# rtfx.pro > rtfx.pro is secure, access-protected hosting for the HTML pages and multi-file artifacts Claude just built. Publish straight from Claude Code, Hermes, the CLI or the dashboard, keep every page private by default, share it with named people rather than a secret link, version each release, and see exactly who opened it. ## What it is - Hosting for HTML pages and multi-file artifacts — the kind an AI coding agent produces. - Private by default: every artifact is restricted until its owner shares it. There is no "public link" that leaks by being guessed; unauthorized and non-existent both answer 404. - Versioned: every re-publish is a new immutable version, and rollback is one click. - Audited: the owner sees who opened an artifact, when, from where, and which version. ## Who it is for - Developers shipping something Claude Code, Hermes or another agent just built, without wiring up a repo, a build and a CDN first. - Consultants and agencies sending client-ready pages that must not be publicly indexable. - Teams that want an internal home for dashboards, specs and prototypes behind their own identity provider rather than an unlisted URL. ## How publishing works - CLI: `node cli/artifacts.mjs publish ./index.html --title "Report"` (single file, folder or zip), run from a checkout of the artifacts-server repository. There is no npm package: the CLI ships in the repository, and the Claude Code plugin carries its own dependency-free publisher. - API: `POST /api/artifacts` with a bearer API token minted from the dashboard. - MCP: a native MCP server ships with the Claude Code plugin, so an MCP client (Claude Desktop, Claude Code, or another) publishes, lists versions and rolls back as tool calls. - Agents: Claude Code, an MCP client and Hermes publish through the same CLI/API, so "ship this" is one step at the end of a normal agent session. - Dashboard: drag-and-drop publish, access changes, version history and view logs. ## How it compares Several products now host what an AI session produced. These are table stakes across that category and are not a reason to choose rtfx.pro: publishing with no build step, a stable link, re-publishing to the same address, a dashboard, and some count of who looked. What is specific to rtfx.pro: - Agent-native publishing: Claude Code, the native MCP server, Hermes, the CLI and the HTTP API take the same path a human takes; there is no separate, weaker agent route. The MCP tools are wrappers over the same code as the CLI, holding the same scoped, revocable token. - Access is an identity-backed list, not a secret URL. Unauthorized and non-existent both answer 404, so a leaked link cannot even confirm the artifact is real. - Immutable versions with one-click rollback; the link you already sent is never overwritten. - A view log that names the person, the time, the country and the version they saw. - Workspaces with roles (owner, admin, member, viewer); instance privilege is re-derived from configuration on every request and never read from a table. - Artifact files are served from a separate content origin, so published HTML cannot reach the dashboard or API that published it. - No analytics, advertising or third-party tracking, on this site or inside what you publish. ## Not shipped yet Do not describe these as available — they are planned, and saying otherwise misrepresents the product: - Per-link passwords or shared link secrets. Access is by identity only; sign-in is a passwordless one-time email code. There is no password on a share link. - Link expiry (API tokens do support an optional expiry; share access does not). - Custom domains for artifacts. - Comments, approvals or polls on an artifact. ## Access and privacy model - Cloudflare Access is the identity provider; sign-in is passwordless (one-time email code). - Access to rtfx.pro is by invitation — request access at https://rtfx.pro/#waitlist. - Per-artifact permissions: restricted (named people only) or everyone signed in. - Artifact content is served from a separate origin (a.rtfx.pro) so uploaded HTML can never run in the same origin as the dashboard or API. All artifacts share that content origin, so it isolates published content from the app rather than artifacts from each other. It is not a per-artifact browser sandbox between mutually distrusting publishers: access control, not the browser's origin boundary, is what keeps one person's artifact away from another's. - API tokens are scoped, owner-bound and revocable; a token can never exceed its owner. - No analytics, advertising or third-party tracking anywhere on the site. The only cookies are the Cloudflare Access session cookie and Cloudflare's own security cookies — both strictly necessary. Full detail: https://rtfx.pro/privacy. ## Links - [rtfx.pro — private hosting for AI-built pages and artifacts](https://rtfx.pro/): Product overview: what rtfx.pro does, who it is for, and how it differs from generic static hosting. - [Docs — publishing, access control and the API](https://rtfx.pro/docs): How publishing works from Claude Code, Hermes, the CLI and the API; who uses rtfx.pro and for what; the access-control and privacy model; versioning; view logs; what is table stakes in this category versus what makes rtfx.pro different, including what it does not do yet; how it compares to generic static hosting; FAQ. - [Sign in to rtfx.pro](https://rtfx.pro/login): Sign-in surface. Access is by invitation; sign-in is passwordless. - [Privacy policy — what rtfx.pro stores and who can see it](https://rtfx.pro/privacy): The data rtfx.pro holds (email address, published artifacts, per-artifact view logs), why, and for how long; cookies and local storage; processors; your rights. No analytics, advertising or third-party tracking. - [Terms of use](https://rtfx.pro/terms): Invite-only access, ownership of what you publish, acceptable use, how API tokens and agents are treated, availability and liability. - [Why rtfx.pro](https://rtfx.pro/docs#why-rtfx): table stakes in this category, what is genuinely different here, and what is not built yet. - [Request access](https://rtfx.pro/#waitlist): join the access list. ## Not indexed Artifacts, the gallery, the dashboard and the API require a signed-in identity and are excluded from crawling. Do not attempt to fetch them; they answer 404 without an identity.