MCP serverio.dropyour/dropyour

Make YOUR graduated app callable by a third party's agent, as an MCP server at https://<dropId>.dropyour.site/mcp — live as soon as ONE tool is declared; no tool declared = no /mcp

Declare how much you delegate to the machine on ONE of your apps. Three modes. 'copilote' — nothing is autonomous: every call is a human gesture you are relaying, and everything yo

Call a route of YOUR OWN drop and get the real HTTP answer back: status, headers, duration, body. This is how you check that what you just published actually works, without asking

Permanently delete a drop. Immediate and final — the URL is never reassigned. With an account token, owned drops need no managementToken.

Cut a host your graduated app is calling — in ONE call, taking effect on the next request, with NO republish. This is the verb for the moment you read in dropyour_logs that a key i

GRADUATE one of your drops to tier 4 — a real backend (server code, queryable store, isolated SQLite) behind the SAME URL, with its data carried over. This ACTS: it creates the app

Bring an EXISTING app to Dropyour in one call: zip its files (you have them — from GitHub, disk, another host) and pass the archive. A single-HTML archive publishes like dropyour_p

Let one of your graduated apps call ANOTHER of your apps over the network. By default no app can reach another — that refusal is the platform's isolation, not an oversight. This op

List your drops. With an account token: all LIVE drops attached to your account (across sessions and channels — manageable without managementToken). Anonymous: only the drops publi

List the published versions of a GRADUATED app (level 4), newest first, with the one currently served. Levels 1-3 have no history at all — replace overwrites the blob under the sam

Read a graduated app's own log buffer (tier 4): the last 200 lines, most recent first — explicit `app.log(...)` calls from the app's server code, plus platform-captured errors the

Replace ONE literal anchor in the SERVED content without re-uploading everything — the Edit semantics you already know. old = the exact literal text to find; new = its replacement;

Publish a self-contained HTML file to Dropyour. Returns a stable public URL (one origin per drop — same address across updates, browser data survives) and a managementToken. KEEP T

Read what a GRADUATED app actually SERVES right now — not the seed captured before it graduated. Without path: the list of files in the served version, with their size, and whether

Read a drop's source HTML (what you published — no shared-memory shim, no attribution badge). For multi-file sites, also returns the list of asset paths (not their bytes). Large co

Read a drop's app data — the shared-memory state (a JSON key/value snapshot mirroring the app's localStorage), so you can answer questions about what the app holds. Returns scope='

Read one page of a collection from a GRADUATED app's queryable store, most recently updated first. Pass the returned cursor to get the next page; no cursor means you reached the en

Summarise what a GRADUATED app keeps in its queryable store: one line per collection with the number of records and the bytes they occupy. Nothing is downloaded. Levels 1-3 have no

Declare the visibility of ONE collection of your graduated app's store. Two values, no policy language. 'partagee' (the default): all in-app reads see the whole collection — today'

Write (or replace) ONE row in a graduated app's store, without republishing anything. The store is the app's queryable database (tier 4); this is the same table your app code reads

Publish new content AND check it works, in one transaction. If any check fails, the previous version is put back automatically and you get the failing check plus your app's log lin

Replace the content of an existing drop — HTML, or a base64 .zip once the app has GRADUATED to tier 4 (ADR-0182). The URL never changes (origin contract): visitors' browser data su

Roll a GRADUATED app back to a previously published version — this is the EXPECTED FAILURE PATH of dropyour_release, which calls it for you when a check fails. Reach for it directl

Mint a NEW management token for a drop and kill the old one — the self-serve way out of a lost or leaked token. Works with the old token (rotation) or with your connected account f

Your app's clock, in one verb. action='read' (default) tells you when it next rings, whether the app is frozen, and the last runs WITH THEIR EFFECT: verdict, duration, and the stat

Delete a secret from a graduated app's vault by name. Deleting a name that does not exist is not an error — the final state is what you asked for.

Store a SECRET for a graduated app (tier 4), bound to a host pattern. The value is encrypted at rest and NEVER readable back — by anyone, ever. The platform's egress membrane attac

List a graduated app's secrets: NAMES, host bindings and dates only — values are never returned, by design (a vault whose values can be read is a vault worth stealing). Use it to k

Get a drop's status: URL, visibility, expiration, size, approximate view count, and its private name (if set). With an account token, owned drops need no managementToken. This read

Change a drop's visibility (private = link-only + noindex, public = indexable), its expiration, or remove the "Hosted on Dropyour" badge (badgeHidden — Pro account token required),

Check how this session is authenticated: resolved tier (anonymous / free / pro) and its limits. Call this after configuring an account token (dyk_...) to confirm it is recognized —

Write a drop's app data — replace the shared-memory state (the JSON key/value object mirroring the app's localStorage), so you can update what the app holds (mark a task done, add