Self-host the artifact server, or send the client a link today.

What is actually in the open-source cluster

Three projects, all young, all doing a version of the same thing. Figures below were read from the repositories on 19 September 2026 and will have moved since.

• plannotator/artifact-server, AGPL-3.0, by backnotprop. 165 stars, 12 forks, 16 open issues, created 24 August 2026, last pushed 14 September. The most complete of the three: artifacts organised by project, immutable versions with stable and exact links, team comments attached to a specific version, and a built-in MCP server reached through artifactserver connect. It documents deploy targets for Cloudflare with D1 and R2, Docker Compose on SQLite or Postgres, Kubernetes with Helm, AWS on ECS, RDS and S3, Google Cloud on Cloud Run, Cloud SQL and Cloud Storage, a single server, and local. Remote deployments want one trusted application origin and one isolated wildcard content domain, which is the detail that decides how long your first afternoon takes.
• coda0HQ/open-artifacts, MIT. 54 stars, 7 forks, 14 open issues, created 3 July 2026, last pushed 11 September. Cloudflare Workers with D1 for metadata and R2 for bodies. No accounts anywhere: artifact ids are twelve crypto-random characters, creation returns a one-time write token whose SHA-256 is all the server keeps, and channel tokens let an agent update the same URL later. Optional passwords are done properly in the browser with PBKDF2-HMAC-SHA256 at 600,000 iterations and AES-256-GCM, so the password never reaches the server. Content is served under a sandbox Content-Security-Policy. Maximum 4 MiB per artifact, and no custom domains.
• emaxe/open-artifacts, MIT, by a single author. 0 stars and 0 forks, created 10 September 2026, last pushed 18 September, so it is days old at the time of writing. Docker Compose with Postgres and MinIO. An MCP server over Streamable HTTP, an OAuth device flow for interactive login and organisation API tokens for everything else. It renders HTML, GitHub-flavoured Markdown, Mermaid and SVG. Share links come in three modes, team-only, password-protected and public, with optional expiry at one hour, one day, seven days or thirty days, and an administrator can disable public links entirely.

When self-hosting is the right call

Four situations where you should close this page and go and clone a repository.

• The content cannot leave your perimeter. If a client contract, a regulator or your own security review says agent output stays in infrastructure you control, that settles it. No hosted product wins that argument, including ours.
• You want to read and change the code. All three are readable in an afternoon. If the behaviour you need is one pull request away, that is a genuinely better position than filing a feature request with a vendor.
• You already run the platform. If Cloudflare Workers or a Kubernetes cluster is somewhere you deploy things weekly, the marginal cost of one more service is small.
• Volume is high and gates are not needed. Thousands of internal artifacts, no client-facing gate, no analytics. A Worker and a bucket will do that for close to nothing.

What it costs in time, honestly

Not much on day one. More than people expect after that.

• First deploy. Half an hour if you know the platform. artifact-server asks for Node 24.12 or newer and a specific pnpm version, and a remote deployment needs two domains, one trusted and one isolated wildcard for untrusted content, plus certificates for both. coda0HQ is the lightest: create a D1 database, create an R2 bucket, deploy.
• Keeping it current. All three are pushing changes weekly. Somebody pulls, redeploys, and reads the migration notes. artifact-server had 16 open issues and coda0HQ 14 on the day we looked, which is normal for projects this young and is also work that lands on you.
• Being the support desk. A client who cannot open a page emails you, not a vendor. That is the real recurring cost, and it arrives at the least convenient hour.
• The things you will end up building. Email gates, viewer numbers, a portal per client, a domain per client with TLS. Each one is a week you did not plan for.

What you give up

Being specific rather than sweeping, because the gap is in a few named places rather than everywhere.

• Email-domain gates. None of the three restricts a page to verified addresses on a client’s domain. They offer shared passwords, team-only links and expiry. Stacktree adds magic-link verification against one domain from Solo, with no account for the reader.
• Viewer numbers. emaxe hashes viewer IPs for basic counts. The other two document none. Stacktree shows opens, unique viewers and when a page was last opened from Solo, and on Studio aggregate time on page, scroll depth and an attention heatmap. All aggregate, no session replay.
• The client layer. A client space is one address per client on your own domain, a generated portal at the root listing every deliverable, and one gate inherited by every page filed under it. That is the part agencies actually buy, and no repository in the cluster has it.
• Connectors where people already are. A Claude.ai connector, a Slack app, an anonymous HTTP publish that needs no key, and MCP over OAuth for Claude Code, Codex, Cursor, OpenCode and Amp from one npx stacktree-install.
• The page answering for itself. Ask this page answers a reader’s question from that page only, cites the passage and lights it up, and hands you the questions it could not answer. Every page is also readable as Markdown at its own address, behind the same gate.
• Somebody to email. Not an SLA, and not a support queue. One person who wrote the thing and replies.

There is a middle option

If the appeal of the open-source cluster is the perimeter rather than the price, Stacktree sells the code. Stacktree Self-Hosted is the full source, landing site, dashboard, MCP server and installer, deployed onto your own Cloudflare account, with your R2 buckets, your D1 database and your Worker. It is source-available rather than OSI open source: read it, audit it, modify it for your own use, but do not resell it. Founder pricing is $999 one-time against $1,999 at launch, and it is sold as a founder cohort with a full refund if the cohort does not fill, so ask before you plan around it.

Who should pick which

Pick an open-source artifact server if the content has to stay on your own infrastructure, if you want to change the code, or if the job is internal artifacts at volume with no gate and no reporting. AGPL on artifact-server, MIT on the other two.

Pick Stacktree if the reader is a paying client rather than a colleague. The work needs a gate that survives publication, an address on your domain, a portal that collects everything you have sent that client, and numbers telling you it was read. You can test all of that on three free pages before anyone runs a deploy command.