Just Publish Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Just Publish Mcp (MCP Server) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Publish and update the website you built with AI at a live public URL. Sign-in required.
Just Publish puts the website you built with AI live at a public address. Your assistant makes the files; Just Publish publishes them at a justpublish.site address that anyone can open, and keeps them there. You sign in once with your Just account, and every site belongs to the account that published it. A published site can later run at a domain you own.
https://mcp.justpublish.ai/ai.justpublish/just-publishopens a sign-in window the first time (Google or a code sent by email).
Add the endpoint to your client's MCP servers and sign in when it asks:
{
"mcpServers": {
"just-publish": {
"type": "streamable-http",
"url": "https://mcp.justpublish.ai/"
}
}
}The client discovers the authorization server from the endpoint, so there is no API key, client id or secret to paste. In Claude, add the connector at https://mcp.justpublish.ai/claude; in Claude Code:
claude mcp add --transport http just-publish https://mcp.justpublish.ai/claudeStep-by-step guides for each assistant and editor are at https://justpublish.ai/install.
| Tool | What it does |
|---|---|
deploy | Publishes a site from its files and returns its public address. |
get_site_files | Reads the files of a published site. |
update_site_file | Changes one file of a published site and puts the change live. |
list_sites | Lists the sites on the signed-in account. |
The account comes from the sign-in, so deploy takes no email address and the signed-in person's own sites need only a site_id.
Static Markdown guidance the client can load before it picks a tool:
| Resource | Purpose |
|---|---|
just-publish-overview | What Just Publish is and which tool to use when. |
just-publish-edit-lifecycle | The read, edit and update loop. |
just-publish-file-conventions | Paths, encoding, size limits, routing. |
just-publish-invariants | index.html required; deploy replaces, update_site_file merges. |
This repository also hosts the just-publish skill in the SKILL.md format, which teaches an agent the publish flow before it calls a tool. Add it, with the Just Domain skill, to any agent that reads Agent Skills:
npx skills add just-done/skillsTo install this copy in Codex, give the skill installer this tree:
https://github.com/just-done/just-publish-mcp/tree/main/skills/just-publishor copy skills/just-publish/ into ~/.codex/skills/ (or ~/.claude/skills/). The same package is listed for discovery at justpublish.ai/.well-known/agent-skills/index.json.
index.html at the root. No build step and no server code.
Public metadata and the registry listing for the Just Publish MCP server: server.json, .mcp.json, icons, the skill and this README. The server runs at https://mcp.justpublish.ai/; its source is not part of this repository. Just Publish is operated by Just Done LLC.
MIT. See LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.