run.dropto/drop2run

Est-ce que run.dropto/drop2run est sûr ?

Au dernier audit MCP Hub, le serveur MCP « run.dropto/drop2run » est classé « Vérifié ». Aucun comportement malveillant détecté au test comportemental. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Versions auditées & empreintes

Vérifiez la version que vous utilisez : son empreinte doit correspondre à celle listée ici — sinon vous n'utilisez pas la version auditée.

⚠ La dernière version publiée (1.2.0) n'a pas encore été auditée. Un nouveau pentest est programmé ; les verdicts ci-dessous portent sur les versions listées.

Vous utilisez ce serveur ? Suivez-le (créez un compte) pour être alerté dès qu'une nouvelle version paraît ou que le verdict change.

Les 7 outils

• login≈ 197 tokens

  Signs in through a browser on this machine and stores an access token, which every other tool then uses. Opens the browser here and waits for the person to approve. If it answers that nothing has been approved yet, call it again to keep waiting — that is not a failure. Needs no command line and no token pasted by hand.

  Paramètres, retour & exemple (2)

  Paramètres

  • replace · boolean · optionnel
    Sign in even though a token is already stored. Use when switching accounts, or when the stored token is being refused.
  • waitSeconds · integer · optionnel
    How long this call waits for the approval before answering. Default 120.

  Exemple d'appel

  {"name": "login", "arguments": {"replace": true, "waitSeconds": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• login_code≈ 157 tokens

  Signs in where no browser can be opened on this machine — a container, a remote host. The first call returns a short code and a URL to enter it at, which the person opens anywhere; call it again to wait for the approval and store the token.

  Paramètres, retour & exemple (2)

  Paramètres

  • replace · boolean · optionnel
    Sign in even though a token is already stored.
  • waitSeconds · integer · optionnel
    How long a waiting call polls before answering. Default 120.

  Exemple d'appel

  {"name": "login_code", "arguments": {"replace": true, "waitSeconds": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• publish_files≈ 446 tokens

  Publishes one or more files written here — markdown, HTML, CSS, JSON — as a site, and returns its URL. A single page goes at index.html; a single .md, .markdown or .pdf file is a site on its own, served through the documents viewer. Text only: a PDF or an image has to be published from disk with publish_dir.

  Paramètres, retour & exemple (4)

  Paramètres

  • site · string · optionnel
    Subdomain or site id to publish over. Omit to create a new site.
  • files · array · requis
    The files to publish.
  • folder · string · optionnel
    Folder to file the new site in, when the person asked for one: its path of names such as Clients/Acme, or its id from list_folders. Only for a new site — do not pass it together with `site`; moving an existing site is done in the dashboard. It never creates a folder: a folder that does not exist is refused with the list of those that do, and nothing is published.
  • subdomain · string · optionnel
    Subdomain to create the new site under, when the person asked for a particular address. Only for a new site: leave it out to publish over an existing one, and do not pass it together with `site`. Ask rather than inventing one — the name is the URL somebody will be given, it cannot be changed afterwards, and an unused site made under a guessed name has to be deleted by hand.

  Exemple d'appel

  {"name": "publish_files", "arguments": {"files": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• publish_dir≈ 350 tokens

  Publishes a folder from disk and returns its URL. The folder needs an index.html at its root, or documents (.md, .pdf, .docx, .xlsx, .epub), which are served through the reader.

  Paramètres, retour & exemple (4)

  Paramètres

  • path · string · requis
    Absolute path of the folder to publish.
  • site · string · optionnel
    Subdomain or site id to publish over. Omit to create a new site.
  • folder · string · optionnel
    Folder to file the new site in, when the person asked for one: its path of names such as Clients/Acme, or its id from list_folders. Only for a new site — do not pass it together with `site`; moving an existing site is done in the dashboard. It never creates a folder: a folder that does not exist is refused with the list of those that do, and nothing is published.
  • subdomain · string · optionnel
    Subdomain to create the new site under, when the person asked for a particular address. Only for a new site: leave it out to publish over an existing one, and do not pass it together with `site`. Ask rather than inventing one — the name is the URL somebody will be given, it cannot be changed afterwards, and an unused site made under a guessed name has to be deleted by hand.

  Exemple d'appel

  {"name": "publish_dir", "arguments": {"path": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• delete_site≈ 201 tokens

  Takes a site down permanently — its files, its history and its subdomain. Nothing here undoes it, and the subdomain becomes available for anybody to claim. Requires `confirm` to repeat the site's own subdomain exactly; ask the person for it rather than filling it in from what you already know, because that is the step this asks for.

  Paramètres, retour & exemple (2)

  Paramètres

  • site · string · requis
    Subdomain or site id to delete.
  • confirm · string · requis
    The subdomain of the site being deleted, repeated exactly. A mismatch refuses the call rather than guessing which site was meant.

  Exemple d'appel

  {"name": "delete_site", "arguments": {"site": "texte", "confirm": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_sites≈ 54 tokens

  Lists the sites on this account, so a publish can go to one of them.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_sites", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_folders≈ 77 tokens

  Lists the folders on this account, each with the path a publish's `folder` accepts. Folders are made and rearranged in the dashboard; no tool here creates one.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_folders", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

Badge pour votre README

Ce serveur a passé le pentest comportemental. Le badge porte son nom et renvoie à cette fiche — la preuve, c'est la fiche (verdict live qu'on contrôle), pas l'image.

[![Vérifié par MCP Hub](https://dokore.fr/badge/run.dropto--drop2run.svg)](https://dokore.fr/serveur/run.dropto--drop2run)

<a href="https://dokore.fr/serveur/run.dropto--drop2run"><img src="https://dokore.fr/badge/run.dropto--drop2run.svg" alt="Vérifié par MCP Hub" height="20"></a>

Réévalué en continu : si le comportement change, le verdict tombe et le badge disparaît. Un badge qui ne pointe pas vers une fiche dokore.fr ne prouve rien. Comment ça marche

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

@drop2run/mcp@1.2.0