ANVILNINE

DROPKILN / CHANGELOG

What shipped

Every Dropkiln release, newest first. Version 1.0.0 shipped under the project's old name, Artifacts, and the entry below is left as it read then. When a release touches security, it says so under a Security heading. Read those even when you skip the rest.

v1.0.0

Artifacts 1.0.0 #

First stable release. Publish HTML, JSX, Markdown, or a zip site and get an unguessable URL. Ships with a web UI, a CLI, and a built-in MCP server.

Artifacts is stable. POST an HTML page, a React component, Markdown, or a zipped static site, and you get back an unguessable URL on a domain you run. One container, about 1,100 lines, MIT.

New

  • Four content types. HTML, JSX/TSX (one React component, no build step), Markdown, and zipped static sites.
  • Built-in MCP server. A streamable HTTP endpoint at /mcp. Point Claude Code, Codex, or any MCP client at it and they publish with one tool call.
  • Web UI and CLI. Drag a file into the dashboard, or push from the terminal with the dependency-free CLI (npx github:anvilnine/artifacts).
  • Per-artifact visibility. Mark each artifact public, private (admin password), or password-protected.
  • Lifecycle controls. Custom slugs, rename, tags, projects, disable without deleting, auto-expire, delete.
  • Pluggable storage. Plain files by default; switch to S3, git, Postgres, or SQLite with one env var.

Security

  • Uploaded HTML runs, so you serve artifacts from a separate origin. An uploaded page never sees the dashboard’s session cookie.
  • Two-tier auth. Humans log in with an admin session (HttpOnly, SameSite=Strict). Machines carry scoped, revocable API keys (read, publish, or full). No shared master secret.
  • Login and unlock routes rate-limit per IP; password hashing runs off the event loop.
  • Private by default: unguessable slugs, noindex, bearer-key writes, optional expiry.

← Dropkiln docs