anubhavmalhotra.com

Source for anubhavmalhotra.com: a one-page, README-style personal site that also speaks MCP. Hosted on Vercel.

Layout

• public/ is the site: index.html (no JavaScript, no webfonts), plus machine-readable twins README.md, llms.txt and profile.json.

• api/mcp.js is a Vercel function served at /mcp (see vercel.json): a stateless, read-only MCP server over Streamable HTTP, built on the official SDK and answering from public/profile.json and public/README.md.

• lib/mcp-server.js holds the tools and resources. dev/server.mjs runs the same function locally.

• test/mcp-smoke.mjs connects with the official MCP client and exercises every tool, resource and static file.

Edit public/index.html, public/README.md and public/profile.json together when facts change.

Related MCP server: GitLab MCP Server

The download gate

A password-protected page at a secret path describes a package and lets it be downloaded at most five times. Nothing about it is in public/: the path, the password hash and the storage token live only in the project's environment variables (GATE_PATH, GATE_PASSWORD_HASH, BLOB_READ_WRITE_TOKEN), and api/gate.js answers /<path> and /<path>/download through the catch-all rewrites in vercel.json.

A correct password sets a signed cookie (12 hours, keyed by the password hash, so changing the password ends all sessions). With the cookie, /<path> shows the description page with a Download button, and /<path>/download records one download and streams the file. The page text, the file and the download count live in a private Vercel Blob store; the count is updated with an ETag-conditional write, so the limit holds under concurrent requests. Each click on Download counts, whether or not the transfer finishes.

The description page is an HTML fragment kept out of this public repository. Keep the source in private/ (ignored by git) and upload it; a <!-- download --> marker in it places the download block, otherwise the block is appended.

npx vercel env pull .env.local                  # once, for the scripts below
npm run gate:page -- private/zeus.html          # upload the description page
npm run gate:page:pull                          # fetch the current page back into private/
npm run gate:upload -- ~/Downloads/thing.pkg    # put a file behind the gate; resets the count
npm run gate:status                             # what is uploaded, downloads used
npm run gate:reset                              # five more downloads for the same file
npm run gate:password -- 'new password'         # prints the hash to store in GATE_PASSWORD_HASH

To change the password, store the printed hash with npx vercel env add GATE_PASSWORD_HASH production (and preview, development), then redeploy. npm run test:gate exercises the whole flow with a throwaway fixture; it refuses to run while a real file is uploaded and leaves the page alone.

Run

npm install
npm run dev          # http://localhost:8787 and http://localhost:8787/mcp
npm test             # against the dev server; SITE_URL=https://anubhavmalhotra.com npm test after deploying

Deploy

npx vercel login
npx vercel --prod    # first run creates the Vercel project and deploys
npx vercel domains add anubhavmalhotra.com
npx vercel domains add www.anubhavmalhotra.com

The domain already uses Vercel's nameservers, so it goes live as soon as it is attached to the project.

For automatic deploys on every push, import this repository at https://vercel.com/new instead of deploying from the CLI, then add the domains in the project's settings.