Skip to main content
Glama

RenderPing

Website screenshots and PDFs from any URL — one REST call.

RenderPing renders any public URL with real headless Chromium and returns a signed URL to a PNG, JPEG, WebP or PDF. Full-page or custom viewport, element capture, hide-selector cleanup, cookies and headers for authenticated pages, sync or async rendering with webhooks. Ships with an MCP server so AI agents can render pages as tools.

Quickstart

# Sign up (returns your JWT + full API key, shown once)
curl -X POST https://renderping.theking.qzz.io/api/auth/signup \
  -H "Content-Type: application/json" \
  -d '{"email":"you@example.com","password":"a-long-password"}'

# First capture
curl -X POST https://renderping.theking.qzz.io/api/v1/captures \
  -H "X-API-Key: rp_live_..." -H "Content-Type: application/json" \
  -d '{"url":"https://example.com","format":"png","full_page":true}'

The response contains result_url — an HMAC-signed, expiring link to the rendered file. Free plan: 50 successful renders/month.

Related MCP server: @rendershot/mcp-server

Monorepo layout

Path

What it is

apps/server

Fastify API: auth, API keys, captures queue, quota metering, signed file delivery, Paddle + Gumroad billing rails

apps/worker

Playwright/Chromium render worker with PG-backed job queue (FOR UPDATE SKIP LOCKED, concurrency-limited) and SSRF protection

apps/mcp

MCP server (stdio) exposing render_screenshot, render_pdf, check_changes, get_usage to AI agents

apps/dashboard

Vanilla-JS SPA: keys, playground, usage meter, license redemption

apps/marketing

Landing page + deterministic pSEO generator (~250 pages + sitemap + robots)

apps/docs

Developer documentation site

packages/shared

Plans, types, SSRF guard (assertPublicUrl)

packages/design

Shared design system (tokens + components, no framework)

Notable engineering details

  • SSRF-safe rendering: every target URL is DNS-resolved and checked against private/reserved ranges (loopback, RFC1918, link-local/cloud metadata, ULA, IPv4-mapped v6) before navigation; blocked literal hosts are also aborted per-request for redirects/subresources (packages/shared/src/net.ts).

  • Byte-faithful webhook verification: Paddle signatures are verified over the raw request bytes via a scoped content-type parser — not a re-serialization of parsed JSON (scripts/verify-paddle-webhook.js proves it end-to-end).

  • Deterministic pSEO: two generator runs produce byte-identical output; the verifier enforces canonical/h1/meta/internal-link invariants per page plus sitemap completeness.

  • Verification harnesses for everything: scripts/verify-{dashboard,marketing,docs,mcp,paddle-webhook,gumroad-redeem}.js run against the live server on localhost:8080.

Self-hosting

npm install
cp .env.example .env          # fill DATABASE_URL, JWT_SECRET, FILE_SIGN_SECRET
node scripts/migrate.js       # applies migrations/*.sql
npm run build
npm start                     # or systemd units under infra/

Requirements: Node 20+, PostgreSQL 12+, Chromium (installed via npx playwright install chromium).

Billing

Paid plans are monthly memberships sold on Gumroad with instant license-key redemption (POST /api/billing/gumroad/redeem). A Paddle Merchant-of-Rail checkout path is implemented behind feature flags (PADDLE_MODE=sandbox|live) and verified by its own harness.

License

© 2026 RenderPing. All rights reserved. Public repository published for transparency; reuse of the code requires permission.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers