Publish content to a NEW permanent public URL and get back its drop_… id. Accepts exactly one content input: content (inline HTML/text), files (in-memory multi-file bundle), file/paths (a local file or directory, stdio/local only), or source_url (a public http(s) URL the server fetches). For a files bundle: a drop holds up to 200 files; each file is content (text you write), source_url (a remote asset dropthis fetches server-side — use this for images/video/pdf/fonts), or content_base64 (small inline bytes only); never base64-inline an image into HTML. Use when the user wants to publish, share, post, put online, make public, or get a shareable link for generated content — a report, dashboard, slide deck, site, or file. Creates a NEW drop every call: do NOT call this to change something you already published — that makes a duplicate. To change an existing drop, use dropthis_update_content (the files at the URL) or dropthis_update_settings (title, visibility, password, expiry, metadata) with the drop_… id from this call's response. If you only kept the URL or slug, call dropthis_resolve to recover the drop_… id instead of publishing again (which would make a duplicate). Two URLs come back: url is the canonical, always-branded human view (the badge is guaranteed, with no client detection); for a single non-HTML file the response also carries raw_url, which serves that file's exact bytes at its natural path — share url with humans, hand raw_url to other agents (raw_url is null for HTML drops, where the page is the artifact, and for collections, whose per-file paths come from dropthis_get_content). Routing: by default the drop lands on the account's default custom domain when one is live (the first live path-mode domain becomes the default automatically), otherwise on the shared dropthis pool — accounts holding only dedicated domains also land on the shared pool. Pass domain (a LIVE custom domain — see dropthis_domains_list) to target a specific domain, plus an optional vanity slug on path-mode domains (1-63 lowercase letters/digits/hyphens; a taken slug is auto-suffixed with a warning). Don't pass domain for quick throwaway shares — default routing already handles those. Oversized png/jpeg/webp images are optimized server-side by default (re-encoded smaller, paths unchanged, every transform disclosed in the response warnings[] as image_optimized/image_optimize_skipped); pass optimize:false for byte-exact storage.

Update the content of an EXISTING drop, keeping its current URL (ships a new deployment). Requires drop_id (the drop_… id from publish — id-only; call dropthis_resolve to convert a URL/slug) and exactly one content input (content, files, file, paths, or source_url). Use when the user edited, changed, regenerated, or wants to update the page and the URL should stay the same. PARTIAL BY DEFAULT (mode:"patch"): the files you send are upserted by path and every file you do NOT mention is carried forward unchanged — so to fix one page send only that page (a previously-bundled image stays), and to remove a file pass its path in delete_paths (e.g. delete_paths:["assets/old.png"]). Use mode:"replace" only to swap the ENTIRE content set in one call (the files you send become the whole drop and everything else is dropped; delete_paths is invalid in replace mode). Ships content only — it never changes settings; for title/visibility/password/expiry/metadata use dropthis_update_settings, and to create a brand-new drop use dropthis_publish. Not idempotent: a retry creates another deployment unless you pass the same idempotency_key. Oversized png/jpeg/webp images in the new content are optimized server-side by default (re-encoded smaller, paths unchanged, every transform disclosed in the response warnings[] as image_optimized/image_optimize_skipped); pass optimize:false for byte-exact storage.

Change an EXISTING drop's settings — title, visibility (public/unlisted), password, noindex, expiry, metadata, or its routing (move onto a custom domain / back to the shared pool, and rename its vanity slug) — by its drop_… id (id-only). Does not touch the content at the URL: to replace content use dropthis_update_content; to create a new drop use dropthis_publish. For a public URL or slug, call dropthis_resolve first to get the drop_… id. Idempotent — applying the same values again is a no-op.

Read back an EXISTING drop's settings and metadata — the settings read half of the edit loop: in a read-modify-write / read-before-patch cycle, read current settings here, change them, then write with dropthis_update_settings (content goes through dropthis_update_content). Fetch one drop by its drop_… id (id-only), returning its URL, slug, title, status, visibility, revisions, expiry, noindex flag, whether it is password-protected, custom metadata, and the current revision number. For a public URL or slug, call dropthis_resolve first to get the drop_… id. Settings and metadata only — for the bytes the drop actually serves use its read sibling dropthis_get_content (the two read halves: dropthis_get = settings/metadata, dropthis_get_content = served content).

List the account's drops newest first, paginated, returning each drop's drop_… id, URL, title, status, and expiry when available. Use when the user wants to list / show my drops / see what they have published. Each row's id is the drop_ id the mutating tools (update_content, update_settings, delete) need — not the slug or URL. Pass domain to only list drops mounted on that custom domain (see dropthis_domains_list for the account's domains). Pass workspace (a workspace id or slug from dropthis_workspaces) to list a workspace you belong to instead of your active one, without switching it (delegated credentials only).

Permanently delete a drop and its public URL by drop_id (the drop_… id, not the slug or URL). Destructive and irreversible; requires confirm: true.

List a drop's content history — its past versions / revisions / deployments, newest first. Use when the user asks for the content history, previous versions, or revisions of a drop. Requires drop_id (the drop_… id, not the slug or URL).

Roll a drop back to a prior deployment's content — the first-class version-history rollback (Pro+). Mints a NEW deployment whose content is copied from the chosen prior deployment (a dep_… id from dropthis_list_deployments) and makes it current; the drop's URL and settings are unchanged — only the content is restored. Restoring the deployment that is already current is a no-op. This IS the rollback path — prefer it over reading an old version with dropthis_get_content and re-publishing the files by hand. Below Pro the server returns feature_not_in_plan (403) with an upgrade_url. Requires drop_id (the drop_… id, id-only — for a public URL or slug call dropthis_resolve first) and deployment_id. Returns the updated parent drop (its unchanged URL + bumped revision).

Approximate view analytics for one drop, by its drop_… id. Gated by the analytics capability: Free returns feature_not_in_plan (403, needs Keep); Keep (view_count) returns views + truncated only; Pro+ (full) also returns byCountry / byReferer / daily. Counts are best-effort — captured fire-and-forget at the edge, so treat them as an approximate signal, not exact human visits. Requires drop_id (id-only — for a public URL or slug call dropthis_resolve first). Use when the user asks how many views / how much traffic a drop got.

Read back the content an EXISTING drop is serving — the content read half of the edit loop: in a read-modify-write / read-before-patch cycle, read with this tool, modify, then ship the new version with dropthis_update_content. Requires drop_id (the drop_… id, id-only; for a public URL or slug call dropthis_resolve first to get the id). By default returns the CURRENT deployment's file manifest (entry plus each file's path, MIME type, and size in bytes); pass deployment_id (from dropthis_list_deployments) to read a historical version — to actually roll a drop back to a prior version, use dropthis_restore_deployment (this tool only reads) — or path (one of the manifest's files[].path values) to fetch one file: text content is returned directly — in the result text and, when it fits, mirrored into structuredContent.content (a file past ~80,000 characters comes back one window at a time, truncated with truncated: true and the next start_char offset — page through the whole file with start_char; never edit a partial window); binary files as a byte-count summary. Use when the user wants to read, view, inspect, diff, or edit what a drop currently serves. NOT for fetching arbitrary web pages (publish with source_url does that), and it returns content only — for a drop's settings/metadata use its read sibling dropthis_get (the two read halves: dropthis_get_content = served content, dropthis_get = settings/metadata).

Turn a drop's public URL or slug — what a user typically pastes — into the drop itself, including its drop_… id. Owner-scoped: it only matches drops on THIS account, and returns no match for an unknown or foreign URL. The locator path for the editing tools, which require the drop_… id: resolve here, then call dropthis_update_content / dropthis_update_settings / dropthis_delete with the returned id. Accepts a drop_… id too (it passes straight through). Persist the drop_… id — URLs and slugs are locators, not identifiers, and can drift (a vanity slug is renameable, the shared pool host rotates), while the id never moves.

Return the authenticated account profile (id, email, display name, plan, status) WITH the active plan's entitlements — the full capability matrix (what's unlocked + the plan that unlocks each gated feature) plus numeric limits (max drop size, default drop lifetime/TTL, storage cap, custom-hostname + seat caps) — so a feature gate can be pre-checked and a publish sized upfront with no separate lookup. Also returns the active workspace (name, kind, your role) — call before a multi-team publish to confirm which workspace will receive it.

Connect a custom domain (the user's own hostname) to the dropthis account and start the DNS loop. The response carries the exact CNAME record to create (dns[]: name → value) plus structured next hints: if you have access to the user's DNS provider tooling (e.g. a Cloudflare or registrar MCP), create the CNAME record yourself, then call dropthis_domains_verify; otherwise show the user the record and wait for them to create it. Re-call dropthis_domains_verify until status is live; then publish with domain set — or rely on the account default for path domains. Mode (immutable; delete and reconnect to change it): path = many drops under one hostname at https://{hostname}/{slug}/ — the first live path domain auto-becomes the account's default publish target; dedicated = the whole hostname serves exactly one drop at its root. Idempotent: re-connecting an already-connected hostname returns the existing domain.

Check a custom domain's DNS and TLS provisioning and advance its status (pending_dns → verifying → live). Not blocking — if status comes back verifying or pending_dns, re-call after the retry_after seconds shown in the dns records; each record's diagnostics show the expected value vs what DNS currently observed. Always re-callable — also the recovery path after a failed status (e.g. a restrictive CAA record blocking certificate issuance). Once status is live the domain serves drops: publish with domain set, or rely on the account default for path-mode domains. Takes the dom_… id or the hostname.

List the account's custom domains: each row carries the dom_… id, hostname, mode (path/dedicated), status (pending_dns/verifying/live/failed), whether it is the account's default publish target, and the mounted drop_… id for dedicated domains. Use to check which domain publish lands on by default, or to find a hostname to pass as domain to dropthis_publish. Also pass a hostname as domain to dropthis_list to see the drops currently mounted on it.

Fetch one custom domain's STORED state by its dom_… id or hostname: status (pending_dns/verifying/live/failed), mode, default flag, the DNS record to create (dns[] with name → value and the stored diagnostic hints), and next-step guidance. Reads what dropthis last recorded — it does NOT run a live DNS check; to re-check DNS/TLS and advance the status, call dropthis_domains_verify. Use to re-read the CNAME instructions for a connected domain, or to check a domain's state on a read-only connection. For one row per domain across the account use dropthis_domains_list.

Repoint a DEDICATED custom domain to a different drop (drop_id), or set/clear a PATH domain as the account's default publish target (default). Changes ROUTING only — to change the CONTENT of the page a domain serves, use dropthis_update_content on the drop, NOT this tool. Mode is immutable: delete and reconnect to change it. Takes the dom_… id or the hostname.

Disconnect a custom domain: the hostname stops serving drops and its routes are removed (the drops themselves are NOT deleted). Destructive; requires confirm: true. Afterwards, remove your DNS record for the hostname — while your CNAME still points at dropthis, the hostname could be re-connected by another dropthis account (the response repeats this dangling-CNAME warning with the exact record). If the domain was the publish default, new publishes revert to the shared pool.

List the workspaces (teams) this connection can act in, with the currently active one flagged (isActive). dropthis_account shows the active workspace on the current session. (Write-enabled connections can change the active workspace with dropthis_use_workspace.) If you need to publish into a workspace that is NOT currently active, call dropthis_use_workspace with its slug first (or pass workspace to dropthis_publish).

Switch the active team/workspace for this connection. Subsequent publishes land in it; the choice persists server-side across reconnects. Use dropthis_workspaces to list available workspaces first.

Create a new team workspace (you become its owner). Requires a team-scoped credential (ADR-0068: workspaces:write) — a publish-only key cannot create teams. Returns the new workspace's id and slug; switching the active workspace to it is separate (dropthis_use_workspace). Use dropthis_workspaces to see the teams you already belong to. If creatorCanReach comes back false, the credential created the team outside its allowlist and will be denied on the next write — re-authenticate to obtain a credential that reaches it.

Rename a team workspace or change its slug, by its workspace id. Requires a team-scoped credential (ADR-0068: workspaces:write; owner/admin). Pass name and/or slug — at least one is required. Use dropthis_workspaces to find the workspace id.

Permanently delete a team workspace by its id. Destructive and irreversible (its drops and members go with it); requires confirm: true. Owner only — requires a team-scoped credential (ADR-0068: workspaces:admin). Use dropthis_workspaces to find the workspace id.

List a team workspace's members by its id — each row carries accountId, email, role (owner/admin/member), whether it is you (isYou), and when they joined. Requires a team-scoped credential (ADR-0068: members:read). Use dropthis_workspaces to find the workspace id; the accountId here is what dropthis_update_member_role and dropthis_remove_member take.

Invite an email to a team workspace as admin or member (owner is transferred, never invited). Requires a team-scoped credential (ADR-0068: members:write; owner/admin). role defaults to member. Returns the pending invitation; the invitee accepts it via dropthis_accept_invitation (their own agent/connection). Use dropthis_workspaces to find the workspace id.

Change a workspace member's role to owner, admin, or member, by the workspace id and the member's accountId (from dropthis_members). Requires a team-scoped credential (ADR-0068: members:admin); only an owner may touch an owner, enforced server-side. Setting role=owner TRANSFERS ownership of the workspace to that member — a high-impact handoff that requires confirm: true.

Remove a member from a team workspace by the workspace id and the member's accountId (from dropthis_members), or leave the workspace by passing your own accountId. Destructive; requires confirm: true. Removing others requires a team-scoped credential (ADR-0068: members:admin); leaving needs members:write.

List the workspaces you have been invited to (your own pending invitations) — each row carries the invitation id, the workspace it is for, the role you would join as, its status, and when it expires. Requires a team-scoped credential (ADR-0068: members:read). Accept one with dropthis_accept_invitation (by invitation_id here, or by the raw token from the invite email).

Accept a team-workspace invitation and join — this is the teammate's join path. Pass token (the raw single-use token from the invite email) OR invitation_id (from dropthis_invitations; the agent path, no email needed) — at least one is required, token wins if both are given. Requires a team-scoped credential (ADR-0068: members:write) authenticated as the invited email. Joins and switches your active workspace to the team; returns the joined workspace.