HaoyouBox Publish MCP server
com.haoyoubox/publish·v1.0.0Publish local HTML or Markdown as expiring password-protected HaoyouBox links.
0 stars99 downloads/wk
Reviews
Write oneNobody has reviewed HaoyouBox Publish yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
HaoyouBox Publish tools (1, 1 write)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
publish_filewrite actionPublish one explicit local HTML or Markdown file as an expiring password-protected HaoyouBox link.
Public scan report
scanner v0.1.10 · 2026-10-27 · same rubric, same numbers if you re-run it
- Code scan12 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitystatic API keys via environment variables6/15
- Maintenancelast push 11 days ago15/15
- Maintainer identitynamespace and repository owner differ; GitHub account older than a year; website matches verified namespace7/10
How HaoyouBox Publish compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 82/100
- higher than 63% of 48,255 servers
- Tools
- 1
- the typical server has 7
- Tools that change things
- 100%
- typical: 0%. Fewer write tools means less an agent can break
- Downloads a week
- 99
- more than 63% of 12,191 servers with a package
What its tools let an agent do: 1 send or post
Install HaoyouBox Publish in Claude Code, Cursor or VS Code
Runs npx -y haoyoubox-mcp on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add publish -- npx -y haoyoubox-mcp
What the publisher says
From the HaoyouBox Publish repository's README, as published. We do not edit it. Read it on GitHub
HaoyouBox Agent Skill
中文说明
Publish one local HTML or Markdown file to HaoyouBox from a compatible AI agent. The Skill creates an expiring, password-protected browser link and returns the complete link, visible password, and actual expiry.
This repository contains the open Agent Skill and its documentation. The hosted HaoyouBox service and server source are not part of this repository.
Install
Codex, Claude Code, Cursor, and other supported agents
Use the cross-agent Skills installer:
npx skills add cheng-big/haoyoubox-agent-skill --skill haoyoubox-publish -gReview the Skill before you approve installation. Restart or reload your agent if it does not discover the Skill immediately.
Gemini CLI
gemini skills install https://github.com/cheng-big/haoyoubox-agent-skill --path skills/haoyoubox-publishGemini CLI asks for installation consent. Use /skills list after installation to confirm that haoyoubox-publish is enabled.
Manual installation
Copy the skills/haoyoubox-publish directory into a Skill location supported by your agent, such as ~/.agents/skills/haoyoubox-publish.
The current hosted copy remains available at haoyoubox.com/agent/SKILL.md.
Use
Ask your agent:
Publish report.html to HaoyouBox and create a password-protected link that expires in 24 hours. Use English for the receiver page. Return the complete link, password, and actual expiry together.For a Chinese receiver page:
把 report.html 发布到好友盒，生成 24 小时密码保护链接。接收页使用中文。请一起返回完整链接、密码和实际到期时间。On first use, the agent opens a HaoyouBox device approval flow. You sign in to HaoyouBox and approve the device. The agent then stores the publish token in its private credential store.
What It Publishes
- One explicit .html, .htm, .md, or .markdown file.
- A fixed browser-ready version on HaoyouBox.
- A password-protected link with a server-enforced expiry.
- A Chinese or English receiver interface.
The Skill does not upload directories, ZIP files, hidden files, environment files, keys, symlinks, or an entire workspace. It does not read upload history, delete pages, revoke links, or manage accounts.
Security
- Review the Skill before installation.
- Device approval always requires an explicit user action.
- The publish token must stay in the agent's private credential store.
- The raw share password is derived locally. HaoyouBox receives a salt and verifier, not the raw password.
- The complete share link includes the password for convenient prefill. Treat the complete link as one sensitive access credential.
- Do not publish files that contain secrets, personal data, private keys, or environment variables.
See SECURITY.md for vulnerability reporting and token-response steps.
Product
- Agent access and installation
- 中文 Agent 接入说明
- Upload from the browser
- Security boundaries
Recipients open the generated link in a browser. They do not need to install this Skill or create a HaoyouBox account.
Contributing
See CONTRIBUTING.md. Run npm test before opening a pull request.
License
The files in this repository are licensed under the Apache License 2.0. Use of the hosted HaoyouBox service remains subject to the product's published terms and policies.
Nothing above is checked by us. What we check is on the safety report.
HaoyouBox Publish: common questions
- Is HaoyouBox Publish MCP server safe?
- Mostly: it is graded B (82/100). Read the HaoyouBox Publish safety report
- How do I install HaoyouBox Publish?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does HaoyouBox Publish need an API key?
- Yes. The registry entry asks for
HAOYOUBOX_TOKEN. - Is HaoyouBox Publish maintained?
- The last commit was 18 days ago (2026-10-17). The latest release is v1.0.0.
- How does HaoyouBox Publish compare with other MCP servers?
- safety score 82/100 (higher than 63% of 48,255 servers); tools 1 (the typical server has 7); tools that change things 100% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.