MCP server (JSON-RPC 2.0, stateless)

Streamable-HTTP-free, stateless MCP endpoint (spec 2026-07-28). Methods: server/discover, tools/list, tools/call, plus legacy initialize. Tools: deploy_html, deploy_files, append_files, list_drops, claim_drop, restore_drop, delete_drop, set_drop_password, remove_drop_password, get_limits, get_account. Auth is optional pass-through: send Authorization: Bearer sp_… to act as an account, omit for anonymous deploys. deploy_html and deploy_files accept an optional password string for active paid Pro/Team accounts; it is sent as the encoded X-Ship-Password header, never a query parameter. set_drop_password takes slug + password; remove_drop_password takes slug and works even after a plan lapses. Client config: "ship.page": { "url": "https://ship.page/mcp" }.