# host0

> host0 is a cloud for small software: publish a folder of static files, get a live url in seconds. apps are public at an unguessable, unlisted slug by default, and can be made private or shared with named people by email. bring any coding agent — host0 is the last step, not the generator.

## machine surfaces

- [skill.md](https://host0.ai/skill.md): the host0 skill instruction file, served verbatim
- [publish.sh](https://host0.ai/publish.sh): the bundled publish script (chmod +x it)
- [api index](https://host0.ai/api/v1): every endpoint, every cap, the upload contract — as json
- [mcp endpoint](https://host0.ai/mcp): the remote mcp endpoint (oauth; a bare GET answers 401)

## docs

- [docs](https://host0.ai/docs): the full reference — quickstart, api keys, publishing, access control
- [agent landing](https://host0.ai/agents): this quickstart as a page
- [human landing](https://host0.ai/): the same pitch, for a person

## install the skill

two files: an instruction file and one bash script. requires `curl`, `jq`, and `shasum`/`sha256sum`. the paths below are where claude code keeps skills — use whichever directory your agent reads.

```sh
mkdir -p ~/.claude/skills/host0/scripts
curl -sS https://host0.ai/skill.md -o ~/.claude/skills/host0/SKILL.md
curl -sS https://host0.ai/publish.sh -o ~/.claude/skills/host0/scripts/publish.sh
chmod +x ~/.claude/skills/host0/scripts/publish.sh
```

## get an api key

an emailed 6-digit code buys a key. it starts `h0_`, is returned exactly once, and travels as `authorization: bearer h0_…` on every authenticated request.

```sh
# 1. request a 6-digit code — host0 emails it
curl -sS https://host0.ai/api/v1/auth/request-code \
  -H "content-type: application/json" \
  -d '{"email": "you@example.com"}'

# 2. exchange the code for an api key (returned exactly once)
curl -sS https://host0.ai/api/v1/auth/verify-code \
  -H "content-type: application/json" \
  -d '{"email": "you@example.com", "code": "123456"}'

# 3. save it yourself — don't make the human run this
mkdir -p ~/.host0 && printf '%s' "h0_your_key_here" > ~/.host0/credentials && chmod 600 ~/.host0/credentials
```

## publish

publish a built static site with `index.html` at the root of the directory — its contents become the site root. the script handles hashing, the manifest, uploads, and finalize.

```sh
# first publish — creates the app
~/.claude/skills/host0/scripts/publish.sh ./my-site --name "my site"

# every publish after that — same folder, same app, unchanged files skipped
~/.claude/skills/host0/scripts/publish.sh ./my-site
```

or drive the rest api directly — four steps, and nothing is live until the last one succeeds:

1. POST https://host0.ai/api/v1/apps — body {"name": "my site"} → app_id, slug, url
2. POST https://host0.ai/api/v1/apps/{app}/deployments — body {"files": [{path, size, sha256}]} → upload.targets (unchanged files come back in upload.skipped)
3. PUT each target url — raw bytes, size and sha256 must match the manifest
4. POST https://host0.ai/api/v1/deployments/{id}/finalize — flips the deployment live, atomically

## mcp

claude and other mcp clients can skip the skill entirely:

```sh
claude mcp add --transport http host0 https://host0.ai/mcp
```

## visibility

- `public`: the default — random unguessable slug, unlisted, served noindex; anyone holding the url can view it.
- `link`: the same behaviour, stated explicitly.
- `private`: the owner plus emails invited through `POST /api/v1/apps/{app}/shares`. visitors sign in to view; removing an invite kills their sessions immediately.

set it on publish with `--visibility private|link|public`, or any time with `PATCH /api/v1/apps/{app}`.

## limits

not repeated here — [GET /api/v1](https://host0.ai/api/v1) returns the live numbers under `limits`, rendered from the same constants the server enforces.