artifact-drop.page

Publish an HTML file.
Get a link you can share.

One command turns a report, plan, data snapshot or UI mock into a URL on its own private subdomain. Built for Claude Code and Codex, and just as usable by hand.

Quick start Set up an agent

curl -fsSL https://artifact-drop.page/install.sh | sh

Single-file CLINode 20+Unguessable linksNever indexed

$ artifact-drop publish ./report.html --title "Q3 report"
Published v1 (14.2 KiB)
https://k3x9q2m7p1ab.artifact-drop.page/
Pinned:   https://k3x9q2m7p1ab.artifact-drop.page/v/1/
$

URLs

Every artifact gets its own origin

A 12-character subdomain is assigned on first publish. Anyone with the link can view it; nobody can find it without the link. A slug makes it readable, and a version path makes it permanent.

https:// qa-testSubdomain. A 12-char hash, or a slug you pick. .artifact-drop.pageOwn origin. Served byte for byte, never indexed. /v/3/Pinned version. Optional. / serves the latest.

Hash subdomain default: https://k3x9q2m7p1ab.artifact-drop.page/
Assigned on first publish. 12 characters from a-z0-9, so the URL is the access control.
Slug subdomain --slug: https://qa-test.artifact-drop.page/
Optional name you pick. 3 to 63 characters of a-z0-9-. Publishing to a slug you own adds a version.
Pinned version /v/<n>/: https://qa-test.artifact-drop.page/v/3/
Immutable. Share it when the page may change later. / always serves the newest version.
Folder pages index.html: https://qa-test.artifact-drop.page/about
Upload a folder with an index.html and relative links. /about serves about.html.

Quick start

Three commands to a link

The CLI is a single file with no dependencies. It needs Node 20 or newer and an API key from your admin.

Running publish again on the same local path adds a new version to the same artifact. Pass --new to start a fresh one, or --artifact <id|slug> to update a known artifact from any path. Identical content is a no-op.

Install to ~/.local/bin/artifact-drop.

curl -fsSL https://artifact-drop.page/install.sh | sh

Log in with the key your admin gave you. It is saved to ~/.artifact-drop/config.json.
```
artifact-drop login <token>
```

Publish a file or a folder.

artifact-drop publish ./report.html
# https://k3x9q2m7p1ab.artifact-drop.page/

artifact-drop publish ./dist --slug qa-test --title "QA run"
# https://qa-test.artifact-drop.page/

CLI reference

Small surface, scriptable output

Add --json to any command for a machine-readable receipt. The token comes from login, --token or ARTIFACT_DROP_TOKEN.

Command	What it does
login <token>	Saves the API key locally. `logout` removes it.
publish <path>	Uploads a file or folder. Options: `--slug`, `--title`, `--new`, `--artifact`.
list	Lists artifacts published with your key. `--all` shows everyone's for admins.
info <id\|slug>	Shows URLs, versions, size and file count.
update <id\|slug>	Changes the slug or title. `--no-slug` drops the slug. The old slug stops resolving.
delete <id\|slug> --yes	Removes the artifact and every version.
whoami	Prints the key name and whether it is an admin key.
keys create <name> [--admin]admin	Mints a team key and prints the token once.
keys listadmin	Lists keys with last-used time.
keys revoke <id>admin	Revokes a key immediately.

Prefer HTTP? POST /api/artifacts with a Bearer token and a text/html body, or multipart with parts named file:<path>. The same endpoints back list, info, update and delete.

For agents

Teach Claude Code or Codex to drop a page

The skill tells the agent when to publish, how to call the CLI, and to reply with the URL. install.sh copies it into ~/.claude/skills and ~/.codex/skills when those folders exist; add it by hand otherwise.

Then ask for something like "write up the migration plan as a page and publish it". The agent runs artifact-drop publish --json and hands back the link. Read the skill at /skill.md.

mkdir -p ~/.claude/skills/artifact-drop
curl -fsSL https://artifact-drop.page/skill.md \
  -o ~/.claude/skills/artifact-drop/SKILL.md

# what the agent runs
artifact-drop publish ./plan.html --title "Migration plan" --json
{
  "url": "https://k3x9q2m7p1ab.artifact-drop.page/",
  "versionUrl": "https://k3x9q2m7p1ab.artifact-drop.page/v/1/",
  ...
}

Limits and rules

Real pages, with the sharp edges filed off

Each artifact runs on its own origin with a permissive CSP. Scripts, CDNs and API calls work. Forms and plugins do not.

Works

Inline <script> and <style>
Scripts, styles and fonts from any HTTPS CDN
fetch to HTTPS APIs, localStorage
CSS, JS, images, fonts and JSON in a folder upload
Relative links between pages

Blocked or capped

25 MiB and 500 files per upload
Form submissions, via form-action 'none'
Plugins and <object> embeds, via object-src 'none'
Search indexing. Every page is noindex
Referrers. Pages send Referrer-Policy: no-referrer, so the URL does not leak to sites you link

Uploads need an API key. Viewing needs only the link, so treat the URL like a password and keep secrets out of the page. Pages are served from a wildcard certificate, so hostnames never appear in Certificate Transparency logs.

Publish an HTML file.Get a link you can share.