
Product
Socket Now Protects the Firefox Extension Ecosystem
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.
quick-html-share-mcp
Advanced tools
MCP server that lets your coding agent (Claude Desktop, Cursor, Codex CLI, Claude Code, Continue) publish HTML and get back a shareable URL with viewer analytics — in one tool call. No account, link is the secret.
MCP server for quick-html-sharing — paste HTML, get an unguessable shareable URL plus viewer analytics, all from inside your coding agent.
For vibe coders sharing AI-generated HTML demos with friends, clients, or coworkers without setting up a deploy pipeline.
Add to your MCP client config — no install step beyond that, npx fetches on demand.
~/Library/Application Support/Claude/claude_desktop_config.json (macOS) — or the equivalent path on your OS:
{
"mcpServers": {
"qhs": { "command": "npx", "args": ["-y", "quick-html-share-mcp"] }
}
}
Restart Claude Desktop.
Settings → MCP → Add Server, or edit ~/.cursor/mcp.json:
{
"mcpServers": {
"qhs": { "command": "npx", "args": ["-y", "quick-html-share-mcp"] }
}
}
Same pattern — point the client at npx -y quick-html-share-mcp as a stdio MCP server.
Claude Code supports MCP too, but the companion qhs skill is a lighter-touch alternative (skill = markdown file + tiny helper, no Node process per session).
Nine tools that show up in your agent's tool list:
| Tool | What it does |
|---|---|
qhs_share | Upload an HTML document or snippet, get back a public shareable URL + private edit URL |
qhs_edit | Update HTML at an existing share (slug stays the same) — keeps the old version |
qhs_delete | Permanently take down a share (URL returns 404 after) |
qhs_stats | Views, unique viewers, traffic sources, 7-day activity, crawler fetches |
qhs_list | List your shares — this machine, plus every machine once a sync code is saved |
qhs_versions | List the stored versions of a share, newest first |
qhs_preview_version | Read an old version's source before restoring it |
qhs_restore | Republish an older version (appended as a new version, so it's undoable) |
qhs_set_sync_code | Save your sync code so version history works for shares made on your other machines |
Editing never overwrites. Each qhs_edit appends a new version and keeps the
previous one, so an agent that regenerates a page from a bad prompt is recoverable:
qhs_versions → qhs_preview_version → qhs_restore. Restoring appends too, so
the restore itself can be undone.
your agent quick-html-share-mcp hosted qhs worker
(this npm package, stdio) (Cloudflare, free tier)
│ │ │
├─ qhs_share(html) ───────▶│ │
│ ├─ POST /api/upload ──────────────▶│
│ │◀─ {slug, shareUrl, editToken} ───┤
│ │ │
│ ├─ write ~/.qhs/shares.json │
│ │ (local edit-token store) │
│ │ │
│◀─ {shareUrl, editUrl} ───┤ │
Edit tokens are persisted to ~/.qhs/shares.json so qhs_edit / qhs_delete can find them on subsequent calls without you having to remember anything. The companion Claude Code skill writes to the same file.
Across machines. Save your sync code once per machine with qhs_set_sync_code and the rest follow: qhs_list includes shares made elsewhere, and qhs_versions / qhs_preview_version / qhs_restore / qhs_delete work on them. Editing does not — that still needs the share's own edit token on this device, because a restore republishes bytes the server already holds while an edit supplies new ones. Deleting a share this machine did not create requires confirm: true, since a slug alone is otherwise enough to take a page down for good.
#edit=…), so they never reach the server's HTTP logs.Hosted by qhs · Report watermark is injected into every share for abuse handling.MIT
FAQs

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.

Research
/Security News
Three compromised Rust crates pulled in a malicious dependency that downloaded and executed cross-platform malware during Cargo builds.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.