[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_124":125},"routes/modules.$creator.$moduleId",{"_14":15,"_16":17,"_18":19,"_20":21},"routes/modules.$creator.$moduleId.endpoints",{"_11":12,"_13":-5},"error","Module not found","tools","module",{"_20":22,"_23":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":26,"_36":37,"_38":-5,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":-5,"_57":49,"_58":59,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":73,"_74":75,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":49,"_84":-5,"_85":86,"_87":88,"_89":90,"_91":92,"_93":94,"_95":96},"apiUrl","https://odel.app/api","creator","aliosm","moduleId","pastehtml-dev","@aliosm/pastehtml-dev","displayName","PasteHTML","tagline","Publish, update, and organize HTML and Markdown pastes on PasteHTML as the authorized user.","iconKey","https://avatars.githubusercontent.com/u/7662492?v=4","category","remote","status","published","visibility","public","metaDescription","deploymentType","external","workerName","bindingName","mcpConfig","{\"url\":\"https://pastehtml.dev/mcp\",\"transport\":\"streamable-http\",\"authType\":\"none\"}","pricingModel","free","creatorUserId","system:external-import","createdAt",1783916419000,"updatedAt",1788769663000,"sourceRegistry","official-mcp-registry","sourceUrl","https://registry.modelcontextprotocol.io/v0/servers?search=dev.pastehtml%2Fmcp","sourceVerified",false,"sourceMissingSince","importedAt","upstreamStars",9,"upstreamUpdatedAt",1787104494000,"detectedTransport","streamable-http","detectedAuthType","oauth","probeStatus","ok","lastProbedAt",1788064648000,"githubRepoUrl","https://github.com/AliOsm/pastehtml.dev","githubRepoFullName","AliOsm/pastehtml.dev","releaseId","ext-aliosm-pastehtml-dev","version","1.1.0","descriptionMarkdown","

\n \n $\"pastehtml.dev$ \n \n

\n\n# pastehtml.dev\n\nShare HTML pages in seconds. Drop an HTML file, get a private link your friends\ncan open, preview, and view the source of. Anonymous publishing still works,\nand accounts add folders, custom subdomains, view counts, browser-based re-upload\nupdates, and account API keys for agent publishing into folders.\n\n## How it works\n\n- Drag and drop (or browse for) an `.html`/`.htm` file up to 2 MB.\n- The document is published at `https://.pastehtml.dev/` — or at a\n claimed custom subdomain like `https://launch-plan.pastehtml.dev/` — with an\n inspector page (copy link, preview, highlighted source) at `/p/`.\n Tokens are random 32-character lowercase-alphanumeric IDs (~165 bits of\n entropy — lowercase because they double as subdomains, and browsers lowercase\n hostnames), so random links are private unless shared.\n- Pastes can be password-protected. Locked pastes require the password before\n the inspector page, raw bytes, rendered preview, or live subdomain are served.\n- Signed-in users can save pastes into folders, see view counts, and re-upload a\n replacement `.html`/`.htm` file without changing the share link. Pastes can\n never be deleted. API-created update tokens still work for token-based\n automated updates.\n- The share page offers a live preview (with an in-site fullscreen mode) and\n a Rouge-highlighted source view.\n- Every paste is served as a real page from its own origin —\n `https://.pastehtml.dev/` — so scripts and localStorage work\n (review-progress checklists persist) while staying fully isolated from\n other pastes and from the app itself. The path-based `/p//raw`\n endpoint returns the paste's exact bytes as `text/plain` — a byte-exact copy\n for programmatic clients, immune to any CDN HTML rewriting in transit — while\n `/p//render` serves the same bytes as `text/html` inside a CSP `sandbox`.\n\n## Agent API\n\nPublish without a browser — ideal for AI agents that produce design documents\nor implementation plans and want to hand back a share link. Anonymous publishing\nstill works with no credentials; signed-in users can also create account API keys\nat `/api_keys` so an agent can publish into their account and target folders.\n\n```bash\n# Multipart upload\ncurl -F \"file=@plan.html\" https://pastehtml.dev/api/pastes\n\n# Or stream the HTML straight from a pipe\ncurl --data-binary @plan.html -H \"Content-Type: text/html\" \\\n \"https://pastehtml.dev/api/pastes?filename=plan.html\"\n```\n\nAnonymous creation returns `201` with\n`{ token, title, custom_subdomain, folder, owner, account_paste, password_protected, views_count, live_url, url, raw_url, render_url, markdown_url, update_token }`\n(or `422` with `{ errors }`). Account-key creation returns the same paste fields\nbut omits `update_token`; update account-owned pastes with the account key so\nrevoking the key stops that agent's future access. Add `password=` (or\n`custom_subdomain=`, which requires an account key) to creation/update\nrequests; send `clear_password=1` on updates to remove a paste password. Fetch `raw_url` to read a paste's exact bytes\nback (`text/plain`, never rewritten in transit).\n\n### Account API keys for agents\n\nA signed-in user can open **API keys** from the dashboard, create a key, and give\nthat secret to an agent. Use it as either `Authorization: Bearer pht_...` or\n`X-PasteHTML-API-Key: pht_...`. When a valid account key is present on\n`POST /api/pastes`, the paste is owned by that user and appears in their\ndashboard. Folder targeting is account-only:\n\n```bash\ncurl -H \"Authorization: Bearer $PASTEHTML_API_KEY\" \\\n --data-binary @plan.html -H \"Content-Type: text/html\" \\\n \"https://pastehtml.dev/api/pastes?filename=plan.html&folder_name=Roadmap\"\n```\n\nUse `folder_name=` to find or create a folder under that account,\n`folder_id=` to target an existing folder, and `clear_folder=1` on updates\nto move a paste back to All pastes. Keys can also be scoped to a default folder\nwhen created; scoped keys always publish there, can update only pastes already\nin that folder, reject folder overrides, only list that folder through the folder\nAPI, and cannot create unrelated folders. Scoped keys are revoked automatically\nif the folder is deleted. Unscoped agents can discover existing folder IDs with:\n\n```bash\ncurl -H \"Authorization: Bearer $PASTEHTML_API_KEY\" \\\n https://pastehtml.dev/api/folders\n```\n\nUnscoped keys can create folders with either nested form params\n(`folder[name]=Roadmap`) or a simple top-level `name=Roadmap`, whichever is\neasier for the client. Folder-scoped keys receive `403` on folder creation.\n\nAn account key can update pastes owned by that account, while the per-paste\n`update_token` flow keeps working as long as the paste stays anonymous. If an\nagent needs to claim an anonymous paste into an account, send the account key in\n`Authorization: Bearer ...` and the paste secret separately as\n`X-Update-Token: ...`. Claiming is one-way: afterward the account key is the\npaste's update credential and the old token stops working.\n\nThe `update_token` is revealed exactly once — the server stores only a digest —\nand authorizes any number of in-place updates while the paste remains anonymous:\n\n```bash\ncurl -X PATCH -H \"Authorization: Bearer $UPDATE_TOKEN\" \\\n -F \"file=@plan.html\" https://pastehtml.dev/api/pastes/$TOKEN\n```\n\nUpdates accept the same two body forms as creation and return `200` with the\nrefreshed `{ token, title, custom_subdomain, folder, owner, account_paste, password_protected, views_count, live_url, url, raw_url, render_url, markdown_url }`,\n`403` for a wrong or missing update token or an account key that does not own the paste,\nand `404` for an unknown paste. Paste publish/update endpoints are rate limited per IP at 20 requests per minute and 1,000 per day; folder API endpoints also require an account key and are rate limited per IP.\n\nAgents discover all of this on their own: the full integration guide lives at\n[`/llms.txt`](https://pastehtml.dev/llms.txt) (also pointed to from the\nhomepage, both visibly and in an HTML comment for raw fetchers). Telling an\nagent \"publish this on pastehtml.dev\" is enough.\n\n## MCP server\n\nFor agents that speak the [Model Context Protocol](https://modelcontextprotocol.io),\npastehtml.dev is also a remote MCP server at `https://pastehtml.dev/mcp`\n(Streamable HTTP). Instead of a `pht_` key, the agent authorizes once through\nyour browser over OAuth and then works inside your account — the same folders,\nview counts, and permanent pastes as the dashboard.\n\n```bash\n# Claude Code\nclaude mcp add --transport http pastehtml https://pastehtml.dev/mcp\n\n# Codex\ncodex mcp add pastehtml --url https://pastehtml.dev/mcp\n```\n\nOn first use the client opens a browser consent screen; approve it and the\nagent is connected — no key to copy or store. Authorization is OAuth 2.1 with\nPKCE and RFC 7591 Dynamic Client Registration, scoped to `mcp:read`,\n`mcp:pastes:write`, and `mcp:folders:write`. Review or revoke connected\nagents any time under **Connected agents** in the dashboard.\n\nTen tools are exposed (pastes are permanent — there is no delete-paste tool):\n\n- `create_paste` — publish a new HTML or Markdown paste, optionally into a folder.\n- `update_paste` — republish an existing paste's content (overwrites it in place).\n- `configure_paste` — change a paste's password, custom subdomain, or folder.\n- `get_paste` — fetch one paste's metadata, URLs, and stored content.\n- `get_paste_stats` — aggregate view analytics for a paste.\n- `list_pastes` — page through the account's pastes, optionally filtered by folder.\n- `list_folders` — list folders with their paste counts.\n- `create_folder` — create a new, empty folder.\n- `rename_folder` — rename a folder.\n- `delete_folder` — delete a folder (its pastes survive, unfiled).\n\nDynamic Client Registration can be switched off in production with the\n`MCP_DYNAMIC_REGISTRATION_DISABLED` environment variable (any already\npre-registered clients keep working). Smoke-test a deployment by fetching its\ndiscovery document:\n\n```bash\ncurl https://pastehtml.dev/.well-known/oauth-protected-resource\n```\n\n## Stack\n\n- Ruby on Rails 8.1 · PostgreSQL · Hotwire (Turbo + Stimulus)\n- Tailwind CSS v4 (cssbundling) · esbuild (jsbundling) · Yarn 4\n- Tooling via [mise](https://mise.jdx.dev), PostgreSQL via Docker Compose\n- Comic-book design: Bangers display type over Inter, halftone textures,\n ink-outlined panels with hard offset shadows\n- Installable PWA: manifest + minimal network-first service worker with an\n offline fallback page (pastes themselves are never cached)\n- SEO via meta-tags (OG/Twitter cards with a branded OG image, canonical,\n noindex on paste pages) and comic-styled static error pages\n\n## Development\n\n```bash\nmise run dev # starts postgres (docker), installs deps, prepares db, runs bin/dev\n```\n\nOr step by step:\n\n```bash\nmise run docker:start # postgres on localhost:5435\nmise run deps # bundle install + yarn install\nmise run db:prepare\nbin/dev # rails server + js/css watchers on port 3000\n```\n\n## Tests and lint\n\n```bash\nmise run test # rails test\nmise run lint # rubocop + brakeman\n```\n\n## Deployment\n\nDeploys with [Kamal](https://kamal-deploy.org) from GitHub Actions (the\n\"Kamal Run\" workflow) to a single server: the app container plus a postgres\n18 accessory. `db/production.sql` creates the Solid Cache/Queue databases on\nthe accessory's first boot. Pastes are served from `.pastehtml.dev`\nsubdomains, so the proxy routes the wildcard with a Cloudflare Origin CA\ncertificate (wildcards can't get Let's Encrypt certs over HTTP-01).\n\nOne-time setup:\n\n1. **Cloudflare** (free plan): add a proxied `A` record for `pastehtml.dev`,\n `www`, and a proxied wildcard `*` record, all pointing at the server.\n Set SSL/TLS mode to **Full (strict)**. Create an Origin Server\n certificate for `pastehtml.dev, *.pastehtml.dev` and keep the PEM pair.\n2. **Repository Actions secrets**: `SERVER_IP`, `SSH_PRIVATE_KEY` (root\n access to the server), `RAILS_MASTER_KEY` (from `config/master.key`),\n `POSTGRES_PASSWORD`, `CLOUDFLARE_ORIGIN_CERTIFICATE` and\n `CLOUDFLARE_ORIGIN_KEY` (the Origin CA PEM pair). The container registry\n (ghcr.io) authenticates with the workflow's own `GITHUB_TOKEN`.\n3. Run the **Kamal Run** workflow with the command `setup` once (provisions\n postgres + proxy), then with `deploy` for every release.\n\nFor local runs of kamal commands, put the Origin CA pair in\n`.kamal/certs/origin.pem` / `origin-key.pem` (gitignored), export\n`SERVER_IP` and `POSTGRES_PASSWORD`, and remove the GHA builder cache block\nfrom `config/deploy.yml` if you need to build the image locally.\n","changelogMarkdown","videoKey","requiredSecretsJson","publishedAt","priceCents","trialDays",0,"upstream",{"_113":114,"_115":-5,"_116":117,"_118":119,"_120":121,"_122":123},"requiredSecrets",[],"tags",[99,100,101,102,103,104,105,106,107,108,109,110,111,112],"assets",[],"stats",{"_97":86,"_98":86},"ratingAvg","reviewCount","ai-agents","anonymous-sharing","esbuild","hotwire","html-sharing","kamal","llms-txt","pastebin","postgresql","pwa","rails","ruby","stimulus","tailwindcss","topics",[99,100,101,102,103,104,105,106,107,108,109,110,111,112],"license","language","Ruby","registryName","dev.pastehtml/mcp","homepage","https://pastehtml.dev","packages",[],"ENV",{"_126":127,"_128":129,"_130":131},"ENVIRONMENT","production","TURNSTILE_SITE_KEY","0x4AAAAAAB8-rEI2gNDf_QhU","SENTRY_DSN","https://45fd1229f78089d5c3ee78be128030e1@o4510583261757440.ingest.de.sentry.io/4510584253448272"]