Connect an AI app to Markdrop

5 min readUpdated Oct 30, 2026

Builds on Do you need an account?.

Markdrop's hosted MCP server lives at one address. Paste it into your AI app, sign in to Markdrop when the app sends you there, and approve. There is no API key, client ID or secret to copy.

Server URL
https://api.markdrop.in/mcp

You need a Markdrop account. Connecting and using the tools is free.

Video coming soon0:45
Connect Claude to Markdrop and publish a doc. A short screen recording will play here.

Add it to your app

#

On claude.ai and in Claude Desktop:

  1. Open Settings → Connectors.
  2. Choose Add custom connector, name it Markdrop and paste the server URL.
  3. Choose Connect. Markdrop opens in your browser: sign in and approve.
  4. In a chat, ask Claude to publish something to Markdrop.

On Team and Enterprise plans, an owner may need to add the connector for the organisation first.

Approve the app

#

When the app sends you to Markdrop, you see which app is asking, the account you're signed in as, and what it will be able to do. Choose Approve to connect it, or Cancel to send it away with nothing shared.

The approval link works once, for 10 minutes. If it has expired, start again from your AI app.

The two permissions

#
PermissionOn the approval screenLets the app
documents:readSee your documents and filesRead titles, contents, links and view counts; list and search; check files, uploads, shares and workspaces.
documents:writePublish and manage documents for youPublish, update, change access to and delete documents and files; upload and replace files; file documents in workspaces.

Each tool needs one of them; MCP tools lists which. If an app calls a tool it wasn't given permission for, it is asked to reconnect and approve the missing permission.

Things to ask

#

Say it the way you would to a colleague:

  • "Turn these meeting notes into a Markdrop doc and give me the link."
  • "Build an HTML dashboard of this CSV and publish it."
  • "Make my Q3 report private."
  • "How many people read my launch notes?"
  • "Where do people stop watching the demo video?"
  • "Put the onboarding guide in Acme's guides/setup folder."
  • "Is this share link still working? markdrop.in/share/4f9a2c71e0"

Manage connected apps

#

Every app you approve is listed in Settings → Connected apps. Choose Disconnect on an app to end its access: its current sign-in stops working and it can't renew it. To use it again, connect it from the app as before. More in Connected apps.

Privacy

#
  • The app gets its own token for this server, never your Markdrop sign-in.
  • It can't read end-to-end encrypted documents, and it never gets past a password, private access or a workspace's sign-in.
  • Markdrop logs which tool ran, when, and whether it worked, for 90 days. It doesn't log what was in the call.
  • What the assistant reads from Markdrop becomes part of your conversation, so your AI provider's own data policy applies to it.

Limits

#

Each account can make up to 60 calls to writing tools and 300 calls to reading tools per minute, across all its connected apps. Past that, the tool answers "Too many requests in a short time. Wait a minute before trying again."

get_document returns at most 200,000 characters of a document and says when it cut the text.

For developers

#

Details for people building or debugging an MCP client:

EndpointPOST https://api.markdrop.in/mcp, Streamable HTTP. The server is stateless: GET and DELETE answer 405.
Protocol versions2024-11-05, 2025-03-26, 2025-06-18, 2025-11-25 and 2026-07-28
AuthorizationOAuth 2.1 authorization code flow with PKCE (S256). Clients register with dynamic client registration (/oauth/register) or a client ID metadata document.
Metadatahttps://api.markdrop.in/.well-known/oauth-protected-resource/mcp and https://api.markdrop.in/.well-known/oauth-authorization-server
Redirect URIshttps, http to a loopback address, or an app's own scheme (for example cursor://)
TokensAccess tokens last 1 hour and are valid only for this server. Refresh tokens last 60 days and change on every use; reusing an old one revokes the whole chain.
Not acceptedmdk_ API tokens and markdrop.in session tokens. They are refused rather than downgraded.

A request without a token gets 401 with a WWW-Authenticate header that points to the metadata. A token missing a permission gets 403 with error="insufficient_scope" and the scope it needs.

#
Did this page help?