# Webloyt > Webloyt is free hosting for static websites built by AI models. A model connects to the Webloyt MCP server, claims a name, uploads HTML and CSS, every page is checked, and the site is live at https://.webloyt.cloud. No JavaScript, no build step, no payment. In short, a website harness for AI models and agents: tools, guardrails and hosting. This file is the full set of rules in plain text. The same content for people is at https://webloyt.cloud/guide. ## Connecting - MCP server (Streamable HTTP): https://webloyt-mcp.iroiro.cloud/mcp - Sign-in: OAuth 2.1 with a Google account, started by the MCP client. Webloyt receives only the email address. - In Claude: https://claude.ai/directory/connectors/webloyt - Agents and scripts without a browser: a personal token (see below), sent as `Authorization: Bearer wl_...`. - From the Claude API: list the server in `mcp_servers` (type `url`) with a personal token as `authorization_token`, and add an `mcp_toolset` tool for it. ## Agents and scripts: personal tokens A personal token is tied to one person's Google account and works until they revoke it. It can do everything a signed-in user can except delete a website. Token requests have lower limits: 120 publishes an hour, 600 a day, 20 website claims an hour. At most 5 tokens per account. Pairing, for an agent that has no token yet: 1. `POST https://webloyt-mcp.iroiro.cloud/pair` with JSON `{"label": ""}`. The reply has `pairing_url`, `poll_url`, `poll_secret`, `interval` and `expires_in` (15 minutes). 2. Show `pairing_url` to your user and ask them to open it. They sign in with Google and approve or deny. The link does not contain the secret, so only you can collect the token. 3. Every `interval` seconds, `POST` `{"secret": ""}` to `poll_url`. 202 means they have not decided yet; 200 carries `token` (returned once); 403 means they denied; 404 means the pairing expired. 4. Connect to the MCP server with `Authorization: Bearer `. Store the token where the user keeps secrets; never print it in a page. People can also create and revoke tokens at https://webloyt-mcp.iroiro.cloud/tokens. ## Tools - whoami: the signed-in account and its websites. - claim_website_name: reserve .webloyt.cloud. Names are 7-63 characters: lowercase letters, digits, hyphens. - list_files, read_file: see what a site contains. read_file returns a preview of large photos. - upload_file: create or replace an HTML, CSS, JSON, TXT, CSV or Markdown file (up to 5 MB). Live immediately. Markdown is served as text/markdown, not rendered; use it for files meant for agents, such as a site's own llms.txt or README.md. - patch_file: replace part of a text file. - upload_asset_base64: a small binary file (up to 256 KB). - create_upload_link: a one-time link (15 minutes) the user opens to upload photos, audio, video or fonts from their device. - delete_file, delete_website, restore_website: a deleted website stays in the trash for 14 days. - create_delete_link: a one-time link the user opens to delete a website; only for when delete_website cannot be called. Typical order: whoami, claim_website_name if needed, list_files, upload_file, then give the user the live URL. ## Allowed - HTML and CSS, including animations, grid, flexbox and media queries. - Inline SVG (no CDATA sections, no markup inside SVG style or title). - Images from the site or any direct HTTPS image address; srcset is fine, every candidate is screened. - data: images: SVG, or PNG/JPEG/GIF/WebP/AVIF up to 256 KB. - Fonts from any HTTPS address, or uploaded as WOFF/WOFF2. - Audio, video and PDFs uploaded to the site and referenced by relative path. - Links to any HTTPS page, mailto: and tel:. ## Not allowed - JavaScript of your own: inline scripts, event handlers, uploaded scripts. Only the libraries below, by ` then ``. A file without or is a fragment: no page warnings, not in the sitemap. Keep nav and footer as fragments (partials/ is a good place) from the first page of any multi-page site; edit the fragment once to change every page. - Bootstrap components (tabs, accordions, carousels, dropdowns, modals, via data-bs-* attributes): `https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js` - Code highlighting (Prism, `
`): `https://cdn.jsdelivr.net/npm/prismjs@1.29.0/prism.min.js` plus `components/prism-.min.js` or `plugins/autoloader/prism-autoloader.min.js` from the same folder.
- Maths (MathJax, TeX in \( \) and $$ $$): `https://cdn.jsdelivr.net/npm/mathjax@3.2.2/es5/tex-mml-chtml.js`

## External stylesheets

Allowed with  or @import only from:

- cdn.jsdelivr.net: /npm/bootstrap@, /npm/bootstrap-icons@, /npm/@fortawesome/fontawesome-free@, /npm/bulma@, /npm/@picocss/pico@, /npm/water.css@, /npm/normalize.css@, /npm/modern-normalize@, /npm/animate.css@
- cdnjs.cloudflare.com: /ajax/libs/
- fonts.bunny.net: any path
- fonts.googleapis.com: any path
- use.fontawesome.com: /releases/
- use.typekit.net: any path

Any other CSS can be uploaded to the site.

## Images

- An image address must be the image file itself, not a page that shows it.
- Every external image is moderated when the page is published. Unsplash, Pexels and Pixabay are pre-approved.
- Wikimedia Commons: use the original file address or Special:FilePath. A thumbnail address must use a width Wikimedia serves: 20, 40, 60, 120, 250, 330, 500, 960, 1280, 1920 or 3840.
- Up to 100 different external images per file.
- Uploaded photos are stored web-sized (up to 2000 px) with an 800 px version named -800.. Use the -800 version in cards and galleries.

## Limits

- 10 websites per account; 1 GB per website.
- Upload link: up to 10 files and 100 MB; photos 10 MB each, audio 30 MB, video 50 MB, fonts 10 MB.
- 240 publishes or edits per hour per account, 1,200 per day. A limit error says how long to wait.

## Content rules

Everything is public. Text and images are checked for sexual content, hate, harassment, violence, self-harm and illegal activity. Linked addresses are checked against a domain blocklist and Google Safe Browsing. Do not publish anything illegal, infringing, impersonating, or other people's personal information.

## Search engines

- Each page should have , , a unique  (10-65 characters), a meta description (50-160 characters), a viewport meta tag, exactly one <h1>, and alt text on images.
- upload_file and patch_file return seo_warnings; they never block publishing.
- robots.txt, sitemap.xml and a default favicon are provided for every site. A site's own robots.txt or favicon replaces them.

## The directory

https://webloyt.cloud/directory lists sites whose owners asked for it. A site is listed when its homepage has `<meta name="webloyt-directory" content="<category>">` with a category from: Education, Books, Business, Portfolio, Personal, Travel, Food, Science, Technology, Community, Other. The directory shows the homepage's title, meta description and og:image. Add the tag only when the user says they want the site listed; offer it when a site is finished. Removing the tag removes the listing.

## More

- [Guide](https://webloyt.cloud/guide): the rules for people.
- [Terms of use](https://webloyt.cloud/terms)
- [Privacy policy](https://webloyt.cloud/privacy)
- [Report a website](https://webloyt.cloud/report)
- Contact: admin@webloyt.cloud