Haitham AssoliRead this page in Arabicاقرأ هذه الصفحة بالإنجليزية

Web2026

pastehtml

Drop an HTML file, get a public URL on its own origin.

  • Live
  • Featured
pastehtml — cover screenshot

Project factsبيانات المشروع

In short

Publish a page in one step: drop a file, paste markup, curl it, or hand it to an agent over MCP. Markdown is rendered to a self-contained page on upload. No account, no build step.

The compartments

Role
Solo
Year
2026
Status
Live

Built with

  • Next.js
  • TypeScript
  • Convex
  • MCP
  • Tailwind CSS

What it isما هو

I kept generating single-file HTML pages like reports, mockups and one-off tools, and having nowhere nowhere to put them. Every option was heavier than the artefact: a repo and a deploy for a page that exists to be looked at once.

pastehtml is the missing step. The drop zone, a paste, a curl and an MCP call from an agent all end at the same function and come back with a URL. Markdown is converted to real HTML at upload time, so the stored paste is a page and every view of it behaves identically: the live origin, the raw view, the sandboxed preview, the ETag.

كنت أُولّد باستمرار صفحات HTML بملف واحد، من تقارير ونماذج وأدوات لمرة واحدة، ولا أجد أين أضعها. كل الخيارات أثقل من الشيء نفسه: مستودع ونشر لصفحة وُجدت لتُرى مرة.

pastehtml هو الخطوة الناقصة. منطقة الإفلات واللصق وcurl ونداء MCP من وكيل، كلها تنتهي عند الدالة نفسها وتعود برابط. ويُحوَّل الـ Markdown إلى HTML حقيقي عند الرفع، فتكون النسخة المخزّنة صفحةً وتتصرّف كل الواجهات تحتها بالطريقة ذاتها: النطاق المباشر، والعرض الخام، والمعاينة المعزولة، وETag.

Results

  • Publish from a browser, a terminal, or an AI agent over MCP.
  • Per-paste origins, so pages cannot reach each other.
  • Markdown becomes a styled, self-contained page at upload.
  • النشر من المتصفح أو الطرفية أو وكيل ذكاء اصطناعي عبر MCP.
  • نطاق مستقل لكل نسخة، فلا تصل الصفحات إلى بعضها.
  • يتحوّل الـ Markdown إلى صفحة منسّقة مكتفية بذاتها عند الرفع.

Challenges

Each one opens twice: what went wrong on the left, what I did on the right.

01

Hosting arbitrary HTML is hosting arbitrary JavaScript

Problem

A paste is a full page with scripts in it. Serve all pastes from one domain and any one of them can read the cookies, storage and DOM of every other. The service becomes a hosted cross-site scripting platform.

What I did

Each paste is served from its own origin, so the browser's own same-origin policy does the isolation rather than a sanitiser I would have to keep ahead of. Sanitising untrusted HTML is a losing race; giving it nothing worth stealing is not.

02

Link previews need per-page tags

Problem

A shared link should preview as the page it points to. But the page belongs to the user, who did not write Open Graph tags, and injecting them into their markup would mean rewriting their document.

What I did

Crawlers are detected at the edge and rewritten to a separate function that renders OG tags for that paste, while human visitors get the untouched document. The user's HTML is never modified. The crawler gets a different response.

03

One publish path, four entry points

Problem

A drop zone, a paste box, a REST call and an MCP tool are four different clients. Implementing publishing four times guarantees they drift apart, and the agent path, the one I most wanted, would be the least tested.

What I did

All four are thin shells over a single Convex function. Whatever works from the browser works identically from curl and from an agent, because it is the same code path.

Keep goingتابع

Shelf

All projectsAll 40, in six compartments.
Next design — Night ReelSee all 14