FastDrop MCP API

openapi: 3.2.0
info:
  title: FastDrop MCP API
  version: 1.3.0
  description: 'FastDrop is the liveness layer for agent-ready software: the official MCP Registry authenticates who published a server, FastDrop probes whether it still answers, and publishes the tools each endpoint actually returned.


    Three surfaces, one API:

    - `POST /mcp` - a Streamable HTTP MCP server (JSON-RPC 2.0). Read tools (list_launches, get_engagement_feed, get_product, get_maker, search_products, find_tools, list_reviews, list_comments, get_launch_day_status, get_install_config, find_alternatives, compare_products, find_deals) are unauthenticated; write tools (submit_product, update_product, toggle_vote, post_review, post_comment, recheck_mcp, check_submission_status, invite_collaborator, get_my_stats, get_inbox, mark_notifications_read, get_launch_kit, follow, list_following, list_webhooks, create_webhook, delete_webhook, test_webhook, update_profile, set_deal, set_open_to) require a Bearer token. Prompts (prompts/list, prompts/get): launch_my_product, daily_engagement, find_tools_for, launch_report.

    - `GET /v0.1/servers` - an MCP Registry-compatible subregistry (OpenAPI shape) with a `dev.fastdrop/verification` liveness block in `_meta`. Unauthenticated, cursor-paginated.


    When to use this API: discover agent-ready products by probed capability (not marketing tags), check whether an MCP endpoint currently answers, submit or update your own listing programmatically, and poll submission status. When NOT to use it: identity verification of server publishers (that is the official registry at registry.modelcontextprotocol.io) and human browsing (use the website).


    Agent resources: llms.txt at /llms.txt (complete reference at /llms-full.txt), developer docs at /developers, sitemap at /sitemap.xml, MCP server manifest at /.well-known/mcp.'
  contact:
    name: FastDrop
    url: https://fastdrop.dev/contact
    email: privacy@fastdrop.dev
servers:
- url: https://fastdrop.dev
  description: Production
tags:
- name: MCP
  description: Model Context Protocol server over Streamable HTTP. JSON-RPC 2.0 bodies; see https://modelcontextprotocol.io
paths:
  /mcp:
    post:
      tags:
      - MCP
      operationId: callMcp
      summary: Call an MCP method (initialize, tools/list, tools/call, prompts/list…
      description: 'Single MCP Streamable HTTP endpoint. Start with `initialize`, then `tools/list`, then `tools/call`. Read tools need no auth. Write tools require `Authorization: Bearer fd_...` (API key) or an OAuth access token with the `mcp` scope - a 401 with WWW-Authenticate triggers OAuth discovery (RFC 9728). Anonymous `initialize` responses carry an `Mcp-Session-Id` header; send it back on later calls so lookups are credited to your agent (optional - calls without it still work). Rate limit: 60 POSTs/min per IP.'
      security:
      - {}
      - ApiKeyAuth: []
      - FastDropOAuth:
        - mcp
      parameters:
      - name: MCP-Protocol-Version
        in: header
        required: false
        description: Negotiated MCP protocol version. If omitted, FastDrop assumes 2025-03-26 for compatibility.
        schema:
          type: string
          example: '2025-03-26'
      - name: Accept
        in: header
        required: false
        description: MCP clients should accept application/json and text/event-stream.
        schema:
          type: string
          example: application/json, text/event-stream
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/JsonRpcRequest'
            examples:
              initialize:
                summary: Handshake
                value:
                  jsonrpc: '2.0'
                  id: 1
                  method: initialize
                  params:
                    protocolVersion: '2025-06-18'
                    capabilities: {}
                    clientInfo:
                      name: my-agent
                      version: 1.0.0
              toolsCall:
                summary: Find products by probed capability
                value:
                  jsonrpc: '2.0'
                  id: 2
                  method: tools/call
                  params:
                    name: find_tools
                    arguments:
                      query: web search
      responses:
        '200':
          description: JSON-RPC response. Tool-level failures arrive as HTTP 200 with result.isError=true; auth-gated tools arrive as HTTP 401 with a JSON-RPC body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonRpcResponse'
        '202':
          description: Notification accepted; no JSON-RPC response body is returned.
        '400':
          description: Parse error, invalid request, or unsupported MCP-Protocol-Version
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonRpcResponse'
        '401':
          description: Authentication required for a write tool. WWW-Authenticate points at /.well-known/oauth-protected-resource/mcp for OAuth discovery.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonRpcResponse'
        '403':
          description: The request Origin is not allowed.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonRpcResponse'
        '429':
          description: Rate limit exceeded (60 POSTs/min per IP)
          headers:
            Retry-After:
              schema:
                type: string
              description: Seconds to wait
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonRpcResponse'
    get:
      tags:
      - MCP
      operationId: mcpGetInfo
      summary: Method not allowed (no SSE stream on this server)
      description: This server does not offer the optional GET SSE stream. Use POST for all MCP traffic; the server manifest lives at /.well-known/mcp.
      responses:
        '405':
          description: Use POST; see Allow header
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    JsonRpcRequest:
      type: object
      required:
      - jsonrpc
      - method
      properties:
        jsonrpc:
          type: string
          enum:
          - '2.0'
        id:
          description: Request id (omit for notifications)
          type:
          - string
          - number
        method:
          type: string
          enum:
          - initialize
          - tools/list
          - tools/call
          - ping
          - resources/list
          - prompts/list
          - prompts/get
        params:
          type: object
    Error:
      type: object
      description: Structured error returned by REST endpoints (MCP uses JSON-RPC errors)
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              description: Stable machine-readable error code
              example: NOT_FOUND
            message:
              type: string
              description: Human-readable message
            hint:
              type: string
              description: Resolution hint for agents
              example: See /openapi.json for the API surface.
            docs:
              type: string
              format: uri
              description: Documentation URL
          required:
          - code
          - message
      required:
      - error
    JsonRpcResponse:
      type: object
      required:
      - jsonrpc
      - id
      properties:
        jsonrpc:
          type: string
          enum:
          - '2.0'
        id:
          type:
          - string
          - number
          - 'null'
        result:
          type: object
          description: Method-specific result. tools/call results carry content[], structuredContent, and optional isError=true for tool-level failures.
        error:
          type: object
          properties:
            code:
              type: integer
            message:
              type: string
  securitySchemes:
    ApiKeyAuth:
      type: http
      scheme: bearer
      bearerFormat: fd_
      description: FastDrop API key (starts with fd_). Create one in the dashboard at /app/developer (Developer tab). Grants read access plus write access to your own submissions, votes, reviews, and comments over /mcp. Revoke any time; no scope narrowing on keys - prefer OAuth when a client only needs MCP access.
    FastDropOAuth:
      type: oauth2
      description: OAuth 2 for MCP clients (RFC 8414 metadata at /.well-known/oauth-authorization-server, protected-resource metadata at /.well-known/oauth-protected-resource/mcp). Public clients supported (empty client secret on the token endpoint).
      flows:
        authorizationCode:
          authorizationUrl: https://fastdrop.dev/api/auth/oauth2/authorize
          tokenUrl: https://fastdrop.dev/api/auth/oauth2/token
          refreshUrl: https://fastdrop.dev/api/auth/oauth2/token
          scopes:
            mcp: Call the FastDrop MCP server (/mcp) on behalf of the signed-in user. Read tools plus their own submissions, votes, reviews, and comments - nothing else.
            offline_access: Receive refresh tokens so a long-lived agent session can renew access without re-consent.
externalDocs:
  description: FastDrop developer documentation
  url: https://fastdrop.dev/developers