# DropFast
> Drop an HTML file or ZIP, get a stable URL. DropFast publishes HTML artifacts (plans, prototypes, reports, agent-generated pages) to a permanent address.
## Audience
- Developers publishing one-off sites and prototypes from the CLI.
- AI agents that produce HTML and need a persistent URL to hand back.
## Integration
Today, agents publish over the **REST API** — fetch the hosted skill file in one line, or paste a self-setup prompt and the agent writes its own DropFast skill. A hosted **MCP** server is also live for clients that support remote MCP servers; first-party npm setup packages are coming soon.
- Hosted skill file (REST-first, one-line install): `https://dropfast.dev/dropfast.SKILL.md`
```bash
mkdir -p ~/.claude/skills/dropfast && \
curl -fsSL https://dropfast.dev/dropfast.SKILL.md -o ~/.claude/skills/dropfast/SKILL.md
```
- Self-setup prompts (agent reads the docs + writes its own DropFast skill): `https://dropfast.dev/docs/agents/quickstart`
- Per-client setup guide: `https://dropfast.dev/connect`
- MCP server (hosted): `https://dropfast.dev/api/mcp` (Streamable HTTP, JSON-RPC 2.0; remote MCP — first-party install packages coming soon)
- Registry manifest: `https://dropfast.dev/.well-known/mcp.json` (io.dropfast/dropfast namespace)
- Tool schemas (Anthropic + OpenAI + Gemini shapes): `https://dropfast.dev/.well-known/tool-schemas.json`
- OpenAPI 3.1 spec: `https://dropfast.dev/api/openapi.json`
- Interactive docs: `https://dropfast.dev/docs/openapi`
- Auth (canonical, REST + MCP): `Authorization: Bearer df_sk_...`
- Auth (legacy REST back-compat): `x-api-key: df_sk_...` (Bearer wins if both sent). Create keys at `/dashboard/api-keys`.
### Agent decision tree
- Need to publish a single HTML page → `publish_html`
- Need to publish a multi-file site (HTML + CSS + JS + images) → `publish_zip`
- Update an existing site → `update_site(slug=...)` (use `list_sites` to find the slug)
- Change name / access / password / commentsEnabled without replacing files → `update_site_settings(slug=...)`
- Verify a publish → `get_site(slug=...)` (URL is strongly consistent after publish; response includes `commentsEnabled` so you can branch on whether to call `get_comments`)
- Want a human (or another agent) to leave inline feedback on the published site → publish with `commentsEnabled: true` (any of `publish_html` / `publish_zip` / `publish_markdown`)
- Read open feedback on a comments-enabled site → `get_comments(slug=...)`
- Leave a structured comment yourself → `add_comment(slug=..., bodyText=..., target=...)`
- Mark a comment resolved after applying it → `resolve_comment(commentId=...)`
- Create a short-link → `create_alias`
- Repoint or pause an alias → `repoint_alias`
Review loop (Phase 4 spike): publish with `commentsEnabled:true` → human reviews via the inline overlay → agent calls `get_comments` → `update_site` to address them → `resolve_comment` per item. The comments API is gated per-site by `commentsEnabled`; flip it on with `update_site_settings(slug=..., commentsEnabled=true)` if you forgot at publish time.
Naming note: MCP `publish_html(html=...)` is equivalent to REST `POST /api/v1/sites` with `file=`. Different transports, same operation.
## REST API (fallback)
- Base URL: `https://dropfast.dev/api/v1`
- Publish: `POST /api/v1/sites` (multipart with `file`, optional `name`, `accessMode` of `public`|`private`|`password`, `password` when applicable, and `commentsEnabled` as `"true"`/`"false"`).
- Update files in place: `PUT /api/v1/sites/{slug}` (multipart with `file`). Slug stays the same.
- Update settings: `PATCH /api/v1/sites/{slug}` (JSON: `name`, `accessMode`, `password`, `commentsEnabled`). Omit any field to leave it unchanged.
- Comments (Phase 4 spike, site must have `commentsEnabled:true`): `GET /api/v1/sites/{slug}/comments` lists, `POST` adds a plain-text comment, `PATCH /api/v1/comments/{id}` resolves or reopens.
- Aliases: `POST /api/v1/aliases` (JSON: `alias`, `targetType` `site|external`, plus `targetSiteId` OR `targetUrl`). `PATCH`/`DELETE /api/v1/aliases/{alias}` for repoint/pause/delete. Resolver: `GET /_/{alias}` → 302.
Errors follow `{success: false, error: {code, message, fix, docs_url}}`. The `fix` string is action-oriented — agents read it to self-correct without re-prompting a human.
## Documentation
### Getting started
- [Overview](https://dropfast.dev/docs.md): What DropFast is and who it is for.
- [Quickstart](https://dropfast.dev/docs/quickstart.md): Publish your first site from the CLI in under a minute.
### Reference
- [REST API](https://dropfast.dev/docs/api.md): Endpoints, request bodies, and the full error taxonomy.
- [Access control](https://dropfast.dev/docs/access-control.md): Public, private, and password-protected sites.
- [Aliases](https://dropfast.dev/docs/aliases.md): Short-link aliases that survive site rebuilds and re-targets.
### For agents
- [Overview](https://dropfast.dev/docs/agents.md): Why HTML artifacts deserve URLs.
- [Quickstart](https://dropfast.dev/docs/agents/quickstart.md): Connect over MCP, or paste a prompt that has the agent write its own DropFast skill.
- [Local dashboard auth](https://dropfast.dev/docs/agents/local-auth.md): One HTTP call or CLI command to land authenticated on /dashboard. Local-only by design.
- [Handoff](https://dropfast.dev/docs/agents/handoff.md): Agent-to-human handoff patterns for shared work.
- [Prompts](https://dropfast.dev/docs/agents/prompts.md): Recommended system prompts and tool definitions.
### Releases
- [Release notes](https://dropfast.dev/docs/releases.md): What shipped, when, and what it means for you.
## Full text
- [llms-full.txt](https://dropfast.dev/llms-full.txt): concatenated plain text of every docs page.