Skip to main content
Glama
appdropper-io

@appdropper/mcp

Official

@appdropper/mcp

An MCP server for App Dropper. It lets your coding agent upload a local .apk or .ipa and hand you the tester install link without leaving the editor.

Works with Claude Code, Cursor, VS Code with GitHub Copilot, GitHub Copilot CLI and any other MCP client that can launch a local stdio server.

You:   Upload build/app/outputs/flutter-apk/app-release.apk to App Dropper and give me the install link.

Agent: Uploaded Acme 2.4.1 (318).
       Install: https://appdropper.io/acme?build=Xb81…

Full documentation: https://appdropper.io/help/mcp

Setup

Requires Node.js 20 or newer.

1. Sign in once. This opens your browser to approve the machine and saves a token to ~/.appdropper/config. The MCP server picks it up automatically.

npx appdropper login

2. Add the server to your editor.

Claude Code:

claude mcp add appdropper -s user -- npx -y @appdropper/mcp

On native Windows, use -- cmd /c npx -y @appdropper/mcp.

Cursor (~/.cursor/mcp.json, or .cursor/mcp.json in a project):

{
  "mcpServers": {
    "appdropper": {
      "command": "npx",
      "args": ["-y", "@appdropper/mcp"]
    }
  }
}

VS Code with GitHub Copilot (.vscode/mcp.json, or run MCP: Open User Configuration). Note that the top-level key is servers, not mcpServers:

{
  "servers": {
    "appdropper": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@appdropper/mcp"]
    }
  }
}

GitHub Copilot CLI:

copilot mcp add appdropper -- npx -y @appdropper/mcp

3. Ask. "Upload the latest Android build to App Dropper."

Related MCP server: @betadrop/mcp

Tools

Tool

What it does

Side effects

upload_build

Uploads a local .apk or .ipa, waits for processing, and returns the version, build number, install URL and QR code URL.

Publishes the build and notifies the app's testers by email and push.

find_builds

Finds .apk and .ipa files in a project directory, newest first.

None. Read-only, and never uploads.

list_apps

Lists the apps your token can upload to, with their IDs.

None

list_builds

Lists an app's recent builds with install links.

None

get_build

Gets one build's details by build_id.

None

whoami

Shows whether the server is signed in and what the credential covers. It never reveals the token.

None

Authentication

The server looks for a token in this order, the same order the appdropper CLI uses:

  1. APPDROPPER_TOKEN in the server's environment

  2. The saved login from npx appdropper login

Credentials are read on every call, so signing in after your editor started needs no restart.

appdropper login gives this machine access to all your apps by default, including new ones: the first upload of a new bundle ID creates its app. To use a token limited to specific apps instead, create one at https://appdropper.io/dashboard/tokens and set APPDROPPER_TOKEN. Don't paste a token into a config file you commit. Cursor and VS Code can read it from your environment with "env": { "APPDROPPER_TOKEN": "${env:APPDROPPER_TOKEN}" }, and Claude Code's .mcp.json with "${APPDROPPER_TOKEN}". GitHub Copilot CLI doesn't pass your shell environment through to servers, so use appdropper login there.

Settings

Variable

Default

Purpose

APPDROPPER_TOKEN

—

API token; overrides the saved login

APPDROPPER_MCP_TIMEOUT

600

Seconds upload_build waits for App Dropper to process a build

APPDROPPER_API_URL

https://appdropper.io/api/v1

API base URL

Notes

  • Uploads stream from disk and resume after a dropped connection, so large builds are fine. Your plan's size limit still applies.

  • App Dropper doesn't sign or re-sign apps. An .ipa has to be signed for the testers' devices (ad hoc or enterprise) to install.

  • Only .apk and .ipa files are accepted. upload_build uploads exactly the path it is given and rejects URLs.

  • The server writes only MCP messages to stdout. Its logs go to stderr, which your editor shows in its MCP logs.

License

MIT

Available Tools

6 tools
find_buildsFind APK and IPA buildsA
Read-onlyIdempotent

Search a project directory for Android .apk and iOS .ipa build artifacts, newest first, with size, modification time, platform and release/debug variant. Read-only: nothing is uploaded. Use when the user wants to upload 'the latest build' and you don't know the output path. Skips dependency and hidden folders (node_modules, Pods, .git, .dart_tool, .gradle…) and never follows symlinks.

NameRequiredDescriptionDefault
limitNoMaximum results (default 10).
platformNo"android" for .apk, "ios" for .ipa, "any" for both (default).
directoryNoAbsolute path of the project to search. Defaults to the project the editor opened; pass it explicitly if you know it.

Output Schema

NameRequiredDescription
buildsYes
directoryYes
truncatedYes
total_foundYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, so the safety profile is covered; the description still adds substantive behavioral detail beyond them - traversal skips node_modules, Pods, .git, .dart_tool, .gradle and hidden folders, and never follows symlinks. It does not discuss limits on scan time or permission failures, keeping it from a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences, front-loaded with the core action and result shape, followed by usage guidance and then exclusion rules. No filler and nothing that could be dropped without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value structure need not be explained. Combined with full parameter documentation and explicit read-only/traversal behavior, the definition gives an agent everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and all three parameters (limit, platform, directory) are documented in-schema with defaults and enums, so the baseline is 3. The description confirms platform/variant and ordering semantics but adds no syntax or default detail the schema lacks.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (search) plus resource (Android .apk / iOS .ipa build artifacts) and even the result ordering and fields returned. It is easily distinguishable from siblings like list_builds and get_build, which operate on records rather than scanning a filesystem.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit triggering condition: use when the user wants to upload 'the latest build' and the output path is unknown. That is clear context for invocation, though it does not explicitly name or exclude the sibling tools (list_builds, upload_build) as alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_buildGet one buildA
Read-onlyIdempotent

Get one App Dropper build by its build_id: app, version, build number, platform, release notes, upload and expiry dates, install count, install URL and QR code URL. Read-only.

NameRequiredDescriptionDefault
app_idNoThe app it belongs to, if known. Speeds up the lookup.
build_idYesThe build, from upload_build or list_builds.

Output Schema

NameRequiredDescription
tagYes
app_idYes
qr_urlYes
statusYes
expiredYes
versionYes
app_nameYes
build_idYes
platformYes
bundle_idYes
expires_atNo
size_bytesYes
install_urlYes
uploaded_atNo
build_numberYes
install_countYes
release_notesYes
min_os_versionYes

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint and destructiveHint=false, so the trailing 'Read-only.' merely restates structured data. The field enumeration also duplicates the output schema, so the description adds essentially no behavioral context beyond what the agent already has.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single compact sentence with the key identifier and purpose front-loaded and no filler. The long field list is tight but partly redundant given the output schema, keeping it just short of ideal.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and 100% parameter coverage, the agent has everything needed to call this correctly; the description is complete on inputs and outputs. Only the when-to-use-vs-siblings routing is missing, which is a minor gap for a simple read tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already explains that build_id comes from upload_build or list_builds and that app_id speeds up the lookup. The description contributes only an implicit mention of build_id, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource with explicit scope ('Get one App Dropper build by its build_id') and enumerates the fields returned, so an agent can distinguish it from list_builds and find_builds without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The singular 'one build' and the 'by its build_id' phrasing imply this is the direct-lookup tool, but the description never explicitly contrasts it with find_builds or list_builds, nor states when to prefer one over the other. Usage is inferable but not spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_appsList App Dropper appsA
Read-onlyIdempotent

List the App Dropper apps the configured token can upload to, with their app IDs, bundle IDs and public install pages. Use to answer which apps are available, or to get an app_id for list_builds. Read-only.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription
appsYes
all_appsYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint and openWorldHint, so 'Read-only' is partly redundant. The description nonetheless adds real behavioral context beyond the annotations: results are filtered by the token's upload permissions, which explains why an app the agent 'knows' exists may be absent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler, with the core purpose and the token-scoping constraint front-loaded before the use-case guidance. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A no-parameter, read-only list tool with a full annotation set and an output schema. The description covers purpose, token scoping, intended uses, and downstream handoff, so nothing needed to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4. The description adds value by describing the shape of each returned entry (app IDs, bundle IDs, public install pages), which goes slightly beyond the empty input schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List the App Dropper apps') and scopes it precisely to what 'the configured token can upload to'. It also enumerates the salient return fields (app IDs, bundle IDs, install pages), so an agent distinguishes it from find_builds/list_builds immediately.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states two use cases: answering which apps are available, and obtaining an app_id to feed list_builds. That is clear routing guidance, though it names a downstream consumer rather than an alternative tool for the same job, and gives no exclusion conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_buildsList recent buildsA
Read-onlyIdempotent

List an App Dropper app's most recent builds, newest first, with version, build number, platform, upload date, status and install URL. Use for questions like 'what were the last builds I sent' or to find a previous install link. Read-only.

NameRequiredDescriptionDefault
limitNoHow many builds (default 10).
app_idNoThe app, from list_apps. May be omitted only when the token covers exactly one app.

Output Schema

NameRequiredDescription
app_idYes
buildsYes
app_nameYes
bundle_idYes

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false and openWorldHint=true, so the safety profile is fully covered; the description's 'Read-only' merely repeats it. It does add real behavioral context not in annotations (newest-first ordering, install URL presence), but nothing about pagination, limits behavior, or empty results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tightly written sentences that front-load the resource and ordering, then the usage examples. The trailing 'Read-only' is redundant with the annotations and slightly dilutes an otherwise waste-free description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description needn't document return fields, and the optional app_id/token-scoping rule is handled by the schema. Ordering and use cases are covered; only edge cases like pagination or result limits are unaddressed, which is minor for a simple list tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters (limit and app_id) are already fully documented in the schema, including the one-app token fallback. The description adds no syntax, default, or boundary detail beyond what the schema provides, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (list an App Dropper app's recent builds) plus ordering ('newest first') and the fields returned, which implicitly separates it from find_builds (search) and get_build (single build). However, it never names those siblings, so the differentiation is inferred rather than explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete when-to-use context with example questions ('what were the last builds I sent') and a task goal ('find a previous install link'). It does not state exclusions, e.g. that a known build should go to get_build or that filtered search belongs to find_builds.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

upload_buildUpload build to App DropperA

Upload a local Android .apk or iOS .ipa to App Dropper, wait for it to be processed, and return the app name, version, build number and the tester install URL. Use when the user asks to upload, share, send or distribute a mobile build to testers. Side effects: sends the file to App Dropper, publishes it as the newest build of its app (matched by bundle ID; a new bundle ID creates a new app when the token allows it), and notifies that app's testers by email and push. Takes from a few seconds to several minutes for large builds. If the path is unknown, call find_builds first. Does not build, sign or re-sign the app.

NameRequiredDescriptionDefault
tagNoShort label for the build, e.g. "beta", "nightly" or "qa". Defaults to "beta".
file_pathYesPath to the .apk or .ipa on this machine. Prefer an absolute path; a relative path is resolved against the project directory. Local paths only — URLs are rejected.
release_notesNoWhat changed, shown to testers on the install page and in the notification email. E.g. the latest commit message.

Output Schema

NameRequiredDescription
app_idYes
qr_urlYes
statusYes
versionYes
app_nameYes
build_idYes
platformYes
bundle_idYes
file_nameYes
expires_atNo
size_bytesYes
install_urlYes
build_numberYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only flag the generic profile (not read-only, open-world, non-idempotent). The description goes well beyond them: it discloses that the file is sent to App Dropper, published as the newest build of its app matched by bundle ID, that an unknown bundle ID creates a new app subject to token permissions, and that testers are notified by email and push. Timing ('a few seconds to several minutes for large builds') is also surfaced, which materially affects agent behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with what the tool does and what it returns, then usage, side effects, timing, alternatives and boundaries in that order. Every sentence carries distinct operational information with no filler or repetition of the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an open-world, non-idempotent upload tool this covers everything an agent needs: conversion-checking scope (apk/ipa only), publication semantics, tester notification, latency expectations, the prerequisite fallback to find_builds, and explicit non-goals. Return values are additionally backed by an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters (tag, file_path, release_notes) are already documented in the schema, including defaults, length limits and the local-path-only rule. The description adds no additional parameter-level detail, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb+resource ('Upload a local Android .apk or iOS .ipa to App Dropper') plus the processing wait and the returned fields (app name, version, build number, install URL). This clearly distinguishes it from read-only siblings like find_builds, list_builds, get_build, list_apps and whoami.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names the triggering user intents ('asks to upload, share, send or distribute a mobile build to testers') and routes to the alternative when preconditions aren't met ('If the path is unknown, call find_builds first'). It also states a boundary — 'Does not build, sign or re-sign the app' — so the agent knows not to reach for it for build tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

whoamiCheck App Dropper sign-inA
Read-onlyIdempotent

Check whether this MCP server is signed in to App Dropper and show the credential's name, where it was found, its expiry and which apps it covers. Never reveals the token. Use to debug setup or when another App Dropper tool reports an authentication problem.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription
appsNo
scopesNo
api_urlYes
problemNo
all_appsNo
expires_atNo
token_hintNo
token_nameNo
authenticatedYes
server_versionYes
credential_sourceYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, so the safety profile is covered; the description adds non-obvious context, notably that the token itself is never revealed and which credential attributes (name, location, expiry, app scope) are exposed. It does not discuss caching or what happens when not signed in, so it falls just short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the status check and its output, then the usage trigger. Every clause carries information; no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value syntax is already handled structurally, and the description still summarizes the meaningful fields. With zero parameters and full annotation coverage, nothing essential is missing for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes no parameters, which per the rubric anchors this dimension at a baseline of 4. There is nothing further a description could add.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: checks sign-in status for App Dropper and enumerates exactly what it reports (credential name, source, expiry, app coverage). It is clearly distinguishable from the sibling build/app tools, which all operate on builds or apps rather than the server's own credential.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use conditions: 'Use to debug setup or when another App Dropper tool reports an authentication problem.' That names both the proactive and reactive trigger, leaving nothing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.1.0
    • First observedfind_builds
    • First observedget_build
    • First observedlist_apps
    • First observedlist_builds
    • First observedupload_build
    • First observedwhoami

TDQS

A4.1/5.0

Scored across 6 tools

Disambiguation5/5

Each tool targets a distinct resource and action: find_builds searches local files, list_apps lists remote apps, list_builds lists remote builds, get_build retrieves a single build, upload_build writes, and whoami checks auth. The similar names find_builds and list_builds are clearly differentiated by their descriptions (local directory search vs. remote app builds), leaving no real ambiguity.

Naming Consistency4/5

All names use snake_case and follow a verb_noun pattern (upload_build, find_builds, list_apps, list_builds, get_build). The only deviation is whoami, which is a single word rather than verb_noun, but it is a standard, readable convention.

Tool Count5/5

Six tools is well-scoped for a build distribution service. Each tool has a clear purpose (upload, local discovery, app listing, build listing, single build retrieval, auth) and none appear redundant.

Completeness4/5

Core build distribution workflows are covered: find local build, upload, list apps, list builds, get build details, and verify auth. Missing operations like deleting a build or updating release notes are minor gaps that agents can work around, but they slightly limit full lifecycle coverage.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Enables AI agents to interact with Appcircle mobile CI/CD platform for build management, signing identities, testing distribution, and reporting.
    25
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables coding agents to verify work on live cloud devices by uploading builds, starting sessions, driving UI through UI-tree refs, reading logs, and taking screenshots on iOS, Android, Apple TV, and Android TV.
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    Share Android and iOS builds with testers from your AI agent. Sets up the build for Expo, React Native, Flutter or native apps, uploads the .apk or .ipa, and returns an install link and QR code, plus tester feedback.
    12
    29 npm
    MIT