Stacktree

Works in any agent that can fetch a URL. The instructions are plain Markdown atstacktr.ee/prompt.md— read them before you run them if you like.

Source:github.com/stevysmith/stacktree-skill· the whole collection atstacktr.ee/skills

{ "mcpServers": { "stacktree": { "command": "npx", "args": ["-y", "stacktree-mcp"], "env": { "STACKTREE_API_KEY": "stk_live_..." } } } }

Authorization: Bearer stk_live_…API key Create at app.stacktr.ee/api-keys — or let an agent buy its own over x402 or MPP. Authorization: Bearer <clerk-session-jwt>session Clerk session token, for dashboard-originated calls. Authorization: Bearer <oauth-jwt>OAuth Access token from /oauth/token, used by custom connectors.

filefilerequired .html / .htm / .md / .zip public_slugstring Opt-in public subdomain; authed only. passwordstring Passcode gate on serve. Paid plans only for account publishes; a free account gets 402 plan_password_not_available. expires_in_hoursnumber | "never" Default: 24h anonymous, no expiry on a paid plan. Free is capped at 7 days: a longer value, or "never", is clamped down to the ceiling rather than rejected. Omit it over MCP and the plan's own default applies, same as the raw API. burn_after_read"true" Delete after first view. agentation"true" Inject feedback toolbar on serve. csp_strict"false" Disable strict CSP (default on). The strict policy allows Google Fonts and Loom / YouTube / Vimeo / Wistia / Descript / Calendly embeds, and blocks remote scripts and remote images. A publish that contains something the policy would block still succeeds and returns a warnings array saying what will not render. e2e"true" Treat upload as ciphertext; the decryption key lives in the URL fragment and is never sent to Stacktree. pii_checkoff | warn | block Default warn (MCP layer overrides to block).

curl -F file=@page.html \ -F password=hunter2 \ -F expires_in_hours=72 \ -H "Authorization: Bearer stk_live_..." \ https://api.stacktr.ee/sites

{ "id": "…", "url": "https://stacktr.ee/p/abc123…/", "visibility": "unlisted", "expires_at": 1781234567, "file_count": 1, "size_bytes": 1234, "has_password": true, "agentation": false }

curl -X PUT -F file=@new.html \ -H "Authorization: Bearer stk_live_..." \ https://api.stacktr.ee/sites/my-deck

passwordstring | null Set or remove the passcode gate. Setting one needs a paid plan; removing one always works, including on a page that carries a grandfathered passcode. expires_in_hoursnumber | null null cancels expiry on a paid plan. On Free it is clamped to the 7-day ceiling. allowed_email_domainstring | null Viewers verify an email on that domain before the page renders. Paid plans only; Free gets 402 plan_viewer_gate_not_available. public_slugstring | null Claim or release a public subdomain. agentation · burn_after_read · csp_strictboolean Toggle the serve-time behaviors documented under POST.

curl -X PATCH \ -H "Authorization: Bearer stk_live_..." \ -H "Content-Type: application/json" \ -d '{"agentation": true, "expires_in_hours": null}' \ https://api.stacktr.ee/sites/my-deck

GET/sites List your sites. GET/sites/:idOrSlug One site, with file manifest + absolute preview_url. GET/raw/:token Page HTML stripped of head/scripts — clean text for re-feeding into an agent. Honors password gates. DELETE/sites/:idOrSlug Hard delete: removes R2 objects and metadata. On Free this does not give a page slot back, because the cap counts publishes, not live pages. Viewer numbers are plan-gated. GET /sites and GET /sites/:idOrSlug return metrics_locked: true, with view_count, unique_viewers and last_viewed_at as null, when the plan has no view metrics (anonymous and Free). A boolean opened comes through on every plan, so you can tell someone read the page without seeing how many did. The redaction is server-side, so an agent reading this JSON sees exactly what the dashboard does.

POST https://api.stacktr.ee/sites/:idOrSlug/share-tokens { "label": "alice", "max_uses": 5, "expires_in_hours": 168 } GET https://api.stacktr.ee/sites/:idOrSlug/share-tokens DELETE https://api.stacktr.ee/share-tokens/:tokenId

GET https://api.stacktr.ee/sites/:idOrSlug/feedback POST https://api.stacktr.ee/feedback/:id/resolve { "note": "fixed the header spacing" } DELETE https://api.stacktr.ee/feedback/:id

GET https://api.stacktr.ee/sites/:idOrSlug/reactions { counts, total, reactors, messages } GET https://api.stacktr.ee/sites/:idOrSlug/engagement { sessions, median_active_seconds, avg_scroll, read_to_end_pct, buckets }

How a page landed, read by the owner. Reactions: turn on the on-page reaction bar per site (dashboard Settings) and viewers react with an emoji or leave a short private note, no account. Engagement (Studio and up): aggregate, non-PII read metrics: typical time on page, scroll depth, read-to-end rate, and a 10-bucket attention heatmap of dwell by page depth. No recording, no session replay. Both feed the dashboard activity bell and the optional daily email digest.

POST https://api.stacktr.ee/api-keys { "label": "claude desktop" } GET https://api.stacktr.ee/api-keys DELETE https://api.stacktr.ee/api-keys/:id

publish_html→ { url, id, expires_at, … } One call, one private URL. update_site→ { url, file_count, size_bytes } Replace in place; the URL survives every revision. get_site→ { url, settings, … } Read a published page back. set_password→ { ok: true } Passcode-gate a site. Paid plans only. set_expiry→ { ok: true } Schedule or cancel auto-delete. Cancelling needs a paid plan; on Free the value is clamped to 7 days. set_email_gate→ { ok: true } Restrict viewers to an email domain. Paid plans only. set_agentation→ { ok: true } Toggle the on-page feedback toolbar. list_sites→ { sites: [...] } Everything the key owns. delete_site→ { ok: true } Hard delete. link_wallet→ { ok, adopted } Link the wallet an agent pays from, to claim and manage the pages it published. list_feedback→ { feedback: [...] } Read viewer annotations left via the toolbar; unresolved first. resolve_feedback→ { ok: true } Mark an item addressed after fixing the page, with an optional note. set_client→ { ok: true } File an existing page under a client space, by name or slug. The space is created if it doesn't exist; pass null to detach the page again. Filing is free on every plan. list_client_spaces→ { spaces: [...] } Every client space on the account: slug, name, page count, last activity, the bound hostname if there is one, and whether its client portal is on. create_client_space→ { ok, space } Create a space up front. Rarely needed — publishing with client already creates one. update_client_space→ { ok: true } Rename, archive or restore a space, or set the space-wide viewer gate (a passcode or an email domain) that every page filed under it inherits. delete_client_space→ { ok, detached_pages } Remove a space. Its pages detach and keep their URLs — deleting a client's space never deletes the client's work. get_design_guide→ { guide } The house design guide. Read it before generating or restyling a page so the result arrives looking finished rather than default-styled.

Agents act autonomously without a human reviewing every flag. The MCP layer applies tighter defaults than the raw API: - Plan-aware expiry. Omitting expires_in_hours takes the plan default — 24h anonymous, 7 days on Free, no expiry on a paid plan. Pass "never" for permanence, which a paid plan honours and Free clamps back to 7 days. - Safety scan in block mode (raw API: warn) — blocks accidental publication of personal data or secrets. The scan protects your content; nothing is collected or stored. - Unlisted token URL, strict CSP (Google Fonts + named video embeds allowed; remote scripts and images blocked), X-Robots-Tag: noai — same defaults as the raw API.

Want the same pattern in your own app? The palette and WebMCP registration are built onagentk, our open-source cmdk extension: define tools once as JSON Schema, humans get generated forms, agents get the schemas.

An agent pays with no human and no account, two ways: per publish at the front-door, or with a persistent key bought once. Both acceptx402(USDC on Base or Solana) andMPP(USDC.e on Tempo), so the agent pays with whatever it holds, gasless for the payer. Machine-readable version:x402.md.