cargo-hosting Skill for Claude Code: Deploy Web Apps and Edge Workers on Cargo

Lets Claude put things online through Cargo: host a web app, deploy an edge worker that answers HTTP requests, set secrets and promote to live.

Installs: 10.3K; on skills.sh
Stars: 21; on GitHub
Files: 6; besides SKILL.md
Updated: Oct 2026; last repo commit

Claude uses cargo-ai hosting to scaffold a Vite app or a serverless edge worker, create it in the workspace, upload the source as a deployment, wait for the build, and promote the deployment so the live URL points at it. It also sets worker env vars and secrets, runs a worker locally, and covers custom domains.

SKILL.md says hosting consumes credits monthly per app or worker, so remove ones you no longer serve. It needs the Cargo CLI and a Cargo sign-in. Declaring apps as committed workspace code is cargo-project.

Good for

Teams shipping a small dashboard or UI for colleagues
Developers who need a webhook endpoint or API worker
Marketers putting a page on their own domain

Install cargo-hosting

Claude Code

Copy this prompt.

Install the cargo-hosting skill in Claude Code. Run this command:

/plugin marketplace add getcargohq/cargo-skills
/plugin install cargo@cargo-skills

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Every Cargo skill drives the cargo-ai CLI, so install it and sign in first. A new account starts with 100 free credits and no card (README). Pick one channel, not two: the plugin and skills add both register the skills, so using both duplicates them. The whole bundle is the route the README documents; this skill's own files point to files in sibling skills such as ../cargo/references/prerequisites.md. The plugin needs Claude Code 2.1.154 or newer and adds hooks and two subagents; see the safety section.

From the project README. Source.

What's in the skill

When it loads

Put something on the internet from Cargo — hosted web apps (Vite by default, other static frameworks detected) and serverless edge workers that answer HTTP requests, plus the deployments that build and promote them, the env vars and secrets a worker reads, running a worker locally, and custom domains and search indexing for public sites. Triggers: "build me a dashboard for this", "host this app", "give me a URL to share", "deploy this", "I need a webhook endpoint", "make it live", "promote to production", "ship a UI for my team", "give my worker an API token", "set a secret on the worker", "Missing CARGO_API_TOKEN", "my app cannot call my worker", "run the worker locally", "put it on my own domain", "make the site indexable by Google". Skip when: the app or worker should be declared as committed workspace code — use cargo-project.

Sections in SKILL.md

Bootstrap
The lifecycle
URLs
Apps
App builds
App env vars are public
Custom domains and search indexing
Workers
Worker env vars and secrets
Run a worker locally
Storing files from a worker
Worker logs and errors
Deployments
Critical rules
Async polling
Help

Key facts

Author: Cargo (frontmatter author: getcargo), in the vendor's own repo
License: MIT (LICENSE, README badge and plugin.json agree)
Version: 1.4.0
Installs on skills.sh: 10,340 (Nov 2, 2026)
GitHub stars: 21 (Nov 2, 2026)
Last commit: Oct 31, 2026
What installs: 7 files including SKILL.md: 5 reference and example files and skill-metadata.json
Needs: The cargo-ai CLI (npm) and a Cargo sign-in; a new account starts with 100 free credits
Cargo CLI license: UNLICENSED on npm; the skills bundle itself is MIT
Bundle size: README and plugin manifests say 19 skills, the skills.sh badge says 18, and the repo has 20 skill folders including a redirect stub
Works in: Claude Code, Codex, Cursor, Windsurf, GitHub Copilot, Hermes Agent and other skills.sh agents

What it includes

Scaffolds a local app, then creates its slot with a unique slug.
Runs code · app init / create
Scaffolds a local edge worker, then creates its slot.
Runs code · worker init / create
Uploads the package root; Cargo builds it in a sandbox.
Runs code · deployment create
Points the live URL at a finished build.
Runs code · deployment promote
Polls build status and shows what is live.
Runs code · deployment get / list / get-promoted
Sets variables and secrets a worker reads; changes need a new deploy and promote.
Runs code · Worker env vars and secrets
Runs a worker with npm run dev, with CARGO_API_TOKEN set as a secret first.
Runs code · Run a worker locally
Removes an app or worker and all its deployments.
Delete · app / worker remove
Cargo-owned hosts are noindex; a public site needs its own domain.
Runs code · Custom domains and indexing

From the official docs

Permissions

Medium risk

It uploads your code to Cargo and puts it on a live URL that bills credits monthly. Keep secrets in workers and remove what you stop using.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It uploads your source folder and builds it on Cargo
deployment create uploads the package root, and for apps Cargo runs npm ci --ignore-scripts and your build script in a sandbox. Check the folder for secrets first. github.com
Promote makes a build live
The live URL changes when you promote a deployment. Review the build before promoting. github.com
Live apps and workers bill credits monthly
SKILL.md says each resource carries a charged-until date advanced by an hourly sweep. Remove ones you no longer need; remove also deletes their deployments. github.com
Claude runs the cargo-ai CLI as you
The skill drives the cargo-ai CLI. Sign-in is saved to ~/.config/cargo-ai/credentials.json, and the docs say to confirm the workspace with cargo-ai whoami before any write. github.com
The plugin route adds hooks that run shell commands
The plugin wires a PreToolUse hook on Bash that auto-approves safe cargo-ai calls, and a SessionStart hook that runs npm install -g @cargo-ai/cli at the pinned version. Login, token creation, report creation, project deploy and any remove or delete still prompt. github.com
The plugin sends a session summary to your Cargo workspace
The SessionEnd hook passes the last 60,000 bytes of the transcript to claude -p to write a title and summary, then stores them in your Cargo workspace session record. Use the skills CLI route if you do not want that. github.com
App variables are public
App env vars are compiled into the bundle and cannot be secret. Keep credentials in a worker. github.com
The plugin also adds two subagents
cargo-execution-planner and cargo-list-builder run on the haiku model with Read, Grep, Glob and Bash tools. The planner is described as read-only and the list builder as executing only pre-approved slices. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Talks to	api.getcargo.io (Cargo API). registry.npmjs.org (CLI install). app.getcargo.io (token creation)
Sign-in and keys	Sign-in by emailed code, browser (OAuth) or an API token. Browser and email sign-in save a session to ~/.config/cargo-ai/credentials.json; API tokens are workspace-scoped and the README says to store them in a secrets manager.
Scopes	Uploads source folders and promotes deployments Creates, updates and removes apps and workers Cargo workspace sign-in (saved in ~/.config/cargo-ai/credentials.json)

Questions

What does cargo-hosting do?

It lets Claude deploy small web apps and serverless workers on Cargo, through four steps: scaffold, create, deploy and promote. A worker can answer HTTP requests, such as a webhook.

Does hosting cost credits?

SKILL.md says each app and worker is charged credits monthly, advanced by an hourly sweep, so a live one bills on an ongoing basis. It tells you to remove resources you no longer serve.

Is deploying the same as going live?

No. SKILL.md says deployment create builds and uploads, and the URL only changes when you promote that deployment.

Can I put a secret in an app?

No. SKILL.md says app env vars are public and compiled into the bundle, and secret flags are rejected for apps. Put credentials in a worker.

Can search engines find my site?

Not on a Cargo-owned host. SKILL.md says those are noindex, and a public site needs a custom domain and prerendered HTML.

How do I install it?

Use the install box above. Install the whole Cargo bundle, then the Cargo CLI and sign in. The README says to pick one channel, plugin or skills add, not both.

Is it official?

Yes. It sits in Cargo's own repo (getcargohq/cargo-skills), the LICENSE names Cargo as the copyright holder and the plugin manifest lists Cargo as the author.

Does it work in the Claude app, Codex or Cursor?

The README names Claude Code, Codex, Cursor, Windsurf, GitHub Copilot and Hermes Agent. For Claude Desktop it documents a Claude Cowork plugin route with network egress turned on. The skill drives a local CLI, so there is no plain Claude app skill upload here.

Is it safe to use?

It uploads your source to Cargo and publishes things on a live URL. A deployment builds your code in a Cargo sandbox, promote makes it live, and app variables are compiled into a public bundle. Our advice: keep secrets in workers and check what is in the folder you pass as the source.

Information

updated Nov 2, 2026

Repository: getcargohq/cargo-skills
Folder: cargo-hosting

getcargohq/cargo-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 7

cargo-skills README · github.com
cargo prerequisites.md · github.com
cargo-hosting SKILL.md · github.com
cargo-skills LICENSE · github.com
cargo-skills plugin.json · github.com
session-end.sh · github.com
session-start.sh · github.com