Dropimg for Cursor

Upload a screenshot from Cursor and get a temporary shareable Dropimg link.

This plugin is a thin package around the existing remote Dropimg MCP server. Cursor talks to https://dropimg.io/mcp over Streamable HTTP. There is no local Node or Python process.

Product page: dropimg.io/mcp

What it does

Dropimg hosts an image for a limited time and returns a short URL. From Cursor, the agent can:

• Upload a PNG, JPEG, WebP, or GIF and receive a temporary link
• Look up one of your live uploads by id
• List your live uploads
• Delete one of your uploads by id

The plugin does not run uploads on your machine beyond sending image bytes to Dropimg. The same write path as the website, ShareX, the browser extension, and the REST API is used on the server.

Install from Cursor Marketplace

1. Open Cursor Marketplace or go to cursor.com/marketplace.
2. Search for Dropimg.
3. Install the plugin.
4. When Cursor prompts, sign in to Dropimg and approve access (Connect DropIMG).
5. Confirm dropimg appears under Customize → MCP.

Until the listing is public, use the manual steps below.

Manual / local testing

1. Clone this repository.

2. Copy the folder into Cursor’s local plugin directory (a symlink to a path outside that folder is often ignored):

   rsync -a --delete ./ ~/.cursor/plugins/local/dropimg/

3. In Cursor, run Developer: Reload Window.

4. Open Customize → MCP and confirm the dropimg server.

5. Authenticate when Cursor starts the OAuth flow.

6. Ask the agent to upload a screenshot and confirm the returned https://dropimg.io/… URL opens.

Optional CLI load (if your Cursor build supports it):

cursor --plugin-dir /path/to/dropimg-cursor

Authentication

A Dropimg account is required. Anonymous MCP use is not available.

Cursor should authenticate with OAuth against the production MCP:

• Resource: https://dropimg.io/mcp
• Authorization server metadata: https://dropimg.io/.well-known/oauth-authorization-server
• Protected resource metadata: https://dropimg.io/.well-known/oauth-protected-resource/mcp
• Scopes: images:write, images:read, images:delete
• Dynamic client registration / Client ID Metadata Document is enabled on the server
• PKCE (S256) is required

The authorize page is Connect DropIMG. If you are signed out, Dropimg sends you through the existing magic-link login, then back to the consent screen.

This plugin does not ship an API key, OAuth client secret, or token. Do not put dropimg_api_… keys in mcp.json.

The production server also accepts a Bearer API key created on Integrations. That is for other MCP clients and for debugging. Cursor Marketplace install should use OAuth.

Available MCP tools

Exact tools exposed by https://dropimg.io/mcp:

Tool	Arguments	Result
upload_image	image (required): raw base64 or a data:image/…;base64 URL. expiry (optional): 1h, 24h, 7d, 30d, or 90d	Temporary Dropimg URL and expiry timestamp
get_image	id: 8-character image id	URL, created time, and expiry for one of your live images
list_images	cursor (optional)	Your live images; may include next_cursor
delete_image	id: 8-character image id	Confirms deletion of one of your images

get_image, list_images, and delete_image only see images owned by the signed-in account. Other people’s slugs, expired images, and tombstoned images return not found.

There are no tools for albums, transforms, passwords, PDFs, or arbitrary file types.

Example prompts

These match the deployed tools:

• “Upload this screenshot and give me a temporary link.”
• “Upload this PNG for 24 hours.”
• “List my recent Dropimg uploads.”
• “When does Dropimg image abc123xy expire?”
• “Delete the Dropimg image with ID abc123xy.”

The agent must send image bytes as base64 or a data URL. Point it at a real PNG, JPEG, WebP, or GIF in the workspace.

Supported files

Verified against the production upload inspector:

• PNG (image/png)
• JPEG (image/jpeg)
• WebP (image/webp)
• GIF (image/gif)

Rejected: SVG and any other type. Maximum 50 megapixels. Current production size cap for this path is 10 MB.

This MCP server uploads images, not PDFs or generic documents.

Expiry behavior

expiry is optional. If omitted, Dropimg uses the account default (7 days when that lifetime is allowed).

Allowed labels, subject to the signed-in plan:

• Free: 1h, 24h, 7d
• Pro: those plus 30d and 90d

The plan allowlist is enforced on the server. A Pro-only lifetime on a Free account is rejected.

Links are temporary. There is no permanent archive. Free history lists the last 10 live images; Pro lists are paginated. Expired or deleted images leave active hosting; cleanup is finished by background jobs and storage lifecycle rules.

MCP create responses do not include a delete token. Delete with delete_image and a Bearer/OAuth credential that has images:delete.

Data handling

Based on the current Dropimg implementation and Privacy Policy:

• What is sent: image bytes (base64 or data URL) and an optional expiry label. Cursor sends those to https://dropimg.io/mcp only. This plugin does not add other destinations.
• Uploads are intentional: using upload_image stores the image on Dropimg so it can return a share URL. Anyone with the live unprotected link can open the image until it expires or is deleted.
• Account: MCP requires a Dropimg account. Uploads are attached to that account (source=mcp) and can appear in My drops. Sign-in uses a one-time magic-link email; OAuth then grants images:write, images:read, and/or images:delete.
• What Dropimg stores for an upload: processed image bytes, MIME type, size, optional width/height, created/expiry times, and a random 8-character slug. Original filenames are not stored. EXIF/XMP-style metadata is stripped when supported; if stripping fails, the upload is rejected.
• Rate limits: Dropimg hashes a fingerprint from the client IP for quota and abuse controls. It does not store raw IPs in the application database for uploads.
• Expiry and deletion: images expire on the chosen lifetime, or sooner if you call delete_image or delete from My drops. Deleting a Dropimg account revokes integration tokens and removes active images.
• This plugin: JSON manifests, a logo, this README, and an MIT license. No tokens, no shell hooks, no local executables.

Full legal text: Privacy · Terms

Privacy and security

• MCP traffic is configured only to https://dropimg.io/mcp.
• No secrets are stored in this repository.
• The plugin requests no Cursor hooks, rules, agents, commands, or extra permissions.
• Share URLs are unguessable but not a login. Treat a live link as public unless you later add a password in the Dropimg product UI (the MCP upload tool does not set passwords).

Links

• MCP product page: https://dropimg.io/mcp
• REST API: https://dropimg.io/developers
• OpenAPI: https://dropimg.io/openapi/v1.yaml
• Integrations (API keys, if you need one outside Cursor): https://dropimg.io/app/integrations
• Privacy: https://dropimg.io/privacy
• Terms: https://dropimg.io/terms
• Product: https://dropimg.io

Development / validation

This repo is packaging only. The MCP server lives in the Dropimg Worker.

Checklist before submit:

• .cursor-plugin/plugin.json name is dropimg (kebab-case)
• mcp.json points at https://dropimg.io/mcp and has no secrets or ${VAR} placeholders
• assets/logo.svg is committed and referenced as a relative path
• README documents setup, tools, auth, expiry, and data handling
• LICENSE is MIT
• Repository is public
• Local copy under ~/.cursor/plugins/local/dropimg loads in Customize → MCP
• OAuth completes and tools appear
• One real upload_image returns a working Dropimg URL
• list_images / get_image / delete_image work on that upload
• No API keys or tokens in git history