artifact-site

io.github.lexmountPublished by GitHub account lexmountv0.4.0Updated Oct 24, 2026

One place for every AI agent's pages and docs: versioned links to share, search and update.

VerifiedStreamable HTTPWeb executableProductivity & WorkflowFiles & StorageKnowledge & Memory

Overview

AI-generated overview

Self-hosted or cloud workspace where an assistant publishes, updates, searches and shares agent-produced pages and documents as versioned links.

What you can do
  • Publish HTML, static site folders, ZIPs, PDFs and Office documents, including chunked uploads of large sites
  • Update published sites, edit HTML text or source, and roll back or copy earlier versions
  • Search published work by content, including Chinese, and read extractable text
  • Manage sharing and access: main-link visibility, named people, passcode holders, export and deletion
When to use it
Useful when several agents produce reports, dashboards or docs that need one shared, linkable home with version history and access control, instead of scattered local files and chat histories. It fits teams that want to host such work on their own infrastructure or use the hosted cloud version.
Requirements
Remote endpoint at the deployment's /mcp path, or the npm CLI package run locally (Node 24+ for the CLI). A deployment address in ARTIFACT_SITE_URL and a personal token in ARTIFACT_SITE_TOKEN, or OAuth sign-in through the server's consent page; the token is optional after a CLI login. Self-hosting needs Git, Make, Bash, Docker 24+ with Compose 2.24+, and optionally an OIDC provider.
Before you install
Publishing, updating, sharing and deleting are write actions on hosted content; new artifacts are private by default and main-link access must be opened explicitly. The personal token in ARTIFACT_SITE_TOKEN grants publishing rights and should be kept secret. Uploaded pages run in a sandbox and cannot use the platform login session; external API calls need an origin allowlist. Anonymous uploads expire after a few days.

Installation

In SourceWeft

  1. Open artifact-site in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.lexmount%2Fartifact-site/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "artifact-site": {
      "type": "http",
      "url": "https://artifact-site.app.lexmount.com/mcp"
    }
  }
}

README

[artifact-site — A shared home for AI-generated pages and documents, on your own server. Open source, self-hosted, agent-ready.]

artifact-site

English | 简体中文 | 日本語 | Deutsch | Français | Español

[CI] [License: Apache-2.0 OR MIT] [Node 24] [Roadmap] [npm] [GitHub Release]

There are now so many AI agents to choose from, but their output is scattered across your computer, chat histories and different platforms’ clouds, making it hard to organize, share and revisit.

artifact-site is a self-hosted workspace for individuals and teams, similar to Claude Artifacts or OpenAI Sites. Your various agents create the work; artifact-site brings it together, turning pages and documents into links for sharing, comments and feedback, access control and version history. The agents you already use can keep editing, publishing, searching and updating that work through the CLI or MCP.

You can self-host artifact-site or use the cloud version hosted by Lexmount.

Use the cloud version — hosted by Lexmount, with no deployment required. Drag and drop a file to publish it and get a shareable link. Upload without signing in, or sign in with Google or GitHub to keep your sites, organize them in folders and control who can open each link.

Anonymous uploads expire after a few days.

[Dropping an HTML dashboard onto artifact-site: it becomes a link within seconds, renders in a sandboxed frame, and the sharing panel copies the link]

Drop a file, get a link, share it. View your published work online and choose who can open it in the sharing settings.

Why artifact-site

  • Keep work in one place. Organize pages and documents in folders and find them with full-text search, including Chinese. Team members and agents can find the work they have permission to access.
  • Drop it in and share it. Upload HTML, a build folder, a ZIP or a document to get a link. Large sites upload in chunks. Share with everyone, signed-in users, named people or passcode holders.
  • Keep improving published work. Edit HTML text or source in the browser, or let an agent update the whole site. Each change keeps a version, with rollback and the option to save a copy.
  • Let agents pick up where they left off. Publish and update through the guide, CLI or MCP, then search by content and read extractable text. For example, find a previous report and update it at the same address for your team to view.

How it compares

For your teamClaude Artifacts / Claude Code ArtifactsChatGPT Sites (OpenAI)artifact-site
HostingAnthropic-managedOpenAI-managedYour server, with local or S3-compatible file storage
Publishing workflowWithin Claude / Claude CodeWithin ChatGPT SitesAny tool via file upload, CLI or remote MCP
Content focusInteractive artifactsHosted websites and appsStatic HTML, build folders, ZIPs, PDF and Office documents¹
IdentityClaude accountsChatGPT accountsYour OIDC provider, such as Google, Keycloak or Okta

¹ Office online preview requires Gotenberg. artifact-site hosts finished files; it does not run application backends or build jobs.

Claude Artifacts and ChatGPT Sites combine creation and hosted sharing. artifact-site complements those workflows with a shared home on your own infrastructure for pages and documents produced by different tools.

Product scope and sharing vary by plan and evolve; see the official Claude Artifacts and ChatGPT Sites guides.

Contents

What you can publish

ContentWhat you can do
HTML, static site folders, ZIPsUpload and preview single-page or multi-page sites, including build output such as dist/. HTML pages support visual text editing and source editing.
PDFRead online, search and extract text.
Office documents, such as PPTX and DOCXStore and download originals; enable Gotenberg for online preview.

Build web projects into static files before uploading; the platform does not run application backends or build jobs. PDF and Office documents do not support visual HTML editing, and scanned images are not automatically OCRed.

Hosted pages run in a sandbox and cannot use the platform's login session. External API connections require an origin allowlist. See the runtime limits and security design.

Quick start (local deployment)

You can use the cloud version without installing anything. To deploy locally, run the three commands below. You need Git, Make, Bash, Docker 24+ and the Compose plugin 2.24+. On macOS, use Docker Desktop; on Windows, run the commands inside WSL2 with Docker Desktop’s WSL integration enabled. No Node installation, domain or identity provider is needed.

bash
git clone https://github.com/lexmount/artifact-site.git && cd artifact-sitecp .env.example .envmake build up

Once started, open http://127.0.0.1:4300 and drop in HTML, a static site folder or a PDF to view your work. New sites are private by default; change main-link access in Sharing before sending it to someone else.

The first run downloads dependencies and builds the image, then starts the app and Postgres. Use these commands in a fresh clone. The service is local-only by default; make down stops it and retains data. To make it reachable by your team, follow Deploy for your team.

Need a file to try? Create a sample page
bash
printf '<!doctype html><meta charset="utf-8"><title>Hello</title><h1>Hello, artifact-site!</h1>' > hello.html

Drop hello.html onto the home page (or choose Upload). You should see “Hello, artifact-site!”. Copy a link from the sharing settings; local-deployment links only open on the same machine.

Connect a coding agent

Choose the entry point that fits your agent:

  • Skill: npx skills add lexmount/artifact-site — install the agent skill and give your agent your server URL.
  • CLI: npm install -g @artifact-site/cli — requires Node 24+; use the commands below.
  • MCP: https://your-server/mcp — connect ChatGPT, Claude or another MCP client through the server’s OAuth sign-in; no CLI installation required. A client that only starts local MCP servers can run the CLI’s artifact-site mcp instead.

CLI and MCP create private artifacts by default, without independent share links. Use artifact-site visibility <slug> unlisted or MCP artifact_site_set_visibility when the user asks to share the main link.

[A coding agent publishes a build folder with the artifact-site CLI and hands back the share link]

Or let your coding agent do it. With the agent guide (/for-agents.md), the CLI or the MCP server, "publish this and give me a link" is one instruction — and the site can be updated, searched and read the same way.

Give this instruction to Claude Code, Cursor, Codex or another coding agent that can read URLs, using a server address it can reach. The home page also provides a copy button with your server address filled in:

text
Publish this project's output to artifact-site. Publishing guide: https://your-server/for-agents.md

CLI examples (login requires OIDC):

bash
artifact-site login --base https://your-server        # one-time device sign-inartifact-site publish dist/ --title "Q3 dashboard"    # publish and return linksartifact-site find "quota"                           # search by contentartifact-site read YOUR_SITE_SLUG                    # replace with a site slug to read its text
Authentication details

Open Agent guide on your deployment to choose the prompt, CLI or MCP path. /for-agents#cli and /for-agents#mcp provide server-specific commands, authentication steps and client configuration. Remote MCP authenticates every request: ChatGPT, Claude and other OAuth-capable clients sign in through the server's own consent page, other clients carry a personal token. Publishing is private by default; open main-link access explicitly with the visibility operation. Advanced independent links are opt-in.

Team deployments with OIDC support device sign-in approval; the anonymous local setup above does not require it. The agent follows the guide and the server's publishing policy to choose authentication. A cloud agent cannot directly reach 127.0.0.1 on your computer.

The login example requires OIDC. Remote MCP is a separate, complete entry point at https://your-server/mcp: no CLI installation is required. ChatGPT, Claude and any client that implements MCP authorization connect with the address alone and sign in through the server's OAuth consent page; for other clients, the deployment's /for-agents#mcp page creates a personal token and copies the authenticated configuration. It supports publishing, updating, search, read, sharing, versions, export and deletion, including binary files and directory uploads through MCP tools.

See CLI commands and remote MCP setup and tools.

Deploy for your team

Start from .env.example and follow SELFHOST.md for a production deployment. Use a stable public address for ARTIFACT_PUBLIC_URL: sign-in callbacks, request-origin checks and the address given to agents derive from it:

  • Set a reachable ARTIFACT_PUBLIC_URL and configure a reverse proxy, or set ARTIFACT_WITH_CADDY=on with ARTIFACT_DOMAIN to enable Caddy and automatic certificates.
  • Choose a publishing policy. login requires OIDC; token serves scripts or agents with a Bearer token; open lets anyone who can reach the service publish and suits trusted internal networks. Anonymous publishing supports separate quotas and expiry.
  • Connect Google or an OIDC provider such as Keycloak, Logto, Authentik, Okta or Auth0. Accounts own sites and folders; agents can receive long-lived tokens through device sign-in. The default ARTIFACT_ENFORCE_OWNERSHIP=on enables account-based access control once OIDC is configured. Add administrators' verified sign-in emails to ARTIFACT_ADMIN_EMAILS to enable the admin console.
  • Enable Office preview with ARTIFACT_WITH_GOTENBERG=on. The admin console manages take-downs, quotas, anonymous-site expiry and policy switches. Choose default visibility and schedule backups.

The app ships as one Docker image with bundled Postgres in the single-host setup. To use an available prebuilt image, set ARTIFACT_IMAGE and run make pull. make doctor checks configuration; make backup and make restore handle backups and recovery. For multiple replicas, external Postgres and S3-compatible storage, see DEPLOY.md.

How it works

  • Application and storage. Next.js serves the UI and API, Postgres stores metadata, and files live on local disk or S3-compatible storage. External database and object storage support multiple app replicas.
  • Immutable versions. Each upload or edit writes a new file version, preserving historical content. Optimistic locking (expected_version) detects concurrent update conflicts.
  • Content isolation. Previews use sandboxed iframes without allow-same-origin and a restrictive CSP to isolate uploaded content from the platform. Path checks and decompression limits defend against path traversal and ZIP bombs.

See ARCHITECTURE.md for the architecture, data model and request flows.

Documentation

DocumentWhat it covers
SELFHOST.mdSingle-machine deployment with make up, backups, upgrades, FAQ
DEPLOY.mdMulti-replica deployment: external Postgres, object storage, OIDC
.env.exampleEvery setting, grouped and explained
ARCHITECTURE.mdSystem shape, data model, request paths, the sandbox
SECURITY.mdThreat model and how to report a vulnerability
cli/README.mdThe CLI
src/content/publish-skill.mdThe API contract and hosting limits, as served to agents
ROADMAP.mdWhat comes next: semantic search, comments on sites, and more
CHANGELOG.mdWhat changed, release by release

Contributing

Local development requires Node 24+ and Docker:

bash
npm installmake dev          # start a disposable Postgres and the development servernpm test          # unit tests, no external services needed

See CONTRIBUTING.md for the contribution process, DCO sign-off and CI requirements. Report bugs and ideas in issues; ask questions in discussions.

If artifact-site is useful to you, a ⭐ helps others find it. Using it with your team? Say hi in Discussions — we’d love to list you.

License

Licensed under either of

at your option. Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in this project by you shall be dual-licensed as above, without any additional terms or conditions.

© 2025–2026 LexMount. Third-party components are listed in NOTICE.

File packages

Folder and ZIP/RAR/7z/TAR/TAR.GZ/TGZ uploads now open a file directory; click an HTML/HTM file to render it in the sandbox. Archive uploads default to a 50 MiB compressed limit and retain the original bytes for downloads by users with source-export permission. Ordinary readers cannot download the package. Folder downloads are ZIPs and preserve empty directories when the upload client can enumerate them. Existing website versions and legacy API modes keep their original behavior. See deployment and archive runtime details.

Source: README.md at commit 5c88b93

Tools

0
SourceWeft has not read this server's tools yet.

Version history

2
  1. v0.4.0LatestSep 24, 2026
  2. v0.3.0Sep 24, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts