For agents

Connect the MCP server

DropFast runs a hosted MCP server. Point any client that speaks remote MCP at it and every DropFast tool — publish_html, update_site, query_sites, get_comments, resolve_comment, and the rest — shows up in that client.

The endpoint:

https://dropfast.dev/api/mcp

• Transport: Streamable HTTP. Stateless — no session to establish, plain JSON responses.
• Auth: an Authorization: Bearer df_sk_... header on every request. There is no OAuth — the credential is a DropFast API key. Generate one at dashboard/api-keys; it looks like df_sk_.... The legacy x-api-key: df_sk_... header is also accepted.
• Unauthenticated requests get 401 + a WWW-Authenticate: Bearer header. If your client sees a 401, the key is missing, malformed, or revoked.

Because DropFast authenticates with a static header and not OAuth, the one thing every client below has in common is: skip any sign-in / "authorize" flow the client offers, and configure the Authorization header yourself.

Claude (web, desktop, mobile) — custom connector

Add DropFast as a custom connector.

1. Settings → Connectors → "Add custom connector". On the Free plan you can have one custom connector at a time. On Team/Enterprise, an org owner adds it in the organization's settings so it's available to the workspace.
2. Set the URL to https://dropfast.dev/api/mcp.
3. DropFast doesn't use OAuth, so decline / skip any sign-in step the connector flow presents.
4. Open the connector's "Request headers" section (this is an Anthropic beta) and add one header:
   • Name: Authorization
   • Value: Bearer df_sk_... — with the literal Bearer prefix and the space. Claude does not add the Bearer prefix for you; the header value must contain it verbatim.

That's it — the DropFast tools appear in the connector's tool list.

If the connector won't connect after you set the header: request-headers is a beta and has known client-side flakiness. Remove the connector and add it again (re-entering the header). If it still won't attach, use Claude Code or an IDE client below — those paths are reliable.

Anthropic's walkthrough: Get started with custom connectors using remote MCP.

Claude Code

One command — note that the options come before the server name:

claude mcp add --transport http dropfast https://dropfast.dev/api/mcp \
  --header "Authorization: Bearer df_sk_..."

Then verify in a session by running /mcp — DropFast should list as connected with its tools available.

ChatGPT (Developer mode)

Remote MCP in ChatGPT runs through Developer mode, on the web client (Pro, Plus, Business, Enterprise, and Edu plans).

1. Settings → enable Developer mode.
2. Add an app / connector and set the server URL to https://dropfast.dev/api/mcp.
3. Auth: there's no OAuth — configure the Authorization header as a static credential (Bearer df_sk_...).

Developer mode gives full tool support, including the write tools (publish_html, update_site, …). ChatGPT prompts you to confirm before it runs a write tool.

Cursor

Add DropFast to ~/.cursor/mcp.json (global) or a project-scoped .cursor/mcp.json:

{
  "mcpServers": {
    "dropfast": {
      "url": "https://dropfast.dev/api/mcp",
      "headers": { "Authorization": "Bearer df_sk_..." }
    }
  }
}

VS Code (Copilot)

Add DropFast to .vscode/mcp.json. Use an inputs prompt so the key isn't committed — VS Code asks for it once and stores it securely:

{
  "inputs": [
    {
      "id": "dropfast-key",
      "type": "promptString",
      "description": "DropFast API key (df_sk_...)",
      "password": true
    }
  ],
  "servers": {
    "dropfast": {
      "type": "http",
      "url": "https://dropfast.dev/api/mcp",
      "headers": { "Authorization": "Bearer ${input:dropfast-key}" }
    }
  }
}

Windsurf

Add DropFast to ~/.codeium/windsurf/mcp_config.json — Windsurf uses serverUrl (not url) for a remote server:

{
  "mcpServers": {
    "dropfast": {
      "serverUrl": "https://dropfast.dev/api/mcp",
      "headers": { "Authorization": "Bearer df_sk_..." }
    }
  }
}

The tools

The server exposes the full DropFast surface as MCP tools — publish, update, search/recall, versioning, metadata, comments, and aliases. Each tool maps to a REST endpoint; the REST API reference documents both side by side, and machine-readable schemas live at /.well-known/tool-schemas.json (Anthropic, OpenAI, and Gemini shapes). There is no MCP bulk tool — bulk changes go through REST POST /api/v1/sites/bulk or the CLI's dropfast bulk.

Discovery endpoints

• Registry manifest: https://dropfast.dev/.well-known/mcp.json — the io.dropfast/dropfast-namespaced server manifest.
• Status + versions + discovery map: https://dropfast.dev/api/status — public, unauthenticated; returns live versions plus links to the spec, llms.txt, docs, MCP endpoint, tool schemas, and API keys. Start here.

Troubleshooting

• 401 Unauthorized — the API key is missing, malformed, or revoked. Check the header is exactly Authorization: Bearer df_sk_... (literal Bearer + space), then confirm the key still exists — regenerate it at dashboard/api-keys if in doubt.

• Claude connector "fails to connect" — the request header isn't set, or you're hitting the request-headers beta flakiness. Re-check the Authorization header value, then remove + re-add the connector. Claude Code and the IDE clients above are reliable fallbacks.

• Never put the API key in the URL. Query-string credentials get logged by proxies and servers. The key belongs in the Authorization header, always.

• Rate limits: write tools are limited to 10 requests/min, reads to 60 requests/min. The budgets are per user, not per key — every API key on your account draws from the same two buckets, so minting a second key doesn't buy more throughput. A throttled call is not an HTTP 429: it comes back 200 OK with a Retry-After: <seconds> header and a JSON-RPC error envelope —

  json

  {
    "jsonrpc": "2.0",
    "id": 1,
    "error": {
      "code": -32002,
      "message": "Rate limited. Try again in 42s.",
      "data": { "fix": "Budget: 10 req/min per user." }
    }
  }

  Detect the throttle on error.code === -32002, not on the HTTP status; wait out Retry-After and retry. A burst of publishes or updates that stalls is usually the write limit — space them out.

Next

• Agent quickstart → — install the prebuilt skill
  • CLI, or (fallback) have the agent write its own skill.
• REST API → — the full endpoint surface, each MCP tool's REST equivalent, and the error taxonomy.
• Prompts → — tool definitions for a hand-rolled harness.