{
  "markdown": "<div align=\"center\">\n\n<img src=\"web/public/unlocalhost.png\" alt=\"unlocalhost\" width=\"88\" />\n\n# unlocalhost\n\n**Turn localhost into a link only the people you name can open.**\n\nSign in is built in, so you write no auth code and touch no servers.\n\n[Website](https://www.unlocalhost.tech) · [Docs](https://www.unlocalhost.tech/docs) · MIT licensed · Self hostable\n\n</div>\n\n---\n\n## The problem\n\nYour coding agent can write the whole application. It cannot host it, because\nhosting needs a server, a domain, a certificate, and a login system. So people\nreach for whatever is fastest, and that is where things go wrong: a public URL\nwith no sign in, an API key committed by accident, or auth bolted on at the end\nby someone who has never written auth.\n\nunlocalhost closes that gap. You say one sentence to the agent you already have\nopen, and you get back a real URL with a guest list in front of it.\n\n```\nyou    deploy this and let sarah@gmail.com in\n\nagent  pushed your code to a private repo\nagent  building\nagent  live at sarahs-todo.unlocalhost.tech\nagent  sarah@gmail.com can sign in and open it\n```\n\n## How it works\n\n1. You add unlocalhost to your coding agent as an MCP server and sign in once\n   with GitHub.\n2. You tell the agent to deploy, and name who is allowed in.\n3. **Your agent pushes the code using your own git credentials.** unlocalhost\n   never holds write access to anything.\n4. We clone read only, scan for committed secrets and refuse to continue if we\n   find any, then build and run it.\n5. Visitors sign in with GitHub or Google. Their verified email is checked\n   against the guest list before the request ever reaches your app.\n\n## What makes it different\n\n|                         | Tunnel (ngrok)      | Platform (Vercel)   | unlocalhost          |\n| ----------------------- | ------------------- | ------------------- | -------------------- |\n| Survives closing laptop | No                  | Yes                 | Yes                  |\n| Private by default      | No                  | No                  | **Yes**              |\n| Auth you have to write  | All of it           | All of it           | **None**             |\n| Runs on your own server | No                  | No                  | **Yes**              |\n\n## Quick start\n\n```bash\nclaude mcp add unlocalhost -- npx -y @unlocalhost/unlocalhost\n```\n\nOr in any MCP client config:\n\n```json\n{\n  \"mcpServers\": {\n    \"unlocalhost\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@unlocalhost/unlocalhost\"]\n    }\n  }\n}\n```\n\nThen ask your agent to sign in to unlocalhost, and deploy.\n\n## Self hosting\n\nThe hosted service runs this exact code. Nothing is held back, there is no\nphone home, and no license check.\n\n```bash\ngit clone https://github.com/info-arnav/unlocalhost.git\ncd unlocalhost/deploy\ncp .env.example .env      # fill it in\ndocker compose --env-file .env run --rm migrate\ndocker compose --env-file .env up -d\n```\n\nYou need a domain with wildcard DNS, a DNS provider API token for wildcard TLS,\na GitHub App, and a Google OAuth client. The full walkthrough is in\n[`docs/server-setup.md`](docs/server-setup.md).\n\n## Architecture\n\n```\ninternet :443 → Caddy → auth-gate /verify → activator → Dokku → your app\n```\n\n| Package                        | Job                                                          |\n| ------------------------------ | ------------------------------------------------------------ |\n| `web`                          | Landing page, sign in screens, docs                          |\n| `server/gateway`               | Public API ingress, CORS, rate limiting, request ids          |\n| `server/services/auth-gate`    | OAuth, sessions, and the allowlist check on every request     |\n| `server/services/control-plane`| Apps, sharing, GitHub App, deploy pipeline                    |\n| `server/services/activator`    | Wakes sleeping apps, puts idle ones back to sleep             |\n| `server/services/mcp-server`   | The `unlocalhost` npm package your agent talks to             |\n| `server/shared`                | Database, logging, crypto, errors, sessions                   |\n\nBorrowed rather than built: [Dokku](https://dokku.com) and\n[Nixpacks](https://nixpacks.com) turn a repository into a running container,\n[Caddy](https://caddyserver.com) handles wildcard TLS. The novel part is small\non purpose.\n\n## Security\n\n- Apps are private until you name someone. Removing them revokes access at once.\n- Every deploy is scanned for committed secrets and refused if any are found.\n- Sign in is enforced at the edge, before a request reaches your app.\n- Environment variables are encrypted at rest with AES 256 GCM.\n- We hold read only access, and only to repositories you pick.\n\nFound a vulnerability? Please follow [`SECURITY.md`](SECURITY.md) rather than\nopening a public issue.\n\n## Contributing\n\nRead [`CONTRIBUTING.md`](CONTRIBUTING.md) first. In short: every backend module\nfollows `routes → controller → service → repository`, code carries no comments,\nand there are no test files. Verification is done by running things.\n\n## Licence\n\nMIT. See [`LICENSE`](LICENSE).\n",
  "bytes": 5087,
  "sha": "26d8f1ea55709fd85fe75ce2bfb6f7c18444848da0ee877fc6ef2e034c6650f8",
  "repo_slug": "info-arnav/unlocalhost",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_info_arnav_unlocalhost_bb93c664/readme"
}