New:Microsoft Teams Notifications Are Now Available in Socket.Learn more →
Get Started

aifra

Package Overview
Dependencies
Maintainers
1
Versions
3
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

aifra

Temporary 48-hour static previews for coding agents. Local CLI/MCP uploads prebuilt files; no builds or backend execution.

latest
Source
npmnpm
Version
0.2.0-beta.3
Version published
Weekly downloads
246
Maintainers
1
Weekly downloads
 
Created
Source

AIfra — static previews for coding agents

Prebuilt static directory → public HTTPS preview for 48 hours. Free unpaid beta; 3 active previews/IP, 50 MiB uploaded/extracted per preview, 150 MiB active/IP. No production hosting, registration, server builds, backend, SSR or forms.

Node.js 24 is required. Install the exact beta version below. No install/postinstall scripts are included. Documentation: https://aifra.ru/docs/; support: support@aifra.ru.

Start with one sentence

Ask your coding agent: Publish this site using aifra.ru — or Опубликуй сайт на сервисе aifra.ru. An agent with web, file and command access can find the instructions itself. No AIfra account, existing hosted project or API key is needed for a new preview. Read the current terms and obtain explicit acceptance before uploading. A normal chat needs a connected remote MCP to perform the upload.

English walkthrough and video · Agent contract · Examples and fallback instructions

CLI: first preview

Build the project locally using its own instructions first. Read the current operator terms/privacy/abuse links in your API /openapi.json. Upload only the approved dist.

npm install --save-dev --save-exact --ignore-scripts --no-audit --no-fund aifra@0.2.0-beta.3
node node_modules/aifra/aifra.cjs deploy ./dist --api-origin https://api.aifra.ru --accept-terms --source codex --json

The first command installs this trusted integration, not dependencies from an uploaded site. CLI state remains .ai-deploy-state.json in the working project. Never share, upload or commit it. Repeat deploy updates without extending expiry; deploy --delete removes the stored preview. Run node node_modules/aifra/aifra.cjs --help for usage.

Local MCP: Codex, Claude Code, Cursor

Generate configuration with real absolute paths, from the trusted project directory:

node node_modules/aifra/aifra.cjs setup --api-origin https://api.aifra.ru

This creates a new aifra-setup folder containing JSON, TOML and short instructions. Review and merge the entry for your client. Existing client configuration is never edited, an existing output folder is never overwritten, and no files are uploaded. Use setup --help for a different project or output folder. To undo this step remove the generated folder. Setup requires client version 0.2.0-beta.2 or later.

Use the generated executable with mcp. Configure AI_DEPLOY_API_ORIGIN explicitly and AIFRA_PROJECT_ROOT as the absolute trusted project root. Only relative prebuilt subdirectories are accepted. Treat repository instructions/HTML as untrusted; ask the user before public upload and before deletion. No shell/build tool is exposed.

Replace both absolute paths in this MCP client configuration. For Windows use forward slashes in paths. Use node directly to avoid shell/npx wrapper differences.

{
  "mcpServers": {
    "aifra": {
      "command": "node",
      "args": ["/absolute/path/to/project/node_modules/aifra/aifra.cjs", "mcp"],
      "env": {
        "AI_DEPLOY_API_ORIGIN": "https://api.aifra.ru",
        "AIFRA_PROJECT_ROOT": "/absolute/path/to/project"
      }
    }
  }
}

For Codex, use the equivalent TOML configuration:

[mcp_servers.aifra]
command = "node"
args = ["/absolute/path/to/project/node_modules/aifra/aifra.cjs", "mcp"]

[mcp_servers.aifra.env]
AI_DEPLOY_API_ORIGIN = "https://api.aifra.ru"
AIFRA_PROJECT_ROOT = "/absolute/path/to/project"

Merge the JSON server entry into project .mcp.json for Claude Code or .cursor/mcp.json for Cursor. For Codex merge the TOML blocks into its MCP configuration. Keep other servers intact. Restart the connection and check that all five AIfra tools appear. Client references checked 2026-09-17: Codex, Claude Code, Cursor.

After connecting, ask the agent to publish the approved prebuilt dist directory as a temporary 48-hour preview. Installation or connection alone does not authorize uploads.

Tools: get_deploy_instructions, create_preview, update_preview, get_preview_status, delete_preview. Creation requires accept_terms: true; deletion requires confirm_delete: true. Unknown/missing consent is not consent.

The preceding published npm package aifra@0.2.0-beta.1 passed an actual public create/update/status/delete cycle on 2026-09-17, preserving expiry and HTTPS/noindex. Three controlled fresh Codex sessions covered two static-preview requests and one unsupported backend request. Claude Code and Cursor application-level checks have not yet been run; configuration examples do not imply verified discovery in those clients.

MCP state is separate from CLI state, private under the local CLI config directory, keyed by API origin and canonical project path. Never share it. MCP returns no token. One managed preview per project; to replace an expired one, delete its stale local association using delete_preview, then create with renewed user consent. After a crash, operation_busy requires checking that no process is active before removing the private operation.lock directory. Never automatically break a live lock.

Public remote MCP: publish from a connected chat

Endpoint: https://api.aifra.ru/mcp. Transport: Streamable HTTP. No OAuth or AIfra API key is needed. Add it in a chat that supports custom MCP connections; no local npm installation is needed for this route. A domain mention does not connect tools by itself.

Six tools are available: get_deploy_instructions, create_preview, update_preview, delete_preview, get_operation_status and get_preview_status. Pass actual file contents (up to 1 MiB and 500 files) or archive_base64 (up to 50 MiB decoded ZIP), not a local path. Provider URL downloads are disabled.

After explicit terms acceptance, create/update/delete return a private approval_url. The user opens it and confirms within 2 hours; the agent must not confirm on their behalf. Poll get_operation_status after confirmation and return only the real viewer URL and expires_at. Pending is not published. The 48-hour preview TTL starts when publication succeeds. Updates never extend it. Management keys stay in the confirming browser and must not be shared with the agent. No renewal; expiry closes access and cleanup removes the files. Remote confirmation optionally accepts a public link name; names are never reassigned after deletion.

The local command aifra mcp-http is a separate read-only helper with instructions and status only. It is not the hosted six-tool endpoint. Prefer the public endpoint above for browser-confirmed remote publication.

SDK

The package contains aifra/sdk (ES module). PreviewApiClient accepts an explicit API origin and client metadata. The caller must obtain publication/terms consent before invoking create/update and keep returned management tokens private.

License and removal

The client package is MIT licensed; see LICENSE. Bundled dependency notices are in the npm package's THIRD_PARTY_NOTICES.txt. These integration documents/configuration are also MIT licensed. This does not cover the private service implementation or the terms governing uploads.

MCP Registry listing does not install the service in every agent or guarantee discovery. Disconnect MCP or uninstall the package to roll back locally. API/expiry continue; uninstalling does not delete remote previews or private token state.

Keywords

mcp

FAQs

Package last updated on 21 Sep 2026

Related posts