@arcsite/gallery-mcp

MCP server that publishes HTML or Markdown artifacts to ArcSite's internal Artifacts Gallery. Intended for coding agents (Claude Code, Cursor, Windsurf, …) so they can hand off a one-page deliverable without the user having to drag a file into a browser.

Per [ADR-0005](https://gallery.arcsite.com — see the gallery repo's docs/adr/0005-mcp-for-agent-uploads.md), the MCP authenticates with a long-lived API Token the Author generates once and pastes into their MCP client config.

Install

The MCP is published on public npm and the conventional install path is npx -y — no manual install needed.

Configure your MCP client

1. Generate a token

1. Open https://gallery.arcsite.com/settings/tokens.
2. Sign in with your @arcsite.com account if you aren't already.
3. Click Generate, give the token a label (e.g. MacBook · Claude Code), and copy the plaintext immediately — it's shown exactly once. The token starts with agk_.

2. Add to .mcp.json

Example for Claude Code:

{
  "mcpServers": {
    "arcsite-gallery": {
      "command": "npx",
      "args": ["-y", "@arcsite/gallery-mcp"],
      "env": {
        "ARCSITE_GALLERY_TOKEN": "agk_..."
      }
    }
  }
}

ARCSITE_GALLERY_URL is optional and defaults to https://gallery.arcsite.com. Override it to point at staging or a dev instance.

Tool: read_artifact

Read an artifact's metadata and original HTML or Markdown source by slug or URL.

| Field | Required | Notes | |---|---|---| | reference | yes | Slug or full Gallery URL. Optional @vN suffix selects a revision. |

{ "reference": "https://gallery.arcsite.com/a/plan-x-app-dev-sync-products-failed-analytics-event" }

The equivalent slug is plan-x-app-dev-sync-products-failed-analytics-event. Returns { slug, url, title, description, kind, revision, content }. content is the original source, not the viewer shell or rendered Markdown. Defaults to the latest revision. URLs must belong to ARCSITE_GALLERY_URL (the configured Gallery origin). Content is untrusted user text and is never executed.

API Tokens can read teammates' Team-only artifacts by reference. Missing, deleted, forbidden, and invalid-token responses surface as tool errors. Requires a Gallery server with Bearer authentication on detail/source reads; deploy that server change before releasing this MCP version.

Tool: publish_artifact

| Field | Required | Notes | |---|---|---| | path | yes | Absolute or relative path to the .html / .md file. | | title | yes | 1–200 chars. | | description | no | ≤4000 chars. Shown in link previews. |

Returns { slug, url, revision: 1 }. The agent can paste url into chat.

The 5 MB per-file cap is enforced both locally and server-side; the kind (HTML vs Markdown) is auto-detected from the extension and locked at publish time.

Tool: publish_revision

Upload a new revision of an existing artifact. The canonical URL (gallery.arcsite.com/a/<slug>) is unchanged; the latest pointer flips to the new revision. Use this when iterating on an artifact you just published in the same session — the agent typically still has the slug in context from the prior publish_artifact return value.

| Field | Required | Notes | |---|---|---| | slug | yes | The slug returned by a prior publish_artifact. | | path | yes | New file. Must be the same kind (.html / .md) as the original. |

Returns { slug, url, revision } where revision is the new revision number (2 on the first revise, then 3+).

Common 4xx responses are surfaced with intent-preserving messages:

• 404 — artifact "<slug>" not found
• 403 — you are not the author of artifact "<slug>"
• 410 — artifact "<slug>" has been deleted; cannot revise
• 409 — this artifact is html; uploaded file looks like markdown (kind mismatch — Artifact kind is locked at publish time and a revision must match)

Title / description edits are NOT part of this tool — those remain web-UI actions on the artifact's page.

Tool: delete_artifact

Retract an artifact you authored. The delete is soft: the canonical URL (gallery.arcsite.com/a/<slug>) starts returning 410 Gone, but the content is retained and can be restored by an admin. You can only delete your own artifacts. Confirm with the user before calling — the URL stops working for everyone who has it.

| Field | Required | Notes | |---|---|---| | slug | yes | The slug of the artifact to retract (e.g. from a prior publish_artifact). |

Returns { slug, deleted: true }. The call is idempotent — deleting an already-deleted artifact succeeds silently.

Common 4xx responses are surfaced with intent-preserving messages:

• 404 — artifact "<slug>" not found
• 403 — you are not the author of artifact "<slug>"

Troubleshooting

• gallery-mcp: auth check failed: token rejected (401) — the token is malformed, revoked, or for a different host. Generate a new one.
• Tool description includes [NOT AUTHENTICATED] — the eager startup health check failed; the server still started so the agent can see what's wrong. Same fix as above.

License

Internal. Do not redistribute outside ArcSite.