Private HTML hosting: the 2026 reference.

The four layers of "private"

1. Unguessable URL. The link contains enough entropy that nobody finds it by guessing. Sufficient for low-sensitivity sharing where the link can be passed in Slack or email.
2. Shared password. A second factor on top of the unguessable URL. Useful when the link might be forwarded.
3. Email-domain gate. Viewers prove they own an email at @yourco.com via a magic link before the page renders. Stronger because the gate survives forwarding.
4. End-to-end encryption. The content is encrypted in the browser; the server only sees ciphertext. The key lives in the URL fragment, which never leaves the client. Anyone with the URL can decrypt; nobody without it can.

Why agent output is the catalyst

"Reading text is now running code." Agent-emitted HTML often embeds API responses, prompt context, customer rows, internal IDs. The category of work doesn't fit a public-by-default model. It fits the same shape as a Notion page or a Linear ticket, but as renderable HTML the agent generates on demand.

The common case: sharing an artifact an agent produced

The query that brings most people here is concrete. An agent (Claude Code, Cursor, Codex, Claude.ai) just produced something you want to send to one person: a research report, a status dashboard, a code-review summary, a generated landing page, a one-off internal tool. You do not want it on a public URL that anyone can find, and you do not want to add the recipient to a company workspace or pay for an extra seat just so they can open a file.

Private HTML hosting solves exactly that gap. The agent publishes the HTML to an unguessable URL, and you send the link. The recipient opens it with no account. If the contents are more sensitive, you add a shared password or an email-domain gate so only people at @theirco.com can render the page. The artifact lives on a private link instead of a public site or a walled team tool.

What to look for in a private HTML host

• Unguessable URL on the free tier. If "private" is a paid bolt-on, the default contract is wrong.
• Programmable. An API or MCP server so agents can publish without driving a browser.
• Replace-in-place. Agents iterate; the URL has to survive revisions.
• Custom domain. So the link feels like part of your stack, not an external service.
• CSP defaults. Agent-generated HTML is executable; the host should ship a sensible Content-Security-Policy out of the box.
• Opt-out of AI training. X-Robots-Tag: noai, noimageai on every response.

Where Stacktree sits in the category

Stacktree is the MCP-native option. Other private-hosting services exist (Tiiny Host on paid plans, GitHub Pages with Enterprise Cloud, display.dev with workspace SSO), but they're shaped for human upload flows or org-wide team deploys. Stacktree is shaped for the agent loop: one tool call to publish, one to replace, three layers of gating, and a free tier that doesn't require an account for the first publish.