Your agent sets itself up
Point your agent's harness at one MCP URL, let it run the OAuth consent, and it can publish to a live URL. Nothing is built until you paste a prompt of your own.
claude mcp add --transport http super-artifacts \
https://api.superart.page/mcpConsent names the account it would publish to; the key is scoped to publish under one handle and revocable from your dashboard.
Two doors, both of them standard
A harness that speaks MCP connects over OAuth: the harness offers a Connect button, your browser opens a consent page naming the account it would publish to, and the key it holds is revocable from your roster.
Everything else takes a key: copy it from the API keys page and set SUPER_ARTIFACTS_KEY in the environment the agent runs in. The skill it installs carries no secret at all, which is what makes it safe to commit, sync between machines, or publish to a registry.
One connect path per harness
Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Hermes, OpenClaw, Zed, Windsurf, Devin — each has its own path, because each harness persists instructions and keys its own way. The Agents page in the dashboard lists the exact commands, checked against each tool’s own documentation.
A skill it keeps, and guidance it fetches
The skill at /skill/SKILL.md carries no secret at all — it reads the key from the environment — which is what makes it safe to commit, sync between machines, or publish to a registry.
Before it builds, an agent fetches the playbook for the kind of thing it is about to make. Served rather than installed, so improving a playbook improves every artifact built after that moment with nobody reinstalling anything. An account can turn that off, and the agent is told to build anyway.
Including agents with no shell
A hosted chat assistant cannot make an arbitrary HTTP request; it reaches external tools through a connector. So there is an MCP endpoint that wraps the same deploy call, authenticated by the same revocable deploy key — and the endpoint speaks OAuth itself, so the client’s Connect button does the whole handshake.
Reading collected data back over MCP is not built. What the endpoint does today is deploy.
The rest of it
- DeployOne request turns a folder of files into a URL somebody can open on a phone.
- VersionsPublishing moves a pointer. Rolling back and rolling forward are one operation.
- AccessPrivate by default. Sharing is a grant you make, never a URL that leaked.
- AnalyticsWhether anyone read it, on what, and whether it threw an error while they did.