For agents

Agent quickstart

The whole contract is small: one POST to publish, one stable URL to share, one PUT to update in place. Three ways to give an agent that habit. All need one thing first: an API key. Generate one at dashboard/api-keys — it looks like df_sk_....

  1. Install the prebuilt skill + CLI — one bootstrap command installs the first-party CLI and drops the hosted REST-first skill into your agent's skill dir. The recommended path for any agent on a machine with npm.
  2. Fallback: no npm / offline — no npm, or an air-gapped box? Paste one prompt and the agent reads the docs, stores the key, and writes its own persistent skill/instructions file tuned for your harness.
  3. Connect over MCP — a hosted MCP server is live for clients that support remote MCP servers. See Connect the MCP server for per-client setup.

Just want to publish by hand from a terminal? The Quickstart has the one-line curl to publish your first site.

On a managed or enterprise Claude account, one setup step comes first: your org has to allowlist dropfast.dev for network egress, or publishing from the sandbox is blocked. See Managed or enterprise Claude accounts.

Install the prebuilt skill + CLI

The recommended path: install the first-party CLI (the plumbing — multipart, zip-at-root, URL verification) and drop the hosted, REST-first skill file (dropfast.SKILL.md) into your agent's skill directory (the policy — private-by-default, df.* tagging, the review loop). One bootstrap command does both:

bash
npm install -g @dropfast/cli && \
  mkdir -p ~/.claude/skills/dropfast && \
  curl -fsSL https://dropfast.dev/dropfast.SKILL.md -o ~/.claude/skills/dropfast/SKILL.md

Then store your API key once so every publish is authenticated:

bash
dropfast login   # paste your df_sk_... key; saved to ~/.dropfast/credentials (mode 600)

The curl half writes the skill; swap the destination for whatever harness you run — the CLI is shared, only the skill directory changes:

bash
# Claude Code
mkdir -p ~/.claude/skills/dropfast && \
  curl -fsSL https://dropfast.dev/dropfast.SKILL.md -o ~/.claude/skills/dropfast/SKILL.md
 
# Codex
mkdir -p ~/.codex/skills/dropfast && \
  curl -fsSL https://dropfast.dev/dropfast.SKILL.md -o ~/.codex/skills/dropfast/SKILL.md

The skill ends by asking you one question — when it should publish (every artifact / only shareable deliverables / only when you ask) — and records your answer so the habit persists.

Managed or enterprise Claude accounts — allowlist dropfast.dev

If your agent runs on a managed or enterprise Claude account, the code-execution sandbox restricts outbound network access to a domain allowlist your organization controls. The install and docs reads may succeed while the first publish fails — the tell is an error like:

plaintext
Host not in allowlist: dropfast.dev. Add this host to your network
egress settings to allow access.        (or: 403 blocked-by-allowlist)

This is expected on locked-down orgs, and it is a network policy — not a DropFast credential or CLI problem. (Reading the docs works because that goes through a different, pre-approved fetch path; a publish is a direct API call to dropfast.dev, which the egress firewall blocks.) One allowlist entry fixes it permanently:

A Claude organization owner or admin adds the host in the Claude admin console:

  1. Settings → Capabilities → Code execution → Allow network egress.
  2. If the mode is "Package managers only," switch it to the option that permits custom domains — the additional-domain list is ignored while that mode is set.
  3. Add dropfast.dev to the allowed domains (a literal host, or the wildcard *.dropfast.dev). If you install the CLI from npm inside the sandbox and it isn't already reachable, allow registry.npmjs.org too.
  4. Re-run the publish — nothing else changes.

Not an admin? Send the four steps above to whoever owns your Claude organization. Until dropfast.dev is allowlisted, publishing over the API from inside the sandbox can't succeed — but you can still generate the artifact and publish it from an unrestricted environment (a local terminal with the CLI, or the dashboard).

Fallback: no npm / offline

Use this only when the install path above isn't available — no npm on the box, an air-gapped/offline environment, or a harness where you can't run the CLI. Paste this prompt into your agent. It reads the API from /llms.txt, stores the key the way your harness stores secrets, and writes itself a skill/instructions file so the DropFast habit survives across sessions.

plaintext
You're going to set yourself up to publish HTML artifacts to DropFast, so
you can hand me stable URLs instead of pasting code into chat.
 
1. Read https://dropfast.dev/llms.txt and the pages it links to learn the
   API (publish, update-in-place, access modes, comments, metadata).
 
2. Ask me for a DropFast API key — I'll create one at
   https://dropfast.dev/dashboard/api-keys. Store it the way this harness
   stores secrets (env var / secret store). Never inline it in a committed
   file.
 
3. Write yourself a persistent skill/instructions file for THIS harness so
   the workflow survives across sessions. Use the right location:
     - Claude Code:  .claude/skills/dropfast/SKILL.md
                     (with `name:` + `description:` YAML frontmatter)
     - Cursor:       a rule file under .cursor/rules/
     - Codex/Gemini: AGENTS.md (or the harness's instruction file)
   The file should instruct you to:
     - Publish any HTML artifact (plan, prototype, report, review) with
       POST https://dropfast.dev/api/v1/sites (multipart `file=@index.html`,
       `name=...`) and return the URL in your reply.
     - Update in place with PUT /api/v1/sites/{slug} so the URL stays stable
       across turns. One slug per artifact, not per turn.
     - Default new artifacts to accessMode "private". Flip to "public" or
       "password" only when I ask.
     - When I want inline review, publish with `commentsEnabled=true`, then
       read feedback with GET /api/v1/sites/{slug}/comments and resolve each
       after you address it — send the request in each comment's
       `links.resolve` (PATCH or PUT /api/v1/comments/{id} with
       `{ status: 'resolved' }`).
     - Authenticate every request with `Authorization: Bearer df_sk_...`.
 
4. If this harness supports MCP, also wire the DropFast MCP server
   (https://dropfast.dev/api/mcp, Bearer auth) and prefer its tools
   (publish_html, update_site, get_comments, resolve_comment, ...).
 
5. Ask me exactly one question, and record my answer in the skill file:
   When should I publish artifacts to DropFast?
     1. Every HTML/Markdown artifact I generate.
     2. Only shareable deliverables — plans, prototypes, reports, reviews.
     3. Only when I explicitly ask.
 
6. Confirm by publishing a one-line test page and showing me the URL.

Shorter version

If your agent already has the docs in context (or you just want the instructions file written), this is enough:

plaintext
Write yourself a DropFast skill for this harness. Read
https://dropfast.dev/llms.txt for the API. The skill should: publish HTML
artifacts to POST /api/v1/sites and return the URL, update in place with
PUT /api/v1/sites/{slug} (stable URL, one slug per artifact), default to
accessMode "private", and use commentsEnabled=true + get/resolve comments
when I want inline review. Auth is `Authorization: Bearer df_sk_...` — ask
me for the key and store it as a secret, never in a committed file.

What to put in the skill

Whichever path you take, the durable habits are the same:

  • One slug per artifact, not per turn. Publish once, PUT on every later turn. The link the human holds always points at the latest version.
  • Private by default. Agents are noisy — don't leak every intermediate plan. Flip to public/password on request.
  • Echo the URL. Put it on its own line in the reply so a human (or the next tool) can pick it out.
  • Close the review loop. Publish with commentsEnabled=true, read feedback, address it, resolve each comment.

Connect over MCP

A hosted MCP server is live at https://dropfast.dev/api/mcp (Streamable HTTP, Bearer auth). If your client supports remote MCP servers, point it there and every DropFast tool (publish_html, update_site, get_comments, resolve_comment, …) appears. The registry manifest lives at https://dropfast.dev/.well-known/mcp.json.

Connect the MCP server → has copy-paste setup for Claude (custom connector), Claude Code, ChatGPT (Developer mode), Cursor, VS Code, and Windsurf — including how to configure the Authorization: Bearer df_sk_... header each client needs (DropFast uses an API key, not OAuth).

First-party setup packages that wire the endpoint into stdio-only clients with one command are still coming soon — but remote-MCP clients connect today via the guide above, and the self-setup prompt earlier on this page works in every agent over the plain REST API, no install required.

Next

  • Prompts → — ready-made tool definitions (dropfast_publish, dropfast_update, the comment tools) to paste into a hand-rolled harness.
  • Handoff → — agent-to-human and agent-to-agent patterns on a shared URL.
  • REST API → — the full endpoint surface and error taxonomy.
Edit this page on GitHub
PreviousOverviewNext Connect the MCP server