Artifact Publisher
Access

Share a dashboard on an unlisted, revocable link

Have your agent publish the dashboard with Artifact Publisher. You get one stable link that is not listed anywhere and asks search engines not to index it. You can later limit it to named people or to yourself without changing the link, and revoke it so it stops working.

Updated

By Angle Labs GmbH. Written on 2 November 2026.

The short answer

Publish the dashboard as one self-contained HTML page with Artifact Publisher, an MCP server your agent calls. The default link is public in the unlisted sense: anyone who has the link can open it, nobody can find it by browsing, and the page asks search engines not to index it. When the audience changes, switch the same link toallowlist (named email addresses) or private (only you). When you are done,revoke_artifact stops serving it. Access, expiry and revocation are checked on every request.

See an example

Pinecrest Roasters, Q3 KPI report is a live dashboard with example data, published this way. The link is unlisted: nobody can find it by browsing the site, and it asks search engines not to index it.

1. Connect your agent

Artifact Publisher works with any MCP client that can reach https://app.artifactpublisher.com/mcp. Claude Code and the Codex CLI can sign in in the browser, with no key to copy. For Claude Code:

claude mcp add --transport http artifact-publisher \
  https://app.artifactpublisher.com/mcp

For the Codex CLI:

codex mcp add artifact-publisher --url https://app.artifactpublisher.com/mcp

Cursor signs in with your browser too, so there is no key to copy: add the server URL with no key or headers. The Cursor setup is in Share Cursor or Codex CLI output as a web page. Other clients use a scoped publisher key sent as Authorization: Bearer. Mint it onyour dashboard: it is shown once, and only a hash is stored. Those clients are inPublish HTML over MCP.

You need an Artifact Publisher account to publish; people who open a public link do not.

2. Publish the dashboard

The page runs in a sandbox with no network access. Scripts run inline only and cannot fetch live data, so the numbers go into the page when the agent builds it:

Build the Q3 dashboard as one self-contained HTML page: charts drawn with inline SVG or an inline script, data inline, nothing loaded from other sites. Publish it with the artifact-publisher MCP server as a public artifact titled "Q3 dashboard", and reply with the share link and the artifact_id.

The result has the link, https://app.artifactpublisher.com/artifact/<slug>. To refresh the numbers later, ask the agent to call update_artifact: it adds a new version behind the same link, so nobody needs a new one. To make the link stop working on a date, pass expires_at when you publish (from one minute to 365 days ahead).

3. Change who can open it

set_artifact_access changes access on the same link, without publishing a new version. To limit the dashboard to named people, use allowlist with up to 50 email addresses:

{ "artifact_id": "<artifact_id>", "visibility": "allowlist", "allowed_emails": ["cfo@example.com", "ops@example.com"] }

Each person on the list signs in with an Artifact Publisher account whose primary email is on the list. Anyone else who has the link is refused. To keep it to yourself, use private:

{ "artifact_id": "<artifact_id>", "visibility": "private" }

Switch back to public the same way when anyone with the link should be able to open it again.

4. Revoke it

Revoke the artifact <artifact_id> with the artifact-publisher MCP server.

revoke_artifact stops serving the dashboard: the link answers 410 Gone. It cannot be undone, and it cannot recall a copy someone already saved or a screenshot someone took. If the data must not leave a small group, use allowlist from the start rather than relying on revoking later.

What unlisted does not mean

  • A public link is not authenticated. Anyone it is forwarded to can open it.
  • Asking search engines not to index a page keeps it out of well-behaved search results. It is not access control.
  • The page has no network access, so it cannot pull fresh numbers by itself. Publish a new version to update it.

Next