{
  "markdown": "<div align=\"center\">\n\n# Hushdrop\n\n**Share what your AI builds — on your own domain.**\n\nOpen-source, self-hosted artifact sharing. Drop a file, an HTML page, or a whole site and get a\nbranded, **password-protected (zero-knowledge AES-256)** link on **your own domain** in ~1 second —\nfrom your terminal or any AI agent. The open-source alternative to Stacktree.\n\n[![npm](https://img.shields.io/npm/v/hushdrop?color=ff6b35)](https://www.npmjs.com/package/hushdrop)\n[![downloads](https://img.shields.io/npm/dm/hushdrop?color=ff6b35)](https://www.npmjs.com/package/hushdrop)\n[![CI](https://github.com/maxtechera/hushdrop/actions/workflows/ci.yml/badge.svg)](https://github.com/maxtechera/hushdrop/actions/workflows/ci.yml)\n[![license: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE)\n[![stars](https://img.shields.io/github/stars/maxtechera/hushdrop?style=social)](https://github.com/maxtechera/hushdrop/stargazers)\n\n[**Live demo →**](https://hushdrop.dev) · [Docs](https://hushdrop.dev/docs) · [Try in browser](https://hushdrop.dev/try) · [vs Stacktree](https://hushdrop.dev/stacktree-alternative)\n\n[![Deploy with Vercel](https://vercel.com/button)](https://vercel.com/new/clone?repository-url=https%3A%2F%2Fgithub.com%2Fmaxtechera%2Fhushdrop&stores=%5B%7B%22type%22%3A%22blob%22%7D%5D)\n\n![Hushdrop — share what your AI builds, on your own domain](docs/og.png)\n\n</div>\n\n---\n\n## Quick start\n\nThe core way to use Hushdrop is **from your agent** — it publishes what it builds to your own domain.\n\n**Claude Code** (recommended — auto-updates via the plugin marketplace):\n\n```bash\n/plugin marketplace add maxtechera/hushdrop\n/plugin install hushdrop\n```\n\n**Cursor · Codex · Copilot · Gemini · 20+ Agent Skills hosts:**\n\n```bash\nnpx skills add maxtechera/hushdrop-skill\n```\n\n**No install** — open **[hushdrop.dev/try](https://hushdrop.dev/try)**, drop an HTML file, get a link. No account.\n\n**One-off from the terminal** — zero install, zero setup, no account:\n\n```bash\nnpx hushdrop report.html       # → https://hushdrop.dev/u/xxxx (+ password, copied) — no setup, no account\n```\n\n**Free hosted account** — persistent links on your own handle (`hushdrop.dev/you/<slug>`):\n\n```bash\nnpx hushdrop login                       # passwordless: GitHub or magic link\nnpx hushdrop report.html                 # → https://hushdrop.dev/you/report-a1b2 (persistent)\n```\n\n**Your own domain** — self-host on your Vercel Blob (free, MIT, your URL + brand forever):\n\n```bash\n# one-click: the \"Deploy with Vercel\" button above auto-provisions a Blob store — then:\nnpx hushdrop-install                         # wire your agents + CLI\nhush deploy --domain share.yoursite.com   # or do it from a local clone\n```\n\nNo dashboard required. Two commands to try; one more to own.\n\n## Why this exists\n\nAnthropic shipped artifact sharing so teams could hand each other the things they make with AI. It's\ngreat — and it's locked to their surface, their domain, their account. Stacktree does the agent-native\nversion, but it's a closed SaaS: your content sits on their servers, custom domains and limits are\npaywalled, and you can't audit or self-host it.\n\nI make things all day with agents: reports, proposals, guides, dashboards, whole little sites. I wanted\nto hand someone a link that's **mine** — my domain, my brand, my keys — in the time it takes to type one\ncommand, without uploading client work to someone else's server. So `hush` does exactly that:\nterminal-native, zero-knowledge, on your own domain, usable from any agent. MIT.\n\n## Hushdrop vs. the alternatives\n\n| | **Hushdrop** | Stacktree | send.co | tiiny.host |\n|---|:---:|:---:|:---:|:---:|\n| Your own domain | ✅ free | ❌ | ❌ | paid |\n| Zero-knowledge AES-256 | ✅ | ✅ | files only | ❌ |\n| Open-source / self-host | ✅ MIT | ❌ | ❌ | ❌ |\n| CLI + MCP (agent-native) | ✅ | partial | ❌ | ❌ |\n| Anonymous, no-account drop | ✅ | ❌ | ✅ | ✅ |\n| Burn-after-read / email-gate | ✅ | partial | partial | ❌ |\n| Price | **free / self-host** | paid | freemium | freemium |\n\nFull write-ups: [vs Stacktree](https://hushdrop.dev/stacktree-alternative) · [vs Send](https://hushdrop.dev/send-co-alternative) · [vs ShareDuo](https://hushdrop.dev/shareduo-alternative)\n\n## Features\n\n- 🔒 **Zero-knowledge** — branding + AES-256 happen client-side; the server only stores ciphertext.\n- 🌐 **Your domain, your brand** — colors, logo, social cards flow into the unlock gate + previews.\n- 🤖 **Agent-native** — one CLI command or 9 MCP tools; any agent that runs a shell can publish.\n- ⏱️ **Auto-expire & burn-after-read** — `--expire 7d`, `--burn`, server-enforced cleanup.\n- 📧 **Email-gate & revocable share links** — restrict by domain, mint/revoke guest links.\n- 📦 **Anything static** — HTML, Markdown (rendered), PDFs, images, multi-file zips → sites.\n- 🚀 **One-click self-host** — Deploy to Vercel auto-provisions Blob; no DB to run.\n\n## What you can drop\n\n| You run | You get |\n|---------|---------|\n| `hush report.html` | Branded, AES-256-locked page at `yourdomain.com/<slug>` (+ auto password) |\n| `hush notes.md` | Markdown → rendered, branded HTML page |\n| `hush report.html -p secret` | Your own password |\n| `hush report.html --no-lock` | Branded page, no password — renders for anyone with the link |\n| `hush report.html --expire 7d` | Auto-expire (`7d`/`24h`/`2w`/date); enforce with `hush gc` |\n| `hush report.html --burn` | Burn-after-read — self-destructs on first view |\n| `hush report.html --email-gate acme.com` | Only viewers with that email domain can open it |\n| `hush deck.pdf --page` | A branded **download page** wrapping the file |\n| `hush site.zip` | Multi-file static site at `yourdomain.com/<slug>/` |\n| `hush -s q3 deck.html` | Force the slug |\n\n## CLI reference\n\n| Command | Does |\n|---------|------|\n| `hush <file>` | Publish (managed / hosted / self-host, auto-detected) |\n| `hush login` / `whoami` / `logout` | Passwordless hosted account (GitHub or magic link) |\n| `hush list` / `rm <slug>` / `gc` | List, delete, garbage-collect drops |\n| `hush share <slug> [--revoke]` | Mint / revoke a revocable guest link |\n| `hush claim <url>` | Move an anonymous `/u/` drop into your account |\n| `hush set-expiry` / `set-email-gate` / `set-password` / `set-feedback` | Manage a hosted drop |\n| `hush init` / `setup` / `deploy` | Configure + self-host on your own domain |\n| `hush migrate` | Re-home hosted drops onto your own Blob |\n\n## Use it from any AI agent\n\n`npx hushdrop-install` registers the **`drops` MCP server** into your detected agents (Claude Code, Codex,\nCursor, Windsurf, OpenCode, Amp), puts `hush` on your `PATH`, and prints config for GUI clients.\n\n```bash\nclaude mcp add hushdrop -- npx -y hushdrop-mcp        # Claude Code\ncodex  mcp add hushdrop -- npx -y hushdrop-mcp         # Codex\n```\n```jsonc\n{ \"mcpServers\": { \"hushdrop\": { \"command\": \"npx\", \"args\": [\"-y\", \"hushdrop-mcp\"] } } }\n```\n\n### MCP tools (9 — vs Stacktree's 7)\n\n| Tool | Purpose |\n|------|---------|\n| `publish_html` | Publish raw HTML → branded, password-protected link |\n| `publish_file` | Publish a local file (optionally a branded download page) |\n| `update_site` | Replace a drop's content in place (same URL) |\n| `list_sites` / `delete_site` | List / delete drops |\n| `set_password` / `set_expiry` / `set_email_gate` / `set_feedback` | Manage a hosted drop |\n\n## How it works\n\n1. **Read** your file and detect its type.\n2. **Brand** (HTML) — inject favicon, OG/Twitter card, and a subtle corner badge before `</body>`.\n3. **Encrypt** (if locking) — [StatiCrypt](https://github.com/robinmoisson/staticrypt) (AES-256, client-side) behind your branded unlock gate. The badge is baked in *before* encryption, so it survives.\n4. **Upload** to Vercel Blob under a clean key.\n5. **Serve** — `yourdomain.com/<slug>` proxies the blob via `middleware.js`, rewriting headers so encrypted HTML decrypts + renders (not downloads) and CSP doesn't block the unlock script. Drops are `noindex, nofollow, noai`.\n6. **Report** — URL (+ password) printed and copied to your clipboard.\n\nServing is a dumb transparent proxy; all branding + encryption happen client-side at upload. The server only ever stores ciphertext.\n\n## Self-host\n\n[![Deploy with Vercel](https://vercel.com/button)](https://vercel.com/new/clone?repository-url=https%3A%2F%2Fgithub.com%2Fmaxtechera%2Fhushdrop&stores=%5B%7B%22type%22%3A%22blob%22%7D%5D)\n\nThe Deploy button clones the repo **and auto-provisions a Blob store** (it injects `BLOB_READ_WRITE_TOKEN`;\nthe app derives its store from the token, so it just works). Then `npx hushdrop-install` + `hush init --domain\nshare.yoursite.com` to point your CLI + agents at your instance. Self-host is **token-only, free, unlimited\n— no account needed.** Full walkthrough in [`skill/SETUP.md`](skill/SETUP.md).\n\n## Configuration\n\n| File | Holds | Committed? |\n|------|-------|------------|\n| [`skill/brand/brand.json`](skill/brand/brand.json) | **Presentation** — name, colors, owner, social links. Edit to rebrand. | yes |\n| `~/.hushdrop/config.json` | **Infra** — domain, blob host, Vercel project. Written by `hush init`. | no |\n| `~/.hushdrop/.env` | Your `BLOB_READ_WRITE_TOKEN`. | no |\n\n## FAQ\n\n**Is it really zero-knowledge?** Yes — for locked drops, AES-256 runs in your browser before upload; the server stores only ciphertext.\n**Managed vs. hosted vs. self-host?** Managed = anonymous, 24h, no account. Hosted = free account, persistent links on `hushdrop.dev/you/…`. Self-host = your own domain + Blob.\n**Does it need Vercel?** Only to self-host. The managed + hosted tiers need nothing but `npx`.\n**How is this different from Stacktree?** Same agent-native idea, but open-source, self-hostable, your own domain free, and anonymous (no account). See [the comparison](https://hushdrop.dev/stacktree-alternative).\n**Can agents use it without MCP?** Yes — it's a single CLI; any agent that runs a shell command can publish.\n**Is it free?** Yes. MIT. Self-host costs only your own (usually pennies) Vercel Blob usage.\n\n## Security\n\n- **Locked HTML** is genuinely AES-256 encrypted in the browser — use long passwords; strong against casual access, not a vault.\n- **Raw files** are protected by an unguessable slug; use `--page -p <password>` for a gated download.\n- Passwords are stored in `~/.hushdrop/manifest.json` on your machine only — never uploaded.\n\nSee [SECURITY.md](SECURITY.md) to report a vulnerability.\n\n## Contributing\n\nPRs welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). It's a few hundred lines of readable Node + HTML, no build step.\n\n<div align=\"center\">\n\nMIT · Built by [**Max Techera**](https://maxtechera.dev) · [GitHub](https://github.com/maxtechera) · [Instagram](https://instagram.com/maxtechera) · [hushdrop.dev](https://hushdrop.dev)\n\n</div>\n",
  "bytes": 10719,
  "sha": "31c59c745e4455753ab136c398a6687b7c5795e6e32d1ae8934f0a0fbc613be3",
  "repo_slug": "maxtechera/hushdrop",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_maxtechera_hushdrop_d3ba936a/readme"
}