Loading repository data…
markpasternak / repository
Self-hostable, open-source platform to deploy & share small static web apps ("canvases") inside your org — paste/drag/PUT a folder, get an instant secure URL. Five zero-config backend primitives (KV, files, AI, identity, realtime), an MCP server for AI agents, no telemetry.
A transparent discovery signal based on current public GitHub metadata.
This score does not audit code, security, maintainers, documentation quality, or suitability. Verify the repository and its current documentation before adoption.
Your org's place to ship the small web tools you build with AI. Drop a folder, get a secure URL, behind your own SSO, on infrastructure you control.
AI builds a working dashboard, form, or internal tool in minutes. Then it stalls, because there is nowhere safe and instant to put it: emailing a zip, or spinning up a project on someone else's cloud outside your org boundary, or waiting on a platform team. canvas-drop closes that last mile. It is the creation-and-sharing layer for AI-built tools, prototypes, dashboards, demos, and lightweight internal apps. Self-hosted inside your trust boundary, MIT-licensed, with no telemetry and no phone-home.
It is inspired by Quick, Shopify's internal "drop a folder, get a URL" platform that shifted their culture to demos over memos. Quick lives inside Shopify and there was no open way to run the same idea on your own infrastructure with a real backend, so I built canvas-drop and took it further.
Full documentation lives at canvas-drop.com/docs.
<script> tag, no provisioning, no secrets in the browser. Stay fully static when you do not.Selected from shared topics, language and repository description—not editorial ratings.
QuintinBotes /
Open-source, AI-native QA platform — reads a PR diff, selects tests, runs an AI agent to break the build, and posts a merge-gate verdict. Claude-first, self-hostable, MIT.
62/100 health{base}/llms.txt.Quick is files plus a tiny API behind an identity proxy. canvas-drop keeps that simplicity and adds the rich API, the versioned storage model, the five primitives, and the sharing ladder, so the same "drop a folder" gesture also covers the parts an org actually needs.
Requires Node 24 and pnpm. Clone to a running instance in well under five minutes:
git clone https://github.com/markpasternak/canvas-drop.git
cd canvas-drop
pnpm install
cp .env.example .env # defaults: path mode, SQLite, local storage, dev auth
pnpm dev # server + dashboard in watch mode (Ctrl-C stops both)
| URL | What |
|---|---|
| http://localhost:5173 | The dashboard (Vite HMR). Develop here; it proxies /api, /auth, and /v1 to the server. |
| http://localhost:3000 | The Hono server: API, deploy endpoints, and hosted canvases. |
dev auth auto-logs-in a fake local user, so there is zero setup. curl http://localhost:3000/healthz confirms the server is alive. Port already in use? CANVAS_DROP_PORT=3001 pnpm dev.
Every publish produces the same thing: an immutable version served at an unguessable URL. The first three are in the dashboard; the fourth is for scripts and agents.
index.html and its assets.PUT a ZIP with the canvas's secret key. deploy = live, no draft loop.curl -X PUT "$BASE_URL/v1/canvases/$CANVAS_ID/deploy" \
-H "Authorization: Bearer $CANVAS_KEY" \
--data-binary @site.zip
The key operates only on its own canvas and never belongs in canvas files. GET /v1/canvases/:id, GET …/versions, GET …/files (read back the live version to verify), POST …/rollback, and POST …/unpublish round out the surface. For large or frequently re-deployed canvases there is a staged upload (begin then per-blob PUT then finalize): a content-addressed manifest sends only changed files, and bytes go straight to the server instead of through an agent's context. See canvas-drop.com/docs.
You can also clone any active canvas you own, or a gallery-listed template, as an unpublished draft with a fresh slug and key.
Add one tag, no build step, no keys, no config:
<script src="/sdk/v1.js"></script>
The global canvasdrop appears. Identity rides the signed-in session; the canvas is identified from its own URL. Every method throws a typed, instanceof-catchable error.
const me = await canvasdrop.me(); // { id, email, name, avatarUrl, kind }
const votes = await canvasdrop.kv.increment("votes", 1);
await canvasdrop.kv.user.set("theme", "dark"); // per-viewer scope
const f = await canvasdrop.files.upload(input.files[0]); // { id, name, size, url }
for await (const delta of canvasdrop.ai.stream(messages, { model })) out.textContent += delta;
const ch = canvasdrop.realtime.channel("room"); ch.subscribe(render); ch.publish("cursor", { x, y });
| Primitive | What it gives a canvas |
|---|---|
| KV | Shared (kv.*) and per-viewer (kv.user.*) key/value with list and atomic increment. |
| Files | Per-canvas upload/list/delete; served as safe, non-executable bytes. |
| AI | Anthropic-first proxy behind a provider abstraction: streaming, model allowlist, metered quotas. The provider key stays server-side. |
| Identity | me(): id, email, name, avatar, and kind (member or guest), resolved from org auth, never the client. |
| Realtime | Ephemeral broadcast plus presence per canvas. Revoking a share drops the socket instantly. |
The full, agent-optimized contract is served live at {base}/llms.txt. See also docs/sdk.md.
canvas-drop treats agents as first-class authors. Three ways in, all thin clients of the same service layer:
PUTs files straight to a live version (above).docs/site/agents/skill.md) with the full SDK contract, so any coding agent builds canvases out of the box.docs/site/agents/mcp.md): a connect-once remote server at {base}/mcp, signing in through your org's own login (OAuth 2.1). It exposes identity-scoped tools at full dashboard parity, so anything a person can do in the UI (deploy, version, roll back, share, edit the draft, set the preview cover, clone, read usage) an agent can do over MCP. On by default; disable with CANVAS_DROP_MCP=off.Everything is set by environment variables, validated at boot, with a precise message on an invalid combination. Full surface in .env.example. Swappable drivers:
| Concern | Options | Env |
|---|---|---|
| Database | SQLite, Postgres | CANVAS_DROP_DB |
| Storage | local disk, S3-compatible (AWS S3, MinIO, Cloudflare R2) | CANVAS_DROP_STORAGE |
| URL mode | path, subdomain | CANVAS_DROP_URL_MODE |
| Auth | proxy (recommended prod), oidc, dev | CANVAS_DROP_AUTH_MODE |
| Email (invite notifications) | log, smtp, mailgun, noop | CANVAS_DROP_EMAIL_DRIVER |
| Tenancy (org boundary, off by default) | name an org so guests can't see whole-org canvases | CANVAS_DROP_ORG_NAME |
The blessed production profile is subdomain mode plus an identity-aware proxy (e.g. Cloudflare Access) verifying a signed JWT, with Postgres and S3.
Tenancy (optional). Set CANVAS_DROP_ORG_NAME to draw a member-vs-guest boundary: members (by verified email domain) can share to the whole org, while brought-in guests only see canvases they're invited to. It's inert until named — deploy first, migrate later. Migrating an existing instance is a dry-run-first cutover; see docs/tenancy.md.
Day-to-day operation lives in the in-app admin panel: the all-canvases list with usage, disable/takedown/restore, the AI model allowlist, and global quota defaults. Operator-tunable settings are editable there or via env; the auth and rate-limit hot path stays read-only.
Requires Docker and Docker Compose v2. The repo ships a one-command demo stack that runs canvas-drop in its real proxy mode behind an identity-aware proxy (oauth2-proxy) and a bundled demo IdP (Dex), so you can try the production shape with zero external setup:
docker compose up --build # first build takes a few minutes; add -d for background
# then open http://localhost:8080 and log in as demo@example.com / canvasdrop
docker compose down -v # tear down and wipe data
The app verifies a Dex-signed JWT against Dex's JWKS, the same cryptographic trust path you run in production, with Postgres for data and an optional MinIO profile for S3. The app is never exposed directly; only the proxy is.
The demo stack is for local evaluation only. Its secrets and the
demo@example.comlogin are public placeholders, and it runs on plain HTTP in path mode. Rotate every secret and follow the graduation checklist before any real use.
Going to production is a configuration change: copy [`.env.