HaoyouBox Publish

com.haoyoubox由 haoyoubox.com 发布v1.0.0更新于 Oct 26, 2026

Publish local HTML or Markdown as expiring password-protected HaoyouBox links.

发布方自己的服务：Publish.fun

已验证STDIO仅桌面效率与工作流文件与存储

服务详情

标识符: com.haoyoubox/publish
传输: STDIO
运行时: Desktop only
信任: Verified
发布于: Oct 19, 2026

安全提示

MCP 服务会接收对话中的工具调用请求，并可能执行外部操作。启用前请先了解该服务能做什么，并只授予它所需的权限。

注册中心已验证此服务的命名空间属于 haoyoubox.com。它以软件包形式运行，而不是托管端点，因此没有可与该域名比对的端点。

SourceWeft 的检查只涵盖条目是否完整、端点是否响应；不审查服务器的代码，也不审查其工具的行为。

在 README 中添加徽章

向读者展示该 MCP 服务已收录于 SourceWeft，徽章链接到本页。

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/com.haoyoubox%2Fpublish.svg)](https://sourceweft.com/mcp/com.haoyoubox%2Fpublish?utm_source=readme&utm_medium=badge)

概览

AI 生成的概览

把单个本地 HTML 或 Markdown 文件发布到 HaoyouBox，生成带密码和到期时间的浏览器链接，并返回链接、密码与实际到期时间。

可以做什么: 把指定的单个本地 .html、.htm、.md 或 .markdown 文件发布为 HaoyouBox 上固定的、可直接在浏览器打开的页面
生成受密码保护、由服务端强制到期的分享链接，并一并返回完整链接、可见密码和实际到期时间
为接收页选择中文或英文界面
首次使用时走设备授权流程，并把发布令牌保存在智能体自己的私有凭据存储中
适用场景: 适合把单份报告、笔记或静态页面交给没有 HaoyouBox 账号的人，让对方直接在浏览器中查看，且访问有时间限制和密码保护。不适合批量上传、站点管理或撤销链接。
运行要求: 以本地 stdio 进程在桌面电脑上运行，可通过 npm 包 haoyoubox-mcp 或智能体 Skill 安装。首次使用需要 HaoyouBox 账号完成设备授权，授权后生成发布令牌，保存在 HAOYOUBOX_TOKEN（可选，仅用于发布）。需要能访问 HaoyouBox 托管服务的网络。

安装前请注意

完整分享链接中已包含密码，应视为敏感访问凭据。不要发布含密钥、个人数据、私钥或环境变量的文件；该工具只处理一个明确指定的文件，不上传目录、隐藏文件或密钥。发布令牌必须保存在智能体的私有凭据存储中，设备授权需要用户明确操作。托管服务与服务端源码不在开源仓库内。

安装

在 SourceWeft 中

打开控制台中的 HaoyouBox Publish，将其添加到工作区。
为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照仓库中的启动说明。

README

HaoyouBox Agent Skill

中文说明

Publish one local HTML or Markdown file to HaoyouBox from a compatible AI agent. The Skill creates an expiring, password-protected browser link and returns the complete link, visible password, and actual expiry.

This repository contains the open Agent Skill and its documentation. The hosted HaoyouBox service and server source are not part of this repository.

Install

Codex, Claude Code, Cursor, and other supported agents

Use the cross-agent Skills installer:

Review the Skill before you approve installation. Restart or reload your agent if it does not discover the Skill immediately.

Gemini CLI

bash

gemini skills install https://github.com/cheng-big/haoyoubox-agent-skill --path skills/haoyoubox-publish

gemini skills install https://github.com/cheng-big/haoyoubox-agent-skill --path skills/haoyoubox-publish

Gemini CLI asks for installation consent. Use /skills list after installation to confirm that haoyoubox-publish is enabled.

Manual installation

Copy the skills/haoyoubox-publish directory into a Skill location supported by your agent, such as ~/.agents/skills/haoyoubox-publish.

The current hosted copy remains available at haoyoubox.com/agent/SKILL.md.

Use

Ask your agent:

text

Publish report.html to HaoyouBox and create a password-protected link that expires in 24 hours. Use English for the receiver page. Return the complete link, password, and actual expiry together.

Publish report.html to HaoyouBox and create a password-protected link that expires in 24 hours. Use English for the receiver page. Return the complete link, password, and actual expiry together.

For a Chinese receiver page:

text

把 report.html 发布到好友盒，生成 24 小时密码保护链接。接收页使用中文。请一起返回完整链接、密码和实际到期时间。

把 report.html 发布到好友盒，生成 24 小时密码保护链接。接收页使用中文。请一起返回完整链接、密码和实际到期时间。

On first use, the agent opens a HaoyouBox device approval flow. You sign in to HaoyouBox and approve the device. The agent then stores the publish token in its private credential store.

What It Publishes

One explicit .html, .htm, .md, or .markdown file.
A fixed browser-ready version on HaoyouBox.
A password-protected link with a server-enforced expiry.
A Chinese or English receiver interface.

The Skill does not upload directories, ZIP files, hidden files, environment files, keys, symlinks, or an entire workspace. It does not read upload history, delete pages, revoke links, or manage accounts.

Security

Review the Skill before installation.
Device approval always requires an explicit user action.
The publish token must stay in the agent's private credential store.
The raw share password is derived locally. HaoyouBox receives a salt and verifier, not the raw password.
The complete share link includes the password for convenient prefill. Treat the complete link as one sensitive access credential.
Do not publish files that contain secrets, personal data, private keys, or environment variables.

See SECURITY.md for vulnerability reporting and token-response steps.

Product

Recipients open the generated link in a browser. They do not need to install this Skill or create a HaoyouBox account.

Contributing

See CONTRIBUTING.md. Run npm test before opening a pull request.

License

The files in this repository are licensed under the Apache License 2.0. Use of the hosted HaoyouBox service remains subject to the product's published terms and policies.

来源：README.md，提交 37ee323