$ cd ~/work && cat pastehtml.md
--- title: pastehtml role: Solo year: 2026 status: Live category: Web stack: [Next.js, TypeScript, Convex, MCP, Tailwind CSS]
live: Visit the site
github: Source ---
pastehtml
Drop an HTML file, get a public URL on its own origin.
Publish a page in one step: drop a file, paste markup, curl it, or hand it to an agent over MCP. Markdown is rendered to a self-contained page on upload. No account, no build step.
##Overview
I kept generating single-file HTML pages like reports, mockups and one-off tools, and having nowhere nowhere to put them. Every option was heavier than the artefact: a repo and a deploy for a page that exists to be looked at once.
pastehtml is the missing step. The drop zone, a paste, a curl and an MCP call from an agent all end at the same function and come back with a URL. Markdown is converted to real HTML at upload time, so the stored paste is a page and every view of it behaves identically: the live origin, the raw view, the sandboxed preview, the ETag.
## Challenges
### Hosting arbitrary HTML is hosting arbitrary JavaScript
A paste is a full page with scripts in it. Serve all pastes from one domain and any one of them can read the cookies, storage and DOM of every other. The service becomes a hosted cross-site scripting platform.
Each paste is served from its own origin, so the browser's own same-origin policy does the isolation rather than a sanitiser I would have to keep ahead of. Sanitising untrusted HTML is a losing race; giving it nothing worth stealing is not.
### Link previews need per-page tags
A shared link should preview as the page it points to. But the page belongs to the user, who did not write Open Graph tags, and injecting them into their markup would mean rewriting their document.
Crawlers are detected at the edge and rewritten to a separate function that renders OG tags for that paste, while human visitors get the untouched document. The user's HTML is never modified. The crawler gets a different response.
### One publish path, four entry points
A drop zone, a paste box, a REST call and an MCP tool are four different clients. Implementing publishing four times guarantees they drift apart, and the agent path, the one I most wanted, would be the least tested.
All four are thin shells over a single Convex function. Whatever works from the browser works identically from curl and from an agent, because it is the same code path.
##Results
- Publish from a browser, a terminal, or an AI agent over MCP.
- Per-paste origins, so pages cannot reach each other.
- Markdown becomes a styled, self-contained page at upload.
$ next
GiftAnimated 3D gifts you send as a link.