A Static.app alternative that is private by default

What Static.app is, and what this is

Static.app hosts static content with an in-browser editor and a template gallery. Sites are public by default; a password is an optional extra you add afterwards.

A link here is unguessable before you have configured anything, and the content is whatever the agent produced — this deployment does not try to become the editor.

Where the two overlap

• Static hosting, fast links, custom domains, passwords available.
• An MCP server on both sides, so an agent can publish without a human in the loop.

Where the defaults diverge

• Default posture. Public-then-lock versus unguessable-then-open. Defaults decide what happens on the day someone forgets a step.
• Replace-in-place. The same URL across every revision of the same document, by design, not by re-uploading over the old name.
• No in-browser editor. Deliberate: the page is an artifact of a conversation with an agent, and editing it by hand puts the hosted copy out of sync with the thing that made it.
• Reading, measured. Opens, dwell, scroll depth and a ten-segment attention map, with no session recording.

Side by side

Publishing the same page here

No account, no install — the anonymous route gives you a private link to compare against whatever you are using now:

curl -X POST https://read.botook.ai/v1/publish -F file=@index.html

With a key, from an agent, it is one tool call:

publish_html({
  content: "<h1>Q3 review</h1>…",
  expires_in_hours: 168,
  password: "optional"
})

The second revision is where it shows

Agent loops do not produce one page, they produce fourteen versions of one page. update_site writes the new bytes behind the existing token, so the address you already sent out keeps resolving to the current draft:

curl -X PUT https://read.botook.ai/sites/SITE_ID \
  -H "Authorization: Bearer otr_live_YOUR_KEY" \
  -F file=@report.html

Three gates, stacked or separate

Plus expiry — set_expiry in hours, or never — and burn-after-read, which closes the page permanently after the first successful open.

What you can hand it

The upload primitive is the same on every route, so nothing has to be converted before it is sent. A single document, a folder, or a drawing all go through one call:

Markdown is rendered when it is published rather than when it is read, so the reader, the preview card and /raw are all looking at the same stored document. Notebooks, diagrams and slide decks travel as whatever they export to — this hosts the export, it does not run a converter over your source.

What the reader sees

No account and no install: a reader opens the link and the page is simply there. Everything optional is off unless you asked for it.

• Nothing to sign into. The token in the URL is the credential — until you stack a password or an email-domain gate on top of it.
• An optional toolbar. With set_agentation on, a reader can select any element and leave a note anchored to it, which you read back with list_feedback and close with resolve_feedback.
• Optional reactions. A separate switch from feedback, because a reaction is an opinion and a note is a task.
• A link preview. Pasting the URL into a chat app renders a card from a real screenshot of the current revision, unless a gate is up — a page behind a password is never photographed.

What you learn afterwards

Sending a link and hearing nothing back is the normal failure of every tool in this category. Read-side numbers are collected per page and per revision without cookies or a third-party tag:

• Views and unique readers, and when the page was last opened.
• Dwell time and scroll depth, plus whether anyone reached the end.
• A ten-segment heat map showing where attention stopped.
• Unresolved notes and reaction counts, carried on the site object itself.

curl https://read.botook.ai/sites/SITE_ID/engagement \
  -H "Authorization: Bearer otr_live_YOUR_KEY"

Moving a page across from Static.app

Download the site, zip it and publish. If you were editing in the browser, the replacement habit is to edit in the conversation and let the agent re-publish.

1. Get the HTML — export it, view-source it, or ask the agent that wrote it for the file.
2. Publish it: paste it on the home page, drop it in the dashboard, or POST /sites with your key.
3. Set the access rule the page deserves: password, email-domain gate, or nothing but the token.
4. Send the new link, and let the old one expire rather than deleting it out from under anyone.
5. Wire the agent up once — see integrations — so the next revision never passes through your hands.

Getting your pages back out

The question worth asking before you move anything in: how hard is it to leave? Every published document can be read back in full, by the key that owns it, in the exact bytes that are served — plus a plain-text rendering for whatever needs to re-read it as prose:

curl -s https://read.botook.ai/sites -H "Authorization: Bearer otr_live_YOUR_KEY" | jq '.sites[].id'
curl -s https://read.botook.ai/sites/SITE_ID/content -H "Authorization: Bearer otr_live_YOUR_KEY" -o page.html
curl -s https://read.botook.ai/raw/UNLISTED_TOKEN -o page.txt

Nothing is stored in a proprietary container and nothing is proxied from somewhere else — a published page is the file you handed over, in object storage, addressed by a token. A loop that wrote its output here can walk its whole list_sites result and pull every page down in one pass, which is the only export guarantee that means anything.

Where the bytes actually live

This is a self-hosted deployment on Cloudflare: the request is handled at the edge, the document sits in object storage, and the metadata is one row in a SQL database. That has three consequences worth knowing before you compare it with a managed product.

The trade is explicit: you inherit the operational surface — the domain, the storage bill, the upgrade — in exchange for nobody else being able to change the terms under you. Self-hosting covers what that actually involves.

Evaluating both at once

You do not have to pick before you know. Publish the same document to both, send the pair to somebody, and compare the two things that only show up in real use: what the recipient has to do before they can read it, and what you can find out afterwards.

1. Publish it here anonymously — no account, no project to create, one curl.
2. Publish the same file to Static.app the way you normally would.
3. Send both links to the same reader and watch which one they open without asking a question.
4. Change the document, and update each one. Note whether the link you already sent still works.
5. Check what each side tells you afterwards about whether it was read.

Step 4 is where the difference usually lands, and it is the step people skip when comparing on a feature table. Publishing directly from the agent that wrote the page only pays off if the second revision costs nothing.

When Static.app is the better answer

If a non-technical person needs to tweak copy on a live page without touching an agent or a terminal, an in-browser editor is genuinely better. There is no equivalent here on purpose.

This page would be worth less if it pretended otherwise. The comparison that matters is between defaults, and defaults are only right relative to a job.

Questions people ask

Can I make a page public?

You can hand the link to anyone and it works — there is no reader account. What you cannot do is get it indexed; every viewer response carries noindex.

What about templates?

There are none. The content comes from your agent, which is a better template engine than a gallery.

What does it cost?

Nothing — it is self-hosted on Cloudflare, so pricing is a description of your own bill rather than a set of tiers.

Which agents can publish to it?

Anything that speaks MCP over HTTP: Claude Code, Codex, Cursor, the Claude.ai connector — or plain curl from a script.

Where is the full reference?

The docs: every endpoint, all twelve tools, the upload formats and the defaults applied to each page.