drop2run-cliCAUTION
Source for the drop2run CLI and MCP server — publish a static site or an agent's output to an HTTPS link, no git and no build config.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://glama.ai/mcp/servers/Drop-to-run/drop2run-cli) [](https://mcpservers.org/servers/dropto-run-publish)
Source for the two Drop2Run packages that run on your machine: the drop2run command line tool and the @drop2run/mcp server.
Both are installed globally and then handed a credential. This repository exists so you can read what you are giving that credential to.
npm i -g drop2run # https://www.npmjs.com/package/drop2run npx @drop2run/mcp # https://www.npmjs.com/package/@drop2run/mcp
Using them
The command line tool signs in through a browser and publishes a folder:
drop2run login drop2run deploy dist
login needs a browser on the same machine; drop2run login --device covers a remote shell, and CI uses a DROP2RUN_TOKEN from . The other commands are init, ls, open, rollback, rm, token list, whoami and where, and --json on any of them prints machine-readable output.
The MCP server is registered with a client rather than run by hand. Claude for macOS and Windows installs it from a bundle — download `drop2run.mcpb` and open it, and there is no config file and nothing to install first. Claude Code takes one command:
claude mcp add drop2run -s user -- npx -y @drop2run/mcp
It exposes publish_files, publish_dir, list_sites, list_folders, delete_site, get_site, update_site, pause_site, resume_site and rollback_site, and login / login_code to get a token without leaving the chat. The publishes answer with structured fields beside the sentence, so a URL does not have to be read back out of prose; delete_site is permanent and asks for the site's subdomain repeated back before it runs. The t
419fdddece96OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp -- npx -y @drop2run/[email protected]
Exposed tools (19)
14 read · 3 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
delete_site | destructive | |
get_site | read | |
invite_people | read | |
list_comments | read | |
list_folders | read | |
list_people | read | |
list_sites | read | |
login | read | |
login_code | read | |
pause_site | read | |
publish_dir | write | |
publish_files | write | |
remove_person | destructive | |
reopen_comment | read | |
reply_comment | read | |
resolve_comment | read | |
resume_site | read | |
rollback_site | read | |
update_site | write |
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (6 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (12)
const url = new URL(request.url ?? "/", "http://127.0.0.1");
delete_site, remove_person
publishFiles(credentials, [{ path: "../../.ssh/id_rsa", content: "x" }]),symlinkSync(join(outside, "private-key"), join(root, "id_rsa"));
publishFiles(credentials, [{ path: "../../.ssh/id_rsa", content: "x" }]),`http://127.0.0.1:${listener.port}/cb?code=d2c_test&state=${encodeURIComponent(attempt.state)}`,`http://127.0.0.1:${listener.port}/cb?code=d2c_test&state=wrong`,`http://127.0.0.1:${listener.port}/cb?state=${encodeURIComponent(attempt.state)}`,expect((await fetch(`http://127.0.0.1:${listener.port}/`)).status).toBe(404);@biomejs/biome, @types/node, typescript, vite, vitest
@modelcontextprotocol/sdk, zod, @biomejs/biome, @types/node, typescript, vite, vitest
@biomejs/biome, @types/node, typescript, vitest
Gates applied: no_behavioural_pass.
419fdddece96full audit observations/trust-audit/mcp-server/drop-to-run__drop2run-cli.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 419fdddece96 | CAUTION | B | 89 | first audit |
Questions
What is the drop2run-cli MCP server?
Source for the drop2run CLI and MCP server — publish a static site or an agent's output to an HTTPS link, no git and no build config.
What tools does drop2run-cli expose?
19 in total: 14 read-only, 3 that write, and 2 that can delete or overwrite (delete_site, remove_person). Every one is listed on this page with its risk.
Is drop2run-cli safe to connect to an agent?
With care. The audit graded it B (89/100) and found 12 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does drop2run-cli need?
It reads DROP2RUN_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does drop2run-cli run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @drop2run/node at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (419fdddece96), read on 2026-10-11. The repository is watched and re-audited when it changes.