Static hosting for coding agents

Pipe HTML in.
Get a URL back.

Postpage turns one self-contained HTML document into an isolated, access-controlled web page. Publish from the CLI, the API, the MCP server, or the bundled agent skill. It's built for agents that write reports, docs, and analysis, and for the people who read them.

Install the CLI See how it works

$ npm i -g postpage  ·  no signup to start  ·  up to 10 MiB per page  ·  open source, MIT

zsh — postpage
$

How it works

Three simple commands.

The CLI is the whole interface. Every command speaks JSON with --json, so agents and scripts get exactly what humans get.

$ postpage publish page.html

Publish

Send raw HTML from a file or a pipe. You get back a stable URL built on a server-generated UUID. Signed-in pages start private; anonymous pages lock to the first browser that opens them.

$ postpage update <uuid>

Update

Every update writes a new immutable revision. The URL never changes; the cache key does. Old bytes are never rewritten in place.

$ postpage sharing <uuid> public

Share

Flip a page between private, public, or a list of specific emails. Permission changes take effect on the very next request.

Install

One package. One skill. One connector.

The CLI is on npm; the agent skill teaches Claude Code (and similar agents) how to use it; the remote MCP server puts the same tools in hosted assistants like Claude and ChatGPT. All of it is open source under the MIT licence — the Worker, the CLI, the skill, and this page live in the GitHub repo.

CLI

Node ≥ 20. You can publish before you sign in: an unauthenticated publish mints a temporary guest account for you.

# install
npm i -g postpage

# publish straight away, no login required
echo '<h1>hi</h1>' | postpage publish

# or sign in first for the free tier's higher limits
postpage login
npmjs.com/package/postpage →

Agent skill

One command installs the bundled skill into Claude Code and other agents, so they publish, update, and share pages on request.

# install the skill
npx skills add lengarvey/postpage

# or pick the agents yourself
npx skills add lengarvey/postpage \
  -a claude-code
github.com/lengarvey/postpage →

MCP server

Nothing to install for hosted assistants: add https://api.postpage.ai/mcp as a custom connector in Claude or ChatGPT and sign in when prompted. Claude Code can add it from the terminal. The MCP server needs a signed-in account.

# Claude Code
claude mcp add --transport http \
  postpage https://api.postpage.ai/mcp

Tiers

Start anonymous. Sign in when you need more.

Daily publishing limits and page lifetime are the only rate limits; there are no separate API quotas to track. Every signed-in account gets every sharing mode and MCP access, and nothing here costs money today.

Anonymous

5 pages / day, per IP

  • Your first publish mints a guest account, so there's nothing to sign up for
  • Link-access, locked to the first browser that opens it
  • Deleted 1 week after publish
Free (signed in)

30 pages / day

  • Sign in via Magic Auth or GitHub (no passwords)
  • Private, public, and specific-people sharing
  • MCP server access
  • Deleted after 3 months with no visits; any visit resets the clock

Isolation

Every page is sealed off.

Uploaded HTML is untrusted and may run arbitrary inline JavaScript. Postpage treats that as the default case, not the edge case.

Pages can't read each other

The Content Security Policy blocks all outbound requests, so one page's JavaScript can never fetch another page or exfiltrate anything it computes, even for a visitor authorized to see both.

Bytes served unchanged

No injected scripts, no rewriting, no "powered by" banner. What you upload is exactly what visitors receive, byte for byte.

Network-sealed by CSP

Inline script, style, and data: assets run freely. External fetches, sockets, beacons, and form posts are blocked at the browser.

Auth enforced at the edge

Every request passes through the Worker. HTML bytes are cached; authorization decisions never are. The storage bucket is private.

Sharing

Three modes. One URL, forever.

The UUID is stable identity, not a rotating token. Changing who can see a page never changes its address.

private

Only you. The default for every new page.

{
  "sharing_mode": "private"
}
public

Anyone with the full URL. Never listed, never indexed.

{
  "sharing_mode": "public"
}
specific_users

Verified emails, checked on every request.

{
  "sharing_mode": "specific_users",
  "emails": ["alex@example.com"]
}

Honest scope

Things Postpage doesn't do.

The product is small on purpose. If it's not on the list of goals, it's not hiding in the fine print either.

Publish your first page in one command.

No signup, no dashboard. npm i -g postpage and pipe in some HTML.

View on npm Read the source