host0 — publish a folder, get a live url.

human here? the visual landing page has the pitch, the demo, and the waitlist. this page is the plain-text version, written for agents.

install the skill

two files: an instruction file and one bash script. requires curl, jq, and shasum/sha256sum. the paths below are where claude code keeps skills — other agents keep them elsewhere, so use whichever directory yours reads.

mkdir -p ~/.claude/skills/host0/scripts
curl -sS https://host0.ai/skill.md -o ~/.claude/skills/host0/SKILL.md
curl -sS https://host0.ai/publish.sh -o ~/.claude/skills/host0/scripts/publish.sh
chmod +x ~/.claude/skills/host0/scripts/publish.sh

set me up with host0 — the cloud for small software, where a folder becomes a live url.

1. install the host0 skill: save https://host0.ai/skill.md as SKILL.md, and https://host0.ai/publish.sh as scripts/publish.sh beside it, then chmod +x scripts/publish.sh. in claude code that folder is ~/.claude/skills/host0/ — other agents keep skills elsewhere, so use whichever directory mine reads.
2. read SKILL.md, then curl https://host0.ai/api/v1 for the live contract. if the two disagree, trust the api.
3. get me an api key without making me run commands: ask for my email, POST it to https://host0.ai/api/v1/auth/request-code, ask me for the 6-digit code host0 emails me, POST that to https://host0.ai/api/v1/auth/verify-code, and save the returned key to ~/.host0/credentials with chmod 600.

then ask me what i want to publish.

get an api key

no dashboard, no oauth dance: an emailed 6-digit code buys a key. the key starts h0_, is returned exactly once, and travels as authorization: bearer h0_… on every authenticated request.

# 1. request a 6-digit code — host0 emails it
curl -sS https://host0.ai/api/v1/auth/request-code \
  -H "content-type: application/json" \
  -d '{"email": "you@example.com"}'

# 2. exchange the code for an api key (returned exactly once)
curl -sS https://host0.ai/api/v1/auth/verify-code \
  -H "content-type: application/json" \
  -d '{"email": "you@example.com", "code": "123456"}'

# 3. save it yourself — don't make the human run this
mkdir -p ~/.host0 && printf '%s' "h0_your_key_here" > ~/.host0/credentials && chmod 600 ~/.host0/credentials

publish

publish a built static site with index.html at the root of the directory — its contents become the site root. the script handles hashing, the manifest, uploads, and finalize.

# first publish — creates the app
~/.claude/skills/host0/scripts/publish.sh ./my-site --name "my site"

# every publish after that — same folder, same app, unchanged files skipped
~/.claude/skills/host0/scripts/publish.sh ./my-site

or drive the rest api directly — four steps:

1. 01POST https://host0.ai/api/v1/apps — body {"name": "my site"} → app_id, slug, url
2. 02POST https://host0.ai/api/v1/apps/{app}/deployments — body {"files": [{path, size, sha256}]} → upload.targets (unchanged files come back in upload.skipped)
3. 03PUT each target url — raw bytes, size and sha256 must match the manifest
4. 04POST https://host0.ai/api/v1/deployments/{id}/finalize — flips the deployment live, atomically

nothing is live until finalize succeeds — a half-finished upload never serves, and the previous deployment keeps serving until the flip.

visibility

every app goes live public at an unguessable, unlisted url unless you ask for something else. an app uses one visibility at a time:

• –public — what you get unless you ask for something else. the slug is random and unguessable, the app is unlisted and never indexed, and anyone holding the url can view it.
• –link — the same behaviour, stated explicitly: anyone with the link, listed nowhere.
• –private — only the owner and emails invited through POST /api/v1/apps/{app}/shares. visitors sign in to view; removing an invite kills their existing sessions immediately.

set it on publish with --visibility private|link|public, or any time with PATCH /api/v1/apps/{app}.

limits

upload (rest + skill)   1000 files · 25 mb (26214400)/file · 100 mb (104857600) total
inline (mcp chat)       50 files · 2 mb (2097152)/file · 10 mb (10485760) total
account                 100 apps · 200 deploys/hour · 500 mb (524288000) stored
api rate                120 requests/minute per api key

parenthesised figures are exact byte counts. these are rendered from the same constants the server enforces — GET /api/v1 returns them as json under limits. over a cap you get too_large, app_limit_reached, deploy_rate_limited, storage_quota_exceeded or rate_limited, each with a message saying what to change.

mcp

claude and other mcp clients can skip the skill entirely and add host0 as a remote server:

claude mcp add --transport http host0 https://host0.ai/mcp

sign in when prompted; the tools cover create, deploy, visibility and sharing.

machine surfaces

• –/skill.md — the skill instruction file, served verbatim
• –/publish.sh — the bundled publish script (chmod +x it)
• –/api/v1 — the live api index — endpoints, caps, contract
• –/llms.txt — the llmstxt.org index of everything on this list
• –/docs — the full human+agent documentation
• –/mcp — the remote mcp endpoint (oauth; a bare GET answers 401)