public"`. Omit it unless the user asked. An anonymous deploy becomes `"unlisted"` so the returned URL opens. A signed-in deploy becomes `"private"`. Send `"public"` only after the user has said the page may be world-readable. - `"unlisted"` — anyone holding the link can read it. It is never listed to a team. This is the default for anonymous deploys so the URL you hand back works. - `"private"` — the page opens only for the signed-in owner, or for a caller presenting the edit token. Anyone else with the link gets a not-found page. - `"public"` — anyone holding the link can read it, and a team can list it. An anonymous page opens from the link until someone claims it. Tell the user to open the `manageUrl` and claim it. That ties the page to their account. An unlisted page becomes private so it opens for them alone. An update never changes visibility. Change who can read a page from its manage screen after you claim it. ## Security — read first NEVER put secrets in site content: no API keys, tokens, passwords, private keys, `.env` values, connection strings, or internal URLs. A private page still lives on a host. AgentDrop also rejects obvious credentials, but you are the first line of defense. ## Deploy a site ```bash curl -X POST https://api.agent-drop.co/api/v1/sites \ -H "Content-Type: application/json" \ -d '{ "kind": "markdown", "visibility": "private", "title": "Optional title", "content": "# Hello\n\nMarkdown or a full HTML document." }' ``` `kind` is `"markdown"` or `"html"`. `visibility` is optional. `title` is optional, and the body is plain JSON: do not put comments inside it. Response: ```json { "slug": "3f9a8c1e-7b2d-4c6a-9e1f-2a8b7c6d5e4f", "url": "https://app.example/3f9a8c1e-7b2d-4c6a-9e1f-2a8b7c6d5e4f", // share this with the user "manageUrl": "https://app.example/manage/3f9a8c1e-7b2d-4c6a-9e1f-2a8b7c6d5e4f?t=SECRET", "editToken": "SECRET", // SAVE THIS "kind": "markdown", "expiresAt": 1730000000000 } ``` Each deploy is assigned a random unguessable URL automatically — you don't choose it. **Persist the `editToken` and `slug`** (e.g. in your working notes). You need the token to update, undo, or delete the site later. Give the user the `url` and the `manageUrl` (the manage page lets them sign in to keep the site for 90 days). ## Update content (replaces the current version, keeps history) ```bash curl -X PUT https://api.agent-drop.co/api/v1/sites/ \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{ "kind": "markdown", "content": "# Updated" }' ``` Prefer **update / undo over re-creating** a site — the URL stays stable and viewers see changes in real time. ## Undo / redo ```bash curl -X POST https://api.agent-drop.co/api/v1/sites//undo -H "Authorization: Bearer " curl -X POST https://api.agent-drop.co/api/v1/sites//redo -H "Authorization: Bearer " ``` Use these to revert a bad edit instead of resending the whole site. Returns the new `{ canUndo, canRedo, version, versions }`. ## Status & raw content A public or unlisted page answers without a token. A private or team page looks gone unless you send the edit token. ```bash curl https://api.agent-drop.co/api/v1/sites/ curl -H "Authorization: Bearer " https://api.agent-drop.co/api/v1/sites/ curl -H "Authorization: Bearer " https://api.agent-drop.co/api/v1/sites//raw ``` ## Images (optional) Upload an image, then embed the returned `url` in your Markdown/HTML. ```bash curl -X POST https://api.agent-drop.co/api/v1/sites//images \ -H "Authorization: Bearer " \ -H "Content-Type: image/png" \ --data-binary @diagram.png # → { "url": "https://api.agent-drop.co/api/v1/assets/" } ``` Limits: ≤ 5 MB/image, ≤ 10 images/site. **Images always expire after 7 days.** ## Delete ```bash curl -X DELETE https://api.agent-drop.co/api/v1/sites/ -H "Authorization: Bearer " ``` ## Retention - Anonymous sites: kept **30 days** from the last update. - Claimed sites (user signs in on the manage page): **90 days**. - Images: **7 days**, always. ## Limits - Content: ≤ 1 MB per site. `kind` must be `markdown` or `html`. - Errors return JSON `{ "error": "..." }` with a 4xx/5xx status; rate limits return 429.