brewpage-openapiCAUTION
Open API Specification for https://brewpage.app - Free HTML, Markdown, AI Artifacts & File Instant Hosting
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/brewpage-mcp) [](https://github.com/kochetkov-ma/brewpage-openapi/stargazers) [](openapi/openapi.yaml) [](LICENSE) [](mcp-server/)
This repository is the open-source public layer of BrewPage -- a proprietary HTML/KV/JSON/file hosting platform. The backend, frontend, and infrastructure remain closed-source.
Docs: https://kochetkov-ma.github.io/brewpage-openapi/ | API Reference: https://kochetkov-ma.github.io/brewpage-openapi/api-reference/
What is BrewPage
BrewPage is a free instant hosting service for HTML pages, Markdown documents, multi-file sites, AI artifacts, JSON documents, key-value stores, and binary files. No signup or API key required. Every published resource gets a short HTTPS URL (brewpage.app/{namespace}/{id}) within seconds.
Key characteristics:
- HTML and Markdown pages -- publish raw HTML or Markdown rendered to styled HTML, up to 5 MB, with instant short URLs.
- Multi-file sites -- upload a ZIP archive or individual files (up to 20 MB / 100 files) and get a fully served static site.
- Key-value store -- namespace-scoped KV pairs, up to 1,000 keys per namespace, mutable in place via the owner token.
- JSON documents -- store and retrieve arbitrary JSON, up to 1 MB per document, 10,000 documents per collection.
- File hosting -- upload any safe file type (images, PDFs, video, audio, archives, code), up to 5 MB (video 20 MB), with inline preview.
- Public namespace -- omitting
?ns=publishes to the sharedpublicname
0dfcff643d03OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add brewpage-mcp -- npx -y [email protected]
Exposed tools (16)
6 read · 9 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
delete_resource | destructive | Delete a BrewPage resource (HTML page, KV store, JSON collection, or file) using the owner token. |
get_json | read | Fetch a published BrewPage JSON document by namespace and ID. |
get_kv | read | Fetch a value from a BrewPage KV store by namespace, ID, and key. |
get_page | read | Fetch a published BrewPage HTML page content by namespace and ID. |
get_stats | read | Get BrewPage platform-wide usage statistics including page count, file count, and storage usage. Counts use disjoint split: alive_public + alive_private + deleted == total. Optional |
publish_file | write | Upload a file to BrewPage via URL. Returns a public URL and owner token. |
publish_html | write | Publish HTML or Markdown content to BrewPage. Returns a public URL and owner token. Supports password protection, custom TTL, optional filename, and an opt-in top toolbar (showTopBar). |
publish_json | write | Publish a JSON document to BrewPage. Accepts a JSON object, array, or a JSON-encoded string. Returns a public URL and owner token. |
publish_kv | write | Publish a key/value entry to BrewPage. Creates a KV store; the entry is addressed by (namespace, id, key). Returns a public URL and owner token. |
publish_site | write | Publish an HTML site to BrewPage. Single-page: pass |
republish_site | read | Republish (full-replace) an existing multi-file BrewPage site in place at the SAME URL/ID. Requires owner token. The uploaded bundle becomes the complete new file set — files absent from it are removed, new files added, matching files overwritten. Single-page: pass |
search_gallery | read | Search the BrewPage public gallery. Optional filters: text query, pagination, sort, and |
set_kv | write | Set or update a key in an existing BrewPage KV store. Requires owner token. |
update_hosting | write | Change delivery mode for a NEW public non-site publication. Requires owner token and current hostingVersion. OLD links and forced subdomain modes are locked; reload after a 409 conflict. Content updates never change hosting. |
update_html | write | Update an existing BrewPage HTML/Markdown page. Requires owner token. Returns the updated page metadata. |
update_json | write | Update an existing BrewPage JSON document. Requires owner token. Accepts a JSON object, array, or a JSON-encoded string. |
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (9 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (9)
const password = "fixture-transport-password";
delete_resource
const baseUrl = `http://127.0.0.1:${(address as { port: number }).port}`;`POST /api/html` and `PUT /api/html/{ns}/{id}` responses may also include two optional strings. When a public HTML or Markdown page is created without `X-Delivery-Mode` and its inline code relies on b[BrewPage](https://brewpage.app) is a free instant hosting platform designed for AI agents and developers. One `POST` request publishes HTML, Markdown, a multi-file site, a JSON document, or a binary
[BrewPage](https://brewpage.app) is a free instant hosting platform for HTML pages, multi-file static sites, KV entries, JSON documents, and binary files. One `POST` returns a stable HTTPS short URL w
<a href="https://brewpage.app">BrewPage</a> is a free instant hosting platform for HTML pages, multi-file static sites, KV entries, JSON documents, and binary files. One <code>POST</code> returns a st
NEW protected browser links use the clean returned `link` and a trusted top-level unlock gateway. Never append passwords or owner tokens to NEW share URLs. OLD publications retain historical access be
# Access with password
Gates applied: no_behavioural_pass.
0dfcff643d03full audit observations/trust-audit/mcp-server/kochetkov-ma__brewpage-openapi.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 0dfcff643d03 | CAUTION | B | 89 | first audit |
Questions
What is the brewpage-openapi MCP server?
Open API Specification for https://brewpage.app - Free HTML, Markdown, AI Artifacts & File Instant Hosting
What tools does brewpage-openapi expose?
16 in total: 6 read-only, 9 that write, and 1 that can delete or overwrite (delete_resource). Every one is listed on this page with its risk.
Is brewpage-openapi safe to connect to an agent?
With care. The audit graded it B (89/100) and found 9 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does brewpage-openapi need?
No credential environment variables were found in its source, so it appears to need none.
How does brewpage-openapi run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as brewpage-mcp at 1.9.2.
How current is this page?
The grade is for one exact copy of the source (0dfcff643d03), read on 2026-10-11. The repository is watched and re-audited when it changes.