[htmldrop logo]
htmldrop
Publish anything for agents — one API call, MCP server included.
[htmldrop.link]
[CI]
[npm]
[MIT]
English · 한국어 · 日本語 · 简体中文 · Español · Français · Deutsch
htmldrop turns any HTML, Markdown, PDF, or image artifact into a shareable
link in seconds. Reports, dashboards, charts, demos — anything an agent (or a
human) creates. Markdown/text/JSON render into a clean reader page; PDFs and
images are served as-is. No git, no build, no dashboard.
Try it now: htmldrop.link — drag & drop an HTML
file, paste HTML source, or POST to the API.
How it works
Every link gets its own subdomain, an auto-generated Open Graph preview card,
and a TTL — shared artifacts don't live forever.
Connect your agent (MCP)
The hosted MCP server lives at https://htmldrop.link/mcp (Streamable HTTP) and exposes
one tool: publish_html.
Claude Code
Claude Desktop
Claude Desktop speaks stdio, so bridge to the hosted server with
mcp-remote. In
claude_desktop_config.json:
Cursor
Cursor connects to a remote MCP URL directly. In .cursor/mcp.json:
Codex CLI
In ~/.codex/config.toml:
Self-hosted instance (npm, stdio)
Running your own htmldrop? The htmldrop-mcp
package is a local stdio MCP server that publishes to your storage and
domain:
publish_html tool
Full agent-facing docs live in AGENTS.md, also served at
htmldrop.link/agents.md.
REST API
Pass an owner key in the x-htmldrop-key header for higher rate limits and a
longer default TTL. (x-pin-key is still accepted for backwards compatibility.)
Self-hosting
The only variable you need to set is BASE_DOMAIN. Everything else has a
working default. Storage falls back to the local filesystem (./data) when no
object store is configured — no database required.
Environment variables
Any S3-compatible store works for the CLOUDFLARE_R2_* variables (Cloudflare
R2, AWS S3, MinIO, …). On ephemeral/container hosts, either use object storage
or mount a persistent volume at ./data, or artifacts are lost on redeploy.
Production needs a wildcard DNS record (*.your-domain) pointing at the
server so artifact subdomains resolve.
Deploy to Railway
Then set BASE_DOMAIN and (optionally) the R2 variables in the Railway
dashboard, and attach your domain plus its wildcard.
Safety defaults
- Artifacts are served with
X-Robots-Tag: noindex, nofollow, noarchive
- New HTML artifacts use a versioned CSP sandbox: inline scripts work, while
external network requests/assets, forms, popups, and top-level navigation are blocked
- Per-IP and per-key rate limits
- Everything expires via TTL
- Optional password protection per artifact
See SECURITY.md for vulnerability and abuse reporting.
Development
License
MIT