Open Artifact

中文

Any AI agent publishes HTML pages ("artifacts"); the whole team opens, comments on and uses them, without a Claude account. Everything runs on your own Cloudflare account.

• Publish from any agent. Claude Code, Codex, Cursor or anything else, through MCP or a plain HTTP API.
• Comment on the page itself. Pin a comment to a spot or a selected passage, and hand open comments to an agent with one copy. Each comment has its own link that opens the page at it.
• Versions, sharing and public links. Private, named people, the whole workspace, or a public link with an expiry and an optional password.
• A personal page. Authors list public artifacts at /@name, with share cards and search-engine indexing for those pages only.
• Workspaces. Everyone gets a personal workspace; create more, invite people, and belong to several. See Workspaces.

The interface speaks Chinese and English; see Languages.

License. Open Artifact is source-available under the PolyForm Noncommercial License 1.0.0. It is free for noncommercial use. Commercial use, including a company running it for its own staff, needs a separate license: https://ui.xiaoxiaodong.ai/license

Run it locally

Requires Node 22 and pnpm 9.

pnpm install
pnpm dev:setup   # writes .dev.vars with local secrets, applies the D1 migrations
pnpm dev         # usercontent :8789, app :8787, MCP :8788

Open http://localhost:8787 and sign in with an @example.com address (local setup allows that domain; change ALLOWED_EMAIL_DOMAINS in apps/app/.dev.vars). Locally the sign-in code is printed in the terminal running pnpm dev (look for [mail]). Everyone who signs in gets a personal workspace and is its admin; invite others from 设置 › 成员, or create a shared workspace from the workspace menu at the top left of the home page.

Stop the servers with Ctrl-C. If a port is still taken afterwards, pkill -f workerd.

Workspaces

Artifacts live in workspaces. A workspace can hold one person or many, and a person can belong to several and switch between them from the workspace menu. Sharing, tokens and the admin log all work per workspace; an agent's token publishes into the workspace it was created in.

• Personal workspace. Created at a person's first sign-in, named after them, with them as admin. It can be renamed and others invited in, but it cannot be left or deleted, so everyone always has somewhere to land.
• Joining. People join a workspace only through an invite: an email invite (valid 7 days) or an invite link that lasts 7 days, 30 days or never. Someone who signs up through an invite gets their personal workspace and the invited one, and lands in the invited one. There is no automatic joining by email domain.
• Leaving and deleting. Members and all but the last admin can leave; any later invite brings them back. Someone an admin removed comes back only through an email invite addressed to them. Admins can delete a workspace: every member, page, public link and token loses access at once (tokens answer workspace_deleted), admins can restore it for 30 days from 最近删除 in the workspace menu, and the daily job then deletes it with its artifacts and files.
• 分享给我的 lists every artifact shared with a person one by one, from any workspace, labeled with the workspace it comes from.

Upgrading a self-hosted deployment. Earlier versions put every new account into the deployment's first workspace. That no longer happens: new colleagues land in their personal workspace. After upgrading, have an admin create a never-expiring invite link under 设置 › 成员 and post it where colleagues find it, such as the team chat or onboarding doc. Existing members keep their workspace and get a personal one on their next visit.

Connect an agent

1. In the app, open 设置 › Agent 接入 and create a personal API token.

2. Add the MCP server shown there, for example for Claude Code:

   claude mcp add --transport http open-artifact http://localhost:8788/mcp --header "Authorization: Bearer oa_pat_…"
   

3. Ask the agent to publish something. Agents without MCP can use the HTTP API described at http://localhost:8787/llms.txt.

Checks

pnpm run check   # storage boundary, type checks, all tests (Workers runtime, local D1 and R2)

Layout

Path	What it holds
packages/core	Domain types, repository interfaces, access rules (ArtifactAccess), token and signature secrets
packages/storage-cloudflare	D1 and R2 repositories and the migrations; the only code that touches D1 or R2
apps/app	Web pages, HTTP API, sign-in (Better Auth), the viewer's postMessage proxy
apps/usercontent	Serves artifact files on their own origin through signed URLs, and injects the page SDK; reads files through the app's ArtifactFileReader RPC entrypoint and has no storage binding
apps/mcp	Remote MCP server; each tool is one call to the app's HTTP API with the agent's token

This is the beginning of the README. Read the rest at the original. Read the full README ↗