Web2026
pastehtml
Drop an HTML file, get a public URL on its own origin.
Publish a page in one step: drop a file, paste markup, curl it, or hand it to an agent over MCP. Markdown is rendered to a self-contained page on upload. No account, no build step.
- Production
- pastehtml
- Role
- Solo
- Year
- 2026
- Status
- Live
- Format
- Web
- Built with
- Next.jsTypeScriptConvexMCPTailwind CSS
- Where to find it
- Visit the siteSource
Treatment
I kept generating single-file HTML pages like reports, mockups and one-off tools, and having nowhere nowhere to put them. Every option was heavier than the artefact: a repo and a deploy for a page that exists to be looked at once.
كنت أُولّد باستمرار صفحات HTML بملف واحد، من تقارير ونماذج وأدوات لمرة واحدة، ولا أجد أين أضعها. كل الخيارات أثقل من الشيء نفسه: مستودع ونشر لصفحة وُجدت لتُرى مرة.
pastehtml is the missing step. The drop zone, a paste, a curl and an MCP call from an agent all end at the same function and come back with a URL. Markdown is converted to real HTML at upload time, so the stored paste is a page and every view of it behaves identically: the live origin, the raw view, the sandboxed preview, the ETag.
pastehtml هو الخطوة الناقصة. منطقة الإفلات واللصق وcurl ونداء MCP من وكيل، كلها تنتهي عند الدالة نفسها وتعود برابط. ويُحوَّل الـ Markdown إلى HTML حقيقي عند الرفع، فتكون النسخة المخزّنة صفحةً وتتصرّف كل الواجهات تحتها بالطريقة ذاتها: النطاق المباشر، والعرض الخام، والمعاينة المعزولة، وETag.
Challenges
Hosting arbitrary HTML is hosting arbitrary JavaScript
The problem
A paste is a full page with scripts in it. Serve all pastes from one domain and any one of them can read the cookies, storage and DOM of every other. The service becomes a hosted cross-site scripting platform.
What I did
Each paste is served from its own origin, so the browser's own same-origin policy does the isolation rather than a sanitiser I would have to keep ahead of. Sanitising untrusted HTML is a losing race; giving it nothing worth stealing is not.
Link previews need per-page tags
The problem
A shared link should preview as the page it points to. But the page belongs to the user, who did not write Open Graph tags, and injecting them into their markup would mean rewriting their document.
What I did
Crawlers are detected at the edge and rewritten to a separate function that renders OG tags for that paste, while human visitors get the untouched document. The user's HTML is never modified. The crawler gets a different response.
One publish path, four entry points
The problem
A drop zone, a paste box, a REST call and an MCP tool are four different clients. Implementing publishing four times guarantees they drift apart, and the agent path, the one I most wanted, would be the least tested.
What I did
All four are thin shells over a single Convex function. Whatever works from the browser works identically from curl and from an agent, because it is the same code path.
Results
- Publish from a browser, a terminal, or an AI agent over MCP.النشر من المتصفح أو الطرفية أو وكيل ذكاء اصطناعي عبر MCP.
- Per-paste origins, so pages cannot reach each other.نطاق مستقل لكل نسخة، فلا تصل الصفحات إلى بعضها.
- Markdown becomes a styled, self-contained page at upload.يتحوّل الـ Markdown إلى صفحة منسّقة مكتفية بذاتها عند الرفع.