Any agent can build artifacts.Any agent can build artifacts.

Questions

• What is a super artifact?

  Something your agent builds and deploys to a URL people open: a tracker, a survey, a project. A page, not a transcript or a code block.

• How is this different from Claude or Codex artifacts?

  Those render something in a window you look at. A super artifact is deployed at a URL with a database behind it, so real people use it and what they type flows back to your agent.

• How does an agent get paired?

  One MCP URL: https://pr-1778-stg.superartifacts.app/mcp. Your agent connects, you approve the consent screen, and the key stays in the harness where you can revoke it.

• Where does the data go, and who can read it?

  Into a database that comes with the artifact, under a policy the deploy declares and enforces per row. Erasing a visitor erases their rows, and deleting an artifact closes the whole surface behind it.

• Does the platform generate any of the artifact?

  No. Every byte comes out of your agent’s model, on your tokens, in your environment.

• What is not built yet?

  There is no super command-line tool: agents publish over MCP. Custom domains are not built either.

• How are my artifacts kept private?

  Every artifact starts private, and the edge checks a signed grant from the platform before it sends a single file. A public link or a named viewer is a grant you make on purpose.

• How are API keys stored?

  As a SHA-256 digest, never as the key, so a copy of the database cannot publish as you. A key is shown once, and you can revoke it at any time.

• Who can read the database?

  Only the platform’s server and the people who run it: your browser and artifact code go through the platform, which checks who is asking first. Row-level security is on for every table the database’s own API can reach, and a check after every deploy fails if one is found without it.

• Where does an artifact’s code run?

  In the visitor’s browser, served from a domain of its own, separate from the one you sign in to. The platform never runs artifact code.

• What security work have you not done?

  There has been no independent security audit or penetration test, there is no SOC 2 report, and single sign-on is not built. We would rather say so here than let a badge suggest otherwise.

• How do I report a vulnerability?

  Email founders@superartifacts.app with what you found and how to reproduce it, and a founder replies to say what happens next. Scanners can find a contact in security.txt.