Artifacta

io.artifactaPublished by artifacta.ioOfficial publisherv1.0.5Updated Oct 25, 2026

Artifact store for AI agents. Hosted OAuth at mcp.artifacta.io/mcp; local stdio via npm/PyPI.

VerifiedStreamable HTTPWeb executableCloud & InfrastructureFiles & StorageDeveloper Tools

Overview

AI-generated overview

Artifacta is an artifact store for AI agents, letting an assistant save, list, fetch, share and publish run outputs such as files, reports and datasets.

What you can do
Verify credentials and inspect tenant and plan details with whoami, plus MCP resources for identity, sessions and artifact metadata and bytes. Upload artifacts from inline content or a local path, including a two-phase presigned upload for large files. Look up artifact metadata by ID, get presigned download URLs, and list or filter artifacts by session, agent or metadata. List active sessions and seal a session so no further artifacts can be added. Create public expiring share links, soft-delete artifacts, and publish or unpublish an artifact as a public page.
When to use it
Useful when an agent produces files, reports, datasets or build results that should persist beyond a session, be handed off to another session, or be shared through expiring links. Also fits teams that want a hosted store with OAuth scopes or a local stdio setup for headless and CI environments.
Requirements
Either the hosted endpoint at mcp.artifacta.io, which self-registers via OAuth with PKCE and a browser consent screen, or a local stdio process: npm package @artifacta-mcp/mcp on Node 20+, or PyPI package artifacta-mcp on Python 3.10+. Local and CI use needs an ARTIFACTA_API_KEY (ak_live_...) from the Artifacta dashboard. Network access to Artifacta is required.
Before you install
Local-file uploads are confined to an explicit allow-path list, and destructive tools (public share links, deletes, session seals) are hidden unless allow-destructive is passed. Hosted OAuth grants one of three scopes (read, write, destroy); API keys and local stdio are full-access. Publishing creates a public page, unlisted by default, and share links are public and expiring. Stored artifacts and metadata go to Artifacta's servers.

Installation

In SourceWeft

  1. Open Artifacta in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.artifacta%2Fmcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "artifacta": {
      "type": "http",
      "url": "https://mcp.artifacta.io/mcp"
    }
  }
}

README

Artifacta MCP Server

[npm] [PyPI] [License: MIT]

Official MCP server for Artifacta — an artifact store purpose-built for AI agents. Agents persist run outputs (files, reports, datasets, build results) with session and agent metadata, hand them off across sessions, and share them via expiring download links. Content-hash dedup means re-storing the same bytes is free.

Listed in the official MCP registry as io.artifacta/mcp.

Two implementations with the same tool surface, error contract, and path-confinement engine:

DirectoryPackageRuntime
typescript/@artifacta-mcp/mcpNode 20+
python/artifacta-mcpPython 3.10+

Install as a Claude Code plugin

For Claude Code, the fastest path is the plugin marketplace this repo doubles as — it wires up the hosted server and a skill that persists run outputs automatically:

text
/plugin marketplace add SagaPeak/artifacta-mcp/plugin install artifacta@artifacta

This bundles the same hosted MCP connection as the Quick start below plus the persisting-outputs skill (/artifacta:persisting-outputs, or it auto-triggers when a session has outputs worth saving). Update the plugin with /plugin marketplace update artifacta. See the plugin setup guide.

Quick start

The fastest way to connect is the hosted server — no install, no API key:

bash
claude mcp add --transport http artifacta https://mcp.artifacta.io/mcp

On first use your client self-registers via OAuth Dynamic Client Registration (PKCE) and opens a browser to authorize — no ak_live_ key to copy or store. See the hosted setup guide.

Local / CI (stdio)

For headless, air-gapped, or CI environments where a browser OAuth flow isn't available, run the package locally over stdio with an API key. Get a key at app.artifacta.io/dashboard/keys, then add to your MCP client config (Claude Desktop, Claude Code, Cursor, or any MCP client):

json
{  "mcpServers": {    "artifacta": {      "command": "npx",      "args": ["-y", "@artifacta-mcp/mcp"],      "env": {        "ARTIFACTA_API_KEY": "ak_live_..."      }    }  }}

Or run the Python implementation with pipx run artifacta-mcp.

See the per-package READMEs for config-file profiles, path confinement (--allow-path), destructive-tool gating (--allow-destructive), and troubleshooting: TypeScript · Python.

Tools

ToolDescription
whoamiVerify credentials; returns tenant and plan info
store_artifactUpload an artifact from inline content or a local path
request_upload_url / complete_uploadTwo-phase presigned upload for large files
get_artifactFetch artifact metadata by ID
get_artifact_download_urlGet a presigned download URL (1h expiry)
list_artifactsList/filter artifacts by session, agent, or metadata
list_sessionsList active sessions
seal_sessionSeal a session so no further artifacts can be added (gated behind --allow-destructive)
create_download_linkCreate a public expiring share link (gated behind --allow-destructive)
delete_artifactSoft-delete an artifact (gated behind --allow-destructive, same gate as create_download_link)
publish_artifactPublish an artifact as a public page at artifacta.io/a/{slug} (Artifact Pages); idempotent, unlisted by default
unpublish_artifactTake down an artifact's public page; the artifact itself is untouched; idempotent

Plus MCP resources for whoami, artifact metadata, artifact bytes, and sessions.

Safety defaults: local-file uploads are confined to an explicit --allow-path allow-list, and destructive tools (public share links, deletes, session seals) are hidden from clients that can't confirm writes unless --allow-destructive is passed. publish_artifact and unpublish_artifact are idempotent write operations, not destructive ones — they are not gated behind --allow-destructive.

Hosted OAuth connections (mcp.artifacta.io) add a second layer: the consent screen grants one of three scopes — artifacts:read ⊆ artifacts:write ⊆ artifacts:destroy. All 13 tools are always advertised in tools/list; calling a tool the token wasn't granted for returns a tool error with code insufficient_scope naming the missing scope, and the fix is to re-authorize with the broader scope. Scope gating applies only to hosted OAuth — ak_live_ API keys and local stdio remain full-access, using --allow-destructive / confirmation flags instead.

Framework integrations

The Python package ships optional adapters for OpenAI Agents SDK (pip install 'artifacta-mcp[openai-agents]') and LangChain/LangGraph (pip install 'artifacta-mcp[langchain]').

Documentation

Full docs at docs.artifacta.io/mcp/overview.

Development

bash
# TypeScriptcd typescript && npm install && npm test
# Pythoncd python && python -m venv .venv && source .venv/bin/activatepip install -e '.[dev]' && pytest

This repository is published from the Artifacta monorepo; issues and PRs are welcome here.

License

MIT — see LICENSE.

Source: README.md at commit ed4df0c

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

1
  1. v1.0.5LatestSep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts