# Taslak

> Taslak is a home for what agents make: publish a file, a folder or a static site and get a permanent URL.

## Key facts
- The first publish needs no account: `curl -F "files=@index.html" https://api.taslak.dev/v1/publish`. Anonymous spaces serve for 33 hours 20 minutes after the latest publish unless claimed.
- Each publish is an immutable version with its own URL (`v<n>--<slug>.taslak.page`); sites live at `<slug>.taslak.page`, apart from taslak.dev; promoting an earlier version rolls back.
- Sites are public, password-protected or private (share links and previews). Custom domains via CNAME or nameserver delegation, with automatic certificates, DNS diagnostics and wildcards on Plus; domains belong to the team and move between its sites.
- Static sites only for now: publish build output. `_redirects` and `_headers` follow Netlify's format.
- Sign-in is an emailed code, a password or GitHub, with optional two-step sign-in (authenticator app, e-mailed code or backup code; a browser can be trusted for 30 days); any of up to 10 verified e-mail addresses signs in to an account; passwords found in Have I Been Pwned's leaked-password list are refused. No SSO, no Google sign-in.
- Agent access: CLI logins, OAuth apps, handoff links (one site, one use within 15 minutes) and API keys hold permissions (`spaces:read`, `publish:write`, `domains:write`…, or the `read` and `agent` profiles; key presets `ci_deploy`, `domain_manager`, `billing_viewer`, `team_admin`) and reach all, chosen or no teams, never beyond the user's role. Inviting, member and role changes, approving apps and deciding approvals are for a person in the browser (`person_only`). Team API keys act through the person who made them. Connected apps lists every grant with its activity; "Stop all agent access" revokes them at once.
- Notifications (approvals, access requests, comments, database rows, site transfers, teams joined) land in an inbox kept 180 days, whatever the e-mail settings: https://taslak.dev/inbox, `taslak inbox`, `GET /v1/notifications`.
- Teams have unique slugs, owner/admin/editor roles, invitations valid 7 days, labels, subteams that limit a site to some editors, auto-enroll by e-mail domain, and deleted teams restorable for 30 days. Sites move to another team by transfer request (accepted within 7 days).
- Comments: off, previews (share links, previews, passwords, invited people) or everywhere (public visitors too), with spam filter, bot check, reactions, e-mail notifications and `comment.*` webhooks. Export open threads as Markdown or JSON for an agent; visual reviews open a one-hour link to one version.
- Webhooks: 54 team events (versions, live changes, sites, builds, domains incl. `domain.verification_failed`, database rows, comments, members, build variables, webhooks, API keys, partner tenants) with group wildcards such as `build.*` or `*`, HMAC-SHA256 signed (`X-Taslak-Signature`, two `v1=` for 24 hours after a secret rotation), retried for a day; `failing` after 8 failures in a row, disabled after 32; delivery payload and answer, redeliver with the same event id.
- Analytics tags per site or team: 13 templates (GA4, GTM, Meta, TikTok, LinkedIn, X, Pinterest, Hotjar, Clarity, Plausible, Umami, Fathom, custom HTML), revisions with review (owners and admins approve and release to production), production and preview releases with rollback, a consent policy (opt-in or opt-out, everywhere or only EEA/UK/CH) with a Turkish/English banner and `window.taslak.consent`, and preview sessions on the live site.
- Request logs per site: 90 days (default the last 7) with method, status, user agent and bot/AI class, filtered by time, method and errors, paged with a cursor; `taslak logs --follow` streams new requests.
- Partners: platforms that host sites for their own customers. A Taslak operator enables a team as a partner (help@taslak.dev); it creates customer tenants (teams of their own, by `external_id`, plan up to the partner's, suspendable), registers ES256/EdDSA/RS256 public keys and trades customer JWTs it signs at `POST /v1/partner-tokens` for `tt_` tenant tokens (at most an hour, one tenant only), or mints them. Partner webhooks get tenant events with the tenant's `team_id`. Partner API: https://api.taslak.dev/openapi.partner.yaml. Plan codes from Taslak put a free team on Go or Plus for some days.
- Plans per team: Free (20 spaces, 500 MB of live sites, 1 member, personal use), Go $5/month (unlimited spaces and domains, 10 GB), Plus $15/month (50 GB, 10 members, wildcard domains). Billing at https://taslak.dev/team.

## Docs
Every page is Markdown at the address below; the panel shows the same pages at https://taslak.dev/docs. All of them in one file: https://taslak.dev/llms-full.txt
- Agent setup and getting started: https://taslak.dev/setup.md
- Publishing and versions: https://taslak.dev/docs/publishing.md
- Access and sharing: https://taslak.dev/docs/access.md
- Custom domains: https://taslak.dev/docs/domains.md
- Redirects, headers and caching: https://taslak.dev/docs/routing.md
- Appearance and pages: https://taslak.dev/docs/customization.md
- Builds and git: https://taslak.dev/docs/builds.md
- Framework recipes: https://taslak.dev/docs/frameworks.md
- Database: https://taslak.dev/docs/database.md
- File storage: https://taslak.dev/docs/storage.md
- Content editor (taslak.content.json, letting clients edit posts): https://taslak.dev/docs/content.md
- Comments: https://taslak.dev/docs/comments.md
- Teams, plans and usage: https://taslak.dev/docs/teams.md
- Analytics and logs: https://taslak.dev/docs/analytics.md
- Analytics tags and consent: https://taslak.dev/docs/tags.md
- Troubleshooting: https://taslak.dev/docs/troubleshooting.md
- Agents and MCP (setup per client, cloud sandboxes, tool reference): https://taslak.dev/docs/agents.md
- API guide (authentication, account, e-mail addresses, inbox, keys, idempotency, pagination, rate limits): https://taslak.dev/docs/api.md
- Webhooks and signature verification: https://taslak.dev/docs/webhooks.md
- Partners (customer tenants, tenant tokens, customer JWTs, plan codes): https://taslak.dev/docs/partners.md
- CLI reference: https://taslak.dev/docs/cli.md
- taslak.jsonc reference: https://taslak.dev/docs/config.md
- Limits: https://taslak.dev/docs/limits.md
- Error codes: https://taslak.dev/docs/errors.md

## Tools
- API reference: https://api.taslak.dev/docs
- OpenAPI: https://api.taslak.dev/openapi.yaml (partner operations alone: https://api.taslak.dev/openapi.partner.yaml)
- CLI: `npx -y https://taslak.dev/cli/taslak.tgz <command>` (`publish`, `login`, `status`, `link`, `open`, `spaces`, `versions`, `promote`, `channels`, `builds`, `access`, `share`, `comments`, `collaboration`, `review`, `domains`, `analytics`, `logs`, `tags`, `teams`, `transfers`, `labels`, `webhooks`, `db`, `storage`, `content`, `account`, `inbox`, `keys`, `grants`, `handoff`, `profiles`, `partner`, `plan-code`, `api`, `docs`, `doctor`, `completion`, `mcp`, `mcp proxy`, `setup`, `skills`; `teams switch` sets the current team; see the CLI reference)
- Hosted MCP: https://api.taslak.dev/mcp (Streamable HTTP; MCP OAuth sign-in or `Authorization: Bearer tk_…`)
- Local MCP: `npx -y https://taslak.dev/cli/taslak.tgz mcp` (stdio); `mcp proxy` serves the hosted tools on stdio with the CLI's sign-in
- Agent setup: `npx -y https://taslak.dev/cli/taslak.tgz setup <client> [--hosted]` writes the agent guide and the MCP server for claude, cursor, codex, vscode, copilot, gemini, zed, devin (Windsurf), opencode, amp, warp, droid, cline, continue, openclaw, raycast or agents (AGENTS.md); `skills status` / `skills remove` show and undo it. Guides for these and Devin cloud, Poke, ChatGPT and claude.ai, plus cloud-sandbox network allowlists: https://taslak.dev/docs/agents.md
- Without Node: publish a folder with `sh`, `tar` and `curl` (script in https://taslak.dev/setup.md, "Without Node: curl")
- Both MCP servers reach every API operation: `search_api`, `describe_api`, `call_api` (with `async` and user `approval`, then `resume_execution`), `operation_status`, `show_space` (deployments, files, compare, source, builds and logs, analytics, comments) and `search_docs` / `read_doc`. Content entries (`taslak.content.json`) have their own tools: `content_collections`, `content_list`, `content_get`, `content_create`, `content_update`, `content_delete`, `content_translate`, `content_history`, `content_restore`, `content_items`, `content_item_get`, `content_item_create`, `content_item_update`, `content_item_delete`, `content_items_reorder`, `content_document_get`, `content_document_update`, `content_reviews`, `content_review_get`, `content_review_approve`, `content_review_reject`, `content_review_withdraw`.
- Docs API: `GET https://api.taslak.dev/v1/docs`, `/v1/docs/search?q=…`, `/v1/docs/{slug}` (no token).

## Discovery
- MCP server card: https://api.taslak.dev/.well-known/mcp/server-card.json
- A2A agent card: https://api.taslak.dev/.well-known/agent-card.json
- API catalog (RFC 9727): https://api.taslak.dev/.well-known/api-catalog
- Agent skills index: https://api.taslak.dev/.well-known/agent-skills/index.json (the `taslak` skill: https://api.taslak.dev/.well-known/agent-skills/taslak/SKILL.md)
- OAuth: https://api.taslak.dev/.well-known/oauth-authorization-server and https://api.taslak.dev/.well-known/oauth-protected-resource/mcp