MCP.Market

Hushdrop MCP server

by maxtechera·io.github.maxtechera/hushdrop·v0.3.3·8 stars
No reviews yet

Open-source artifact sharing for AI agents: private, branded, zero-knowledge links.

B72/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B72/100

full report

Adoption
Growing

8 stars46 downloads/wk

Reviews

Write one

Nobody has reviewed Hushdrop yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Hushdrop tools (9, 5 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • delete_sitewrite action

    Delete a drop (and any sibling file) by slug. Burns the artifact immediately.

  • list_sites

    List the drops currently live in your store (slug, URL, size, password if known locally, upload date).

  • publish_filewrite action

    Publish a file from a local path. Non-HTML files get an unguessable URL; pass page=true to wrap any file in a branded download page (optionally password-protected).

  • publish_htmlwrite action

    Publish raw HTML as a branded, password-protected (zero-knowledge AES-256) link on your own domain. Returns the URL and (if locked) the password. Locked by default.

  • set_email_gatewrite action

    Restrict a hosted drop so only viewers with a given email domain can open it (e.g. 'acme.com'); pass 'off' to remove.

  • set_expiry

    Set (or clear) the auto-expiry on a hosted drop. The host's gc cron deletes it after the deadline.

  • set_feedback

    Toggle the viewer feedback widget on a hosted drop (collect reactions/comments from recipients).

  • set_password

    Change the password gate on a hosted drop. Zero-knowledge means re-keying re-encrypts, so re-supply the HTML; returns the new URL + password.

  • update_sitewrite action

    Replace the content of an existing drop in place — same URL/slug, new HTML. (Set a password to re-lock; zero-knowledge means content can't be re-keyed without re-supplying it.)

Public scan report

scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it

no findings
  • Code scan5 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 95 days ago8/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 72/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Hushdrop compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
72/100
higher than 38% of 48,255 servers
Tools
9
the typical server has 7
Tools that change things
56%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
8
more than 86% of 28,688 servers
Downloads a week
46
more than 38% of 12,191 servers with a package

What its tools let an agent do: 1 read · 5 change · 1 delete · 2 send or post

Install Hushdrop in Claude Code, Cursor or VS Code

Runs npx -y hushdrop-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add hushdrop -- npx -y hushdrop-mcp
Add to Cursor

What the publisher says

From the Hushdrop repository's README, as published. We do not edit it. Read it on GitHub

Hushdrop

Share what your AI builds — on your own domain.

Open-source, self-hosted artifact sharing. Drop a file, an HTML page, or a whole site and get a branded, password-protected (zero-knowledge AES-256) link on your own domain in ~1 second — from your terminal or any AI agent. The open-source alternative to Stacktree.

Live demo → · Docs · Try in browser · vs Stacktree

Quick start

The core way to use Hushdrop is from your agent — it publishes what it builds to your own domain.

Claude Code (recommended — auto-updates via the plugin marketplace):

/plugin marketplace add maxtechera/hushdrop
/plugin install hushdrop

Cursor · Codex · Copilot · Gemini · 20+ Agent Skills hosts:

npx skills add maxtechera/hushdrop-skill

No install — open hushdrop.dev/try, drop an HTML file, get a link. No account.

One-off from the terminal — zero install, zero setup, no account:

npx hushdrop report.html       # → https://hushdrop.dev/u/xxxx (+ password, copied) — no setup, no account

Free hosted account — persistent links on your own handle (hushdrop.dev/you/):

npx hushdrop login                       # passwordless: GitHub or magic link
npx hushdrop report.html                 # → https://hushdrop.dev/you/report-a1b2 (persistent)

Your own domain — self-host on your Vercel Blob (free, MIT, your URL + brand forever):

# one-click: the "Deploy with Vercel" button above auto-provisions a Blob store — then:
npx hushdrop-install                         # wire your agents + CLI
hush deploy --domain share.yoursite.com   # or do it from a local clone

No dashboard required. Two commands to try; one more to own.

Why this exists

Anthropic shipped artifact sharing so teams could hand each other the things they make with AI. It's great — and it's locked to their surface, their domain, their account. Stacktree does the agent-native version, but it's a closed SaaS: your content sits on their servers, custom domains and limits are paywalled, and you can't audit or self-host it.

I make things all day with agents: reports, proposals, guides, dashboards, whole little sites. I wanted to hand someone a link that's mine — my domain, my brand, my keys — in the time it takes to type one command, without uploading client work to someone else's server. So hush does exactly that: terminal-native, zero-knowledge, on your own domain, usable from any agent. MIT.

Hushdrop vs. the alternatives

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Hushdrop: common questions

Is Hushdrop MCP server safe?
Mostly: it is graded B (72/100). Read the Hushdrop safety report
How do I install Hushdrop?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Hushdrop need an API key?
Yes. The registry entry asks for BLOB_READ_WRITE_TOKEN.
Is Hushdrop maintained?
The last commit was 134 days ago (2026-06-23). The latest release is v0.3.3.
How does Hushdrop compare with other MCP servers?
safety score 72/100 (higher than 38% of 48,255 servers); tools 9 (the typical server has 7); tools that change things 56% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.