publish-with-pagelive — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited publish-with-pagelive (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Pagelive is a hosted MCP connector (io.pagelive/pagelive, remote at https://app.pagelive.io/api/mcp, OAuth or API-key auth) that turns HTML into a private, shareable, view-tracked link. Reach for it whenever the user wants to send something they built — not just see it in the conversation.
Pages are served from an isolated content plane (pagelive.site, or a connected custom domain), are `noindex` and private by default, can be password-gated, carry a small "Made with Pagelive" badge, and keep a version history (every publish/update is a new version; the link never changes).
publish_pageupdate_pageget_page_statslist_pageslist_form_submissionslist_workspaces / list_domains first.publish_page (full HTML). You get back a live url + slug. Give the userthe URL plainly — it's stable.
update_page — prefer edits (send only the changed regions), not a fullresend. The URL never changes.
get_page_stats (opens) and list_form_submissions (replies).Only report what the tools actually return — never invent numbers.
publish_page — create or replace a page| Param | Required | Notes |
|---|---|---|
html | ✅ | A complete HTML document (<!doctype html>…). This is the page. |
title | – | Dashboard label only (≤200 chars). Not shown on the page. |
password | – | Gates the page behind a password. Free = 1 protected page; paid = unlimited. |
slug | – | Two meanings — see below. |
workspace | – | Team id/slug from list_workspaces. Omit = your personal workspace. |
domain | – | A connected, active custom-domain hostname from list_domains. Paid only, and the domain must belong to the chosen workspace. Omit = pagelive.site. |
`slug` has two behaviours (slugs are unique per host):
replaced as a new version. Returns replaced: true. Works on Free (this is how "update the same link" stays available to everyone).
pagelive.site is alwaysauto-generated, so a new slug there is rejected for every plan — omit it. To choose a slug, pass a connected domain (paid) together with the slug.
Returns: { slug, url, workspace, replaced? }. Default host is pagelive.site, personal workspace. Pages publish as live, noindex, badge on.
update_page — edit an existing page| Param | Required | Notes |
|---|---|---|
slug | ✅ | The page to edit. Must be unambiguous across your hosts/workspaces. |
edits | preferred | Array of { old_str, new_str } find-and-replace ops. Send only the changed regions. |
html | alt | A full document that replaces the whole page. Use only for a complete rewrite. |
The edit contract (important): each old_str must appear exactly once in the current page. If it's missing or appears more than once, the entire update is rejected and the page is left untouched (never corrupted). To fix: re-read the page (its current HTML) and copy exact text, adding surrounding context to disambiguate. Returns { slug, url, updated: true, mode: 'patched' | 'replaced' }.
get_page_stats — analytics for one pageParam: slug (required). Returns: { slug, url, totalViews, recordedEvents, uniqueViewers, topCountries: [{ country, n }] }
totalViews — lifetime view counter for the page.recordedEvents — detailed, bot-filtered view events.uniqueViewers — distinct visitors (by hashed IP).topCountries — up to 5, busiest first.Note: this tool does not return per-visitor dwell time — don't claim dwell from it. Report the four fields above. (Dwell/engaged-time lives in the dashboard, not this endpoint.)
list_pages — everything you can accessNo params. Returns up to 200 pages, newest first: { pages: [{ slug, title, viewCount, status, workspace, url }] }. Includes your personal pages plus pages in teams you belong to. Good for "which pages got views" (read viewCount).
list_form_submissions — read reply-form responsesParams: slug (required), limit (default 50, max 200). Returns: { slug, count, replies: [{ submittedAt, country, fields }], tip? } — newest first. fields is the submitted form data as key/value pairs. If count is 0, tip explains how to add a form.
list_workspaces — where you can publishNo params. Returns { workspaces: [{ id, kind, plan, … }] } — always a personal entry plus any team workspaces (with role). Use an id/slug as the workspace arg to publish_page.
list_domains — connected custom domainsOptional workspace filter. Returns { domains: [{ hostname, workspace }] } (active domains only). Use a hostname as the domain arg to publish_page.
publish_page { html } → share the url. (Private/noindex by default.)publish_page { html, password }. On Free, only the first protected page.update_page { slug, edits: [{ old_str: "Q2", new_str: "Q3" }] } — thelink stays the same. Never republish a whole new page when the user means "update".
list_workspaces → publish_page { html, workspace: "<id>" }.list_domains → publish_page { html, domain: "deck.acme.com" }.<form data-pagelive> with named inputs in the HTML — noaction/endpoint needed; Pagelive wires it on serve, emails the owner, and stores submissions. Then list_form_submissions { slug }. Example:
<form data-pagelive>
<input name="name" placeholder="Your name">
<input name="email" type="email" placeholder="Email">
<textarea name="message" placeholder="Reply"></textarea>
<button type="submit">Send</button>
</form>get_page_stats { slug }, or list_pages for a portfolio view.verbatim. External assets (fonts, images) load fine via absolute URLs.
name="…") so submissions come back as labelled fields.control — don't promise it can be removed via MCP).
on pagelive.site. No custom slugs, no custom domains.
slugs are still auto-generated on pagelive.site), team workspaces.
pagelive.site. Omit slug (links there are auto-generated), pass the slug of a page you already own to replace it, or publish to a connected domain to choose the slug.
edits didn't match exactly once.Re-read the page and copy exact text with more context. The page was not modified.
Disambiguate (the page may live on a custom domain).
domain.get_page_stats /list_form_submissions return.
update_page when a few edits will do.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.