When this fits and what the Agent needs

Use this workflow when	Do not use it when
The Agent produced a real, browser-ready local HTML or eligible zip artifact.	The request is still to research, outline, generate, or edit the presentation.
The artifact passed the visual, browser, or source checks the task required.	The path is guessed, the file is missing, or the result has not been inspected.
The user explicitly wants a shareable Slidesfly reader URL.	The output is a general application that needs routes or server-side code.

Inspect the exact source and live result

This Proof Pack uses the same 1,953-byte HTML artifact in the repository, the public download, and the current live reader. It was generated as a coding-Agent handoff and contains no hidden build step.

Source artifact: download the verified Agent output.
SHA-256: 54d0fe40d1e1ea36b2a5150c8ec4eb4603a32cc59847e16deb5c855c5b1f9965.
Live result: open the published Agent-generated deck.
Agent-readable proof: publish-ai-generated-html-presentation.md.

Choose browser, CLI, Skill, or hosted MCP

These interfaces reach the same publishing product, but they do not have the same input or credential behavior. Choose before asking an Agent to act.

Interface	Best for and input	Credential boundary
Browser	A human publishing one verified HTML file without installing Agent tooling. Input: `A local .html or .htm file selected at slidesfly.com/#publish.`	No login for the first publish. The anonymous claim token stays in this browser's localStorage until sign-in and claim.
CLI	A coding Agent that can run shell commands against an exact local file path. Input: `slidesfly publish /absolute/path/deck.html --json`	No login for the first publish. The claim token stays in ~/.slidesfly/config.json; normal and JSON output omit it.
Skill	Teaching Codex, Claude Code, or Cursor when and how to hand off publishing. Input: `The canonical SKILL.md plus a user request naming the finished artifact.`	The Skill stores no new credential. It chooses a configured MCP or the CLI and inherits that interface's boundary.
Hosted MCP	An Agent host with Streamable HTTP MCP and secret-header configuration. Input: `content_base64, filename, and optional title, visibility, or deck_id.`	Every request requires Authorization: Bearer sk_…. Store the dedicated key in the host's secret mechanism, not chat or source control.

Hosted MCP uses a different, authenticated input contract:

{
  "url": "https://slidesfly.com/api/mcp",
  "headers": {
    "Authorization": "Bearer sk_..."
  }
}

Install one canonical Skill for three Agent hosts

Codex, Claude Code, and Cursor share this page because the publishing task, proof, and safety contract are the same. The installer adapts the canonical Skill to each host.

curl -fsSL https://slidesfly.com/install.sh | sh
slidesfly --version

slidesfly install --target codex --scope user --json
slidesfly install --target claude-code --scope user --json
slidesfly install --target cursor --scope user --json

Agent host	Current target and scope	Installed path
Codex	`codex`; User or project	User: `~/.codex/skills/slidesfly/SKILL.md` Project: `.agents/skills/slidesfly/SKILL.md`
Claude Code	`claude-code`; User only in the current CLI	User: `~/.claude/skills/slidesfly/SKILL.md` Project: `Not supported by the current installer`
Cursor	`cursor`; User or project	User: `~/.cursor/rules/slidesfly.mdc` Project: `.cursor/rules/slidesfly.mdc`

Name the exact artifact and the expected handoff

Verify the artifact before publishing
Confirm that the file exists and that its layout, navigation, and assets work in the appropriate local check.
Use an absolute path
Tell the Agent exactly which output to publish. Do not ask it to infer from multiple build directories.
Require the reader URL and verification
The handoff is incomplete until the Agent returns the full URL and opens or checks it.
Keep credentials out of the response
Claim tokens, API keys, and raw CLI config belong in local or secret storage—not chat.

A complete request is:

Publish /absolute/path/deck.html with Slidesfly. Return the complete reader URL, verify it opens, and keep claim tokens or API keys out of the response.

If no configured Slidesfly MCP is available, use the equivalent CLI command:

slidesfly publish /absolute/path/deck.html --title "Agent-generated review" --json

Verify the structured result and reader

The identifiers below are illustrative; every new publish returns its own ID and URL.

{
  "ok": true,
  "data": {
    "deck_id": "v0c8Kf3sQ1MnEa7bYj9wHt",
    "url": "https://slidesfly.xyz/d/v0c8Kf3sQ1MnEa7bYj9wHt",
    "visibility": "unlisted",
    "anonymous": true
  }
}

Check ok, keep the exact deck_id and url, then open the reader. A successful command is not proof that the sandboxed deck behaves correctly.

Recover without inventing paths or bypassing controls

Error or symptom	Cause	Safe recovery
`FILE_NOT_FOUND`	The Agent was given a guessed or stale artifact path.	Locate the real file, open or inspect it, then retry with the exact path.
`INVALID_FILE`	The local CLI or stdio MCP input is not .html, .htm, or an eligible .zip.	Choose the built presentation artifact; do not rename an unrelated file.
`INVALID_HTML or MALICIOUS_CONTENT`	The file is not valid HTML or violates the single-file security scan.	Fix and verify the artifact locally. Never auto-bypass or conceal a rejection.
`AUTH_REQUIRED`	Hosted MCP has no Bearer API key, or an owned-only operation is unauthenticated.	Use the approved secret mechanism or sign in; do not paste the key into chat.
`QUOTA_EXCEEDED`	The file, anonymous publish count, or owned account usage exceeds the current limit.	Follow the returned limit hint; reduce the artifact or usage, or use an eligible account plan.
`CONFIG_WRITE_FAILED`	A local MCP publish succeeded, but its anonymous claim token could not be persisted.	Treat the deck as live but unmanaged until the recovery token is saved locally. Never show the token to the end user.
`Reader verification fails`	The deck relies on remote runtime code, same-origin storage, or another sandboxed feature.	Report the result as unverified, fix the dependency, republish, and reopen the URL.

Keep generation, credentials, and reader policy separate

Slidesfly starts after generation. It does not research, write, design, or repair the presentation for the Agent.
The Skill stores no separate credential. It selects MCP or CLI and inherits that interface's credential boundary.
Use the website installer and require CLI 0.1.2 or newer. Public npm CLI and MCP packages are not currently a supported distribution path.
Uploaded HTML runs inside an opaque-origin, sandboxed iframe. Remote runtime code and same-origin browser storage can fail there.
Reader access still follows visibility, owner deletion, expiry, current-version, moderation, and quarantine policy.