About Drop Beacon
Drop Beacon MCP provides read-only discovery of EDC products through Drop Beacon's public catalog API. It is for MCP clients that need product searches, recent drops, brand details, and availability listings without credentials.
Key features
- 01Search currently available catalog products
- 02Find recent in-stock drops
- 03Retrieve public brand profiles
- 04Check matching available listings
- 05Credential-free access to public catalog data
Use cases
- 01Find EDC products by category or search term
- 02Check recent product listings
- 03Review a brand's profile and product count
- 04Compare matching availability listings
MCP support
The MCP server exposes four read-only tools: `search_products`, `get_latest_drops`, `get_brand_info`, and `check_availability`. It reads public data from Drop Beacon's HTTPS catalog API without credentials.
Configuration
Local server config is the same for every client. Copy it into your client’s MCP config file.
npx -y drop-beacon-mcpDATABASE_URLSecretNeon PostgreSQL connection string for the Drop Beacon databaseAPI_KEYSecretOptional API key for authenticated accessLocal servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.
Tools
6Saved tool list · updated 2w ago
| Parameter | Type | Required | Description |
|---|---|---|---|
| api_key | string | No | Optional API key for authenticated access. |
| query | string | No | Search keyword to match against product titles (e.g., 'titanium knife', 'Olight flashlight', 'fidget spinner') |
| category | string | No | Filter by product category. Options: knives, wallets, flashlights, pens, fidgets_haptics, multi_tools, watches, bags |
| brand | string | No | Filter by brand name (e.g., 'Spyderco', 'Benchmade', 'Olight', 'Magnus') |
| limit | number | No | Number of results to return (default: 10, max: 25) |
Details
From the project READMEDrop Beacon MCP
Read-only EDC product discovery through Drop Beacon's public HTTPS catalog API. No database password, DATABASE_URL, or API key is required.
Install
Requires Node.js 20 or newer. Configure your MCP client:
{
"mcpServers": {
"drop-beacon": {
"command": "npx",
"args": ["-y", "[email protected]"]
}
}
}
Tools
| Tool | Public data returned |
|---|---|
search_products | Up to 25 currently available catalog matches |
get_latest_drops | Recent in-stock listings first seen within seven days |
get_brand_info | Public brand profile and available-product count |
check_availability | Up to 10 matching available listings |
Categories: knife, fidget, flashlight, pen, wallet, multi_tool, patch, other.
Search arguments accept up to 120 characters. Results are catalog snapshots, not guarantees of current retailer stock. Compare the exact material, configuration and condition on the linked product page. No match does not mean unavailable everywhere. First seen means discovered by Drop Beacon, not released by the manufacturer.
Migration from 0.2.x
Remove DATABASE_URL and API_KEY from client and hosted-service settings. Upgrade any cached installation to 0.3.0 or newer. If a real database password was ever shared, revoke it with the database provider; editing a listing alone cannot revoke access.
Direct SQL access, arbitrary URLs, private records, and internal market analytics are not supported. get_market_trends and get_price_comparison have been retired from this public MCP; use the market pages and product comparison on the website. The old optional API_KEY gate and legacy SSE endpoints are removed. Do not send credentials as tool arguments.
Security boundary
The package has no database driver and only performs credential-free GET requests to https://edc4me.com/api/drops and /api/brands. Explicit output allowlists prevent new upstream fields from silently becoming MCP output. Requests reject redirects, time out after 15 seconds, cap response bodies at 2 MB, and return generic errors without upstream response bodies. Tool arguments cannot override the origin, endpoint, HTTP method, or headers.
The process allows 60 tool calls per minute, shared across clients and reset on restart; this is a best-effort local limit, not a distributed quota. The public API also applies its own edge protections. A 429 response asks the client to wait, never to supply database access.
Stdio is the default. Optional stateless HTTP uses PORT, binds to loopback by default, and serves POST /mcp plus GET /health. Hosted services can explicitly set HOST=0.0.0.0. Browser origins other than https://edc4me.com are rejected, request bodies are limited to 64 KB, and batched requests are rejected. No customer-specific authentication is needed because only public catalog data is available.
Development
npm ci && npm test
npm run security:scan scans tracked files, including documentation and environment examples, without printing secret values. See SECURITY.md for limitations and local hook setup.
Drop Beacon · Public API · MIT
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.