Put what Claude Code builds online, at a link

Yes. Ask for an artifact and Claude Code publishes one page from your session to a private claude.ai URL, opens it in your browser, and updates it in place as the session goes on.

• Finding them again: /artifacts lists yours and any shared with you, and Ctrl+] reopens this session's latest.
• Who has them: Pro, Max, Ultra, Team and Enterprise, in a session signed in with /login.
• Who doesn't: sessions on an API key, a gateway token, Amazon Bedrock, Google Cloud's Agent Platform or Microsoft Foundry, and organizations with customer-managed keys, HIPAA or Zero Data Retention. They're also off by default for claude -p, the Agent SDK and the GitHub Action.

If Claude Code writes a local HTML file and gives you no link, one of those is why. That file isn't wasted: the host0 skill publishes it as it is.

An artifact is enough for one page you and your colleagues look at. It stops being enough when the work is several files or a PDF, when someone without a Claude account needs private access, or when viewers have to save something.

Stay with the artifact for a PR walkthrough, a set of design options or a status board for your own organization: there's no second account, and it's the only one of the two where a teammate can send a comment straight to Claude. On Pro, Max and Ultra there's no organization to share within, which leaves a public link or an email invitation that's still in beta and needs a Claude account. That's the case for an invite-only host0 app.

Not a site with more than one page. An artifact can't serve multiple routes, and Anthropic's docs say a hosted tool with a backend belongs on your own infrastructure. So Claude Code builds the site and something else serves it.

With host0, what you point the deploy at depends on what Claude Code made:

• Plain HTML, CSS and JavaScript: the folder with index.html at its root, not the parent of that folder.
• A framework with a build step: have Claude run the build, then publish dist, build or out.
• Lists, forms and boards that were heading for a database: ask for shared records in h0.json.
• Server code: host0 doesn't run it yet. The API refuses server code and secrets like .env with a message that says why, and Claude Code can act on that. A real API has to live elsewhere.

"Claude Code hosting" can also mean running the agent itself, in a cloud or self-hosted environment. That's a different topic: this page is about what the agent made.

The plugin, if you want to publish and manage from one install. The skill alone, if you only publish. The MCP server alone can't publish anything.

/plugin install host0 --marketplace host0-ai/skills

host0-ai/skills counts as a third-party marketplace in Anthropic's terms, and a plugin from any marketplace runs as you. In a session the command opens the plugin's details first, so read them, then pick a scope. Claude Code may ask for /reload-plugins before it's active. We haven't run this install ourselves.

Because local is the default scope: a server loads only in the project where you added it. Add --scope user to the command to get it everywhere, then open /mcp and finish the OAuth sign-in in your browser.

claude mcp add --transport http host0 https://mcp.host0.ai/mcp

Once it's signed in, Claude Code has tools like list_apps, set_visibility, share, restore_version and update_record, and no deploy tool, since that's the skill's job. If you're logged in with a claude.ai account and added host0 as a connector there, it's already available in Claude Code. On Team and Enterprise, only admins can add those connectors.

Most likely auto mode or a permission prompt, not host0. With v2.1.283 or later a terminal session starts in auto mode, where a classifier blocks by default any download piped into a shell, production deploys, and sensitive data sent to external endpoints.

• The install: our curl installer is the piped kind. If it's blocked, use the plugin.
• The deploy: whether a publish reads as a production deploy is the classifier's call, and we haven't measured how often it says no.
• Saying it plainly helps: the classifier reads a message that names the action and its specifics as your approval, such as "publish ./dist to host0 as a private app". That covers the one action.
• After a block: the /permissions panel lists it under Recently blocked, where you can approve a retry. For something routine, autoMode.allow in your settings is the standing version.
• In Manual mode you answer a prompt for the command each time, and in dontAsk mode anything that would prompt is denied.

It needs a few hosts and one folder opened up, by our reading of the docs; we haven't run it. The sandbox is off until you turn it on with /sandbox. Once on, its allowed domains start empty and commands can only write to the working directory and a temp directory, which leaves out where host0 saves your key.

{
  "sandbox": {
    "network": {
      "allowedDomains": [
        "host0.ai",
        "host0.app",
        "registry.npmjs.org"
      ]
    },
    "filesystem": {
      "allowWrite": [
        "~/.host0"
      ]
    }
  }
}

API calls go to host0.ai, uploads to host0.app, and registry.npmjs.org is for the CLI through npx. If npx can't run in there, the skill switches to its publish.sh, which needs only curl and jq.

Without these settings, what happens at a new host depends on the mode: Manual mode prompts you, and auto mode refuses unless the command named the host and the classifier agreed. Claude may also ask to rerun outside the sandbox, shown as "Bash command (unsandboxed)". On native Windows none of this applies, because commands run unsandboxed there.

Yes, if it publishes the same folder, because .host0/state.json in there ties the folder to the app. Artifacts go the other way: a new session makes a new artifact unless you give it the URL.

That state file doesn't come along to a fresh clone or another machine, and the skill says to keep it out of git. There, name the app: "publish my changes to host0 app k3x9q2m7ta". If the session has no files either, the skill pulls the live version into an empty folder first. Pulled files may be a built bundle, so if you still have the source, have Claude Code edit that and rebuild.

It should work, but we haven't run it ourselves. An artifact starts as an HTML or Markdown file Claude Code wrote, in a temp directory unless you named a place, so ask it to publish that file. In a later session, give it the artifact's URL first.

• Live sections stop: connector calls go through claude.ai, so that data has to be baked into the page or moved to shared records.
• The download button goes too: it's a claude.ai capability, so ask Claude Code to rebuild it.
• Comments stay behind on the artifact, and viewers get a new URL.
• The old link keeps working until you delete the artifact, with d in /artifacts. That's permanent, for everyone.

It should work, but we haven't run it. A cloud session, including the browser at claude.ai/code, has neither your local skills nor your plugins, and host0 isn't on its default network list, so you set up each of these first.

• The skill: commit it to the repository's .claude/skills/, or enable it for your claude.ai account. A project's cloud threads only take the account route.
• The network: the Trusted level covers package registries, GitHub and cloud SDKs. Choose Custom and list host0.ai and host0.app, or choose Full.
• The key: add HOST0_API_KEY to the environment's variables. Any command in the session can read it, so treat that environment accordingly.
• The app: name its slug in the prompt, because the VM has no state file.