AI agents

AI agents (MCP)

Connect Claude Code, Claude Desktop, Cursor or ChatGPT to Slingdrop over MCP, and the tools your agent gets.

Slingdrop speaks the Model Context Protocol, so an AI agent can share files, host assets and send its work to you for review. You comment on the exact spot and approve or request changes; the agent reads that feedback and comes back with the next version behind the same link. It works on every plan, Free included.

Remote or local#

	Remote	Local
Where	`https://slingdrop.my/mcp`	`npx -y @slingdrop/mcp`
Transport	Streamable HTTP (JSON responses, stateless)	stdio
Sign-in	OAuth in the browser, or an API key as `Authorization: Bearer sd_…`	An API key in `SLINGDROP_API_KEY`
Files the agent can send	Inline text, base64 or a URL	The same, plus local files and folders by `path`
Longest single wait	50 seconds per call (the agent calls again)	Up to 30 minutes

Both run the same tools against the same API key limits. The local server needs Node 20 or later. Set SLINGDROP_URL to point it somewhere other than https://slingdrop.my.

Set up your client#

Claude Code#

terminal

claude mcp add --transport http slingdrop https://slingdrop.my/mcp

terminal

claude mcp add --transport http slingdrop https://slingdrop.my/mcp \
  --header "Authorization: Bearer sd_…"

terminal

claude mcp add slingdrop --env SLINGDROP_API_KEY=sd_… -- npx -y @slingdrop/mcp

With the remote server, run /mcp in Claude Code and choose Authenticate to sign in. Use the local server if you want Claude Code to send files from your project by path.

Claude Desktop and Claude.ai#

Add a custom connector: Settings → Connectors → Add custom connector, paste https://slingdrop.my/mcp and sign in to Slingdrop when asked. Or run the local server by adding it to claude_desktop_config.json:

claude_desktop_config.json

{
  "mcpServers": {
    "slingdrop": {
      "command": "npx",
      "args": ["-y", "@slingdrop/mcp"],
      "env": { "SLINGDROP_API_KEY": "sd_…" }
    }
  }
}

Cursor and other clients#

Add the remote server to ~/.cursor/mcp.json (or the project's .cursor/mcp.json); Cursor opens the Slingdrop sign-in when you enable it. Windsurf, VS Code and other MCP clients take the same URL, or the local command above.

mcp.json

{
  "mcpServers": {
    "slingdrop": { "url": "https://slingdrop.my/mcp" }
  }
}

mcp.json

{
  "mcpServers": {
    "slingdrop": {
      "url": "https://slingdrop.my/mcp",
      "headers": { "Authorization": "Bearer sd_…" }
    }
  }
}

mcp.json

{
  "mcpServers": {
    "slingdrop": {
      "command": "npx",
      "args": ["-y", "@slingdrop/mcp"],
      "env": { "SLINGDROP_API_KEY": "sd_…" }
    }
  }
}

ChatGPT#

Turn on Developer mode under Settings → Apps & Connectors → Advanced settings, then create a connector with the URL https://slingdrop.my/mcp and OAuth sign-in.

How sign-in works#

The remote server is an OAuth 2.1 protected resource. A request without a valid key gets 401 with a WWW-Authenticate header pointing at /.well-known/oauth-protected-resource. Clients then discover the authorization server at /.well-known/oauth-authorization-server, register themselves (dynamic client registration), and run the authorization code flow with PKCE (S256). You approve the app on a Slingdrop consent screen.

The access token the client receives is an ordinary Slingdrop API key named after the app (for example MCP: Claude), with your plan's daily call limit. It shows up in Settings → Developer, where you can revoke it at any time. More in Authentication.

The review loop#

When an agent makes something you should see (a page, a logo, a song, a deck), it calls request_review and gives you the link. You comment and decide in the browser. The agent calls wait_for_feedback, applies your comments, and calls submit_revision with the new version and the ids of the comments it addressed, until the status is approved. Comments arrive with their location in words ("pinned 30% from the left and 12% from the top", "at 1:42", "lines 12–18"), so the agent knows exactly what to change. A website sent as index.html with its CSS, JS and images renders live in the review page.

The same loop is available over REST and in the SDK. See Reviews & approvals.

Tools#

Every tool that takes files uses the same file list. Results come back as text for the model plus structured content.

request_review#

Send work for review. Creates a feedback drop with approval on that is kept until you delete it, starts the review and notifies you. Returns the review link, drop_id and a cursor.

titlestringrequired: Short name for what was made, e.g. "Pricing page redesign".
filesfile[]required: The work. See file list.
questionstring: What the reviewer should look at or decide, shown at the top of the review.
reviewersemail[]: Other people who should review. The drop becomes private to them; they get an invite and confirm their email to comment.

wait_for_feedback#

Wait until the reviewer comments, approves or requests changes, then return their feedback. Returns early when something new arrives; otherwise returns after the timeout with nothing new and the agent can call again. Read-only.

drop_idstringrequired: From request_review.
cursorstring: The cursor from the previous call, to get only what's new.
timeout_secondsnumber, 10–1800: How long to wait at most. Default 300. The remote server caps each call at 50 seconds.

get_feedback#

The review's current status, latest decision and comments, without waiting. Read-only.

drop_idstringrequired: The review.
cursorstring: Only feedback after this cursor (plus anything still open).

submit_revision#

Upload the next version behind the same link. The comments listed in resolves are marked resolved with a reply, and the reviewer is notified.

drop_idstringrequired: The review.
filesfile[]required: The new version.
notestring: What changed, in a sentence or two.
resolvesstring[]: Ids of the comments this version addresses.

reply_to_comment#

Reply to a reviewer's comment, for example to ask a clarifying question. The reply is labelled as coming from the AI agent.

drop_idstringrequired: The review.
comment_idstringrequired: The comment's id (shown in brackets in the feedback text).
textstringrequired: The reply.

share_files#

Upload files and get a link, without a review. Returns the link, drop_id and when it expires.

filesfile[]required: What to share.
titlestring: Title of the drop.
purpose"share" | "feedback": Default "share". "feedback" allows comments without asking for approval.
expiry"1h" | "24h" | "7d" | "30d" | "90d" | "forever": Default "forever" (until deleted) for share drops. Feedback drops default to 7 days.
passcodestring, 4–12: Protect the link with a passcode.

host_files#

Upload files to file hosting and get stable public CDN URLs for an app or site. HTML, JavaScript and SVG are served as downloads, so agents should use request_review to show a web page.

filesfile[]required: What to host. Each file's name becomes its path.
spacestring: Space name, e.g. acme-assets. Created if the name is free. Defaults to your own space.
prefixstring: Folder to put the files under, e.g. v2/.
immutableboolean: Cache for a year. Only for file names that change when the content does.

list_drops#

The 50 most recent drops and reviews with their links. Read-only.

status"active" | "all": Default "active".

get_drop#

A drop's details: files, versions and settings. Read-only.

drop_idstringrequired: The drop.

create_file_request#

Create a link where someone can upload files to you, e.g. to collect assets or documents.

titlestringrequired: What you're asking for.
instructionsstring: Shown to the person uploading.

The file list#

Tools that take files accept 1 to 500 items. Each item uses exactly one source. Put folders in name to keep structure, e.g. site/index.html and site/style.css.

pathstring: A local file or folder. Local server only. A folder sends every file in it (skipping .git, node_modules and .DS_Store) with relative names.
textstring: The contents as text: HTML, Markdown, SVG, code.
base64string: Binary contents, base64-encoded (a data: URL prefix is fine).
urlstring: An http(s) URL that Slingdrop downloads. Up to 100 MB.
namestring: File name, optionally with folders. Required for text, base64 and url.
typestring: MIME type, if known. Otherwise it is guessed from the extension.

request_review arguments

{
  "title": "Pricing page redesign",
  "question": "Does the comparison table read clearly on a phone?",
  "files": [
    { "name": "site/index.html", "text": "<!doctype html>…" },
    { "name": "site/style.css", "text": "body { … }" },
    { "name": "site/hero.png", "url": "https://example.com/build/hero.png" }
  ]
}

Limits and privacy#

Every tool call counts against the key's daily API calls, and drops follow your plan's size, storage and daily limits. See Limits.
Agents can only do what the tools allow: they can't delete drops, change your settings or read other people's files.
Revoke a connected app any time by deleting its key in Settings → Developer.