Share AI built apps as link: why the URL is a space, not a page

The premise everyone gets wrong

The default mental model for an AI app maker share link is that it points at one screen. You typed a sentence, the agent built a thing, the share button froze that thing into a URL. Tap the URL, see the thing. End of story.

That is true for some shapes of share link. A static export, where the builder bundles your app into HTML+JS and uploads to a CDN, is one screen. An iframe wrapper, where the link points at the builder's editor with the preview pane embedded, is one screen with editor chrome around it. A "view-only" mode, where the platform serves a read-only snapshot of your project, is one screen.

mk0r picks a different shape. The link is a wildcard subdomain that rewrites to a live development VM, and the rewrite preserves everything past the hostname. The result is not a page. It is a URL space, the way any normal website on the internet is a URL space. The recipient can navigate it, deep-link into it, hit endpoints inside it, drive it with query parameters. The same things they can do on any real site, on the link your AI just produced.

The 47-line file that decides this

The whole behavior lives in one Next.js middleware file at src/proxy.ts. It is 47 lines including imports and the export config. The interesting work is inside the proxy() function, which is exactly eleven lines. Below is the full body of that function, as it ships.

// VM IDs are 15-30 char lowercase alphanumeric strings.
const VM_ID_RE = /^[a-z0-9]{15,30}$/;

const KNOWN_APEX = ["mk0r.com", "staging.mk0r.com"];

export function proxy(request: NextRequest) {
  const vmId = extractVmId(request.headers.get("host") ?? "");
  if (!vmId) return NextResponse.next();

  const target = new URL(request.url);
  target.port = "";
  target.protocol = "https:";
  target.hostname = `3000-${vmId}.e2b.app`;

  return NextResponse.rewrite(target);
}

The line that does the heavy lifting is target.hostname = `3000-$${vmId}.e2b.app`. The line above it sets the port to empty. The line below it returns the rewrite. That is the whole transformation. Pathname stays, search stays, the HTTP method stays, the body stays. The only field that changes is the host the request is forwarded to.

The matcher at the bottom of the file is "/:path*", which means every path under the wildcard subdomain enters this function. There is no allowlist of routes. Every URL on <vmId>.mk0r.com is in the URL space.

What happens when your friend opens a deep link

The interesting case is not the home page. It is what happens when your friend pastes /admin/users/42?tab=billing after the hostname. The diagram below traces the request, end to end, on a path the AI invented.

Notice what does not happen. No auth check. No allowlist of paths. No rewrite of the path or query. The middleware does not even know what routes the AI built; it does not need to. Whatever your friend types after the slash gets handed to the Vite dev server inside the sandbox, which renders whichever route the AI made.

The three URL parts and what each one is doing

A useful exercise: take the URL apart. Each piece has a job, and only the first one is fixed by the platform. The rest belongs to whatever the AI built.

What the proxy preserves, and what it does not

The list below is taken straight from the source. Every yes is a thing your friend can do on the link. Every no is a thing the recipient does not get.

The first list is what makes the link a URL space. The second list is what makes the recipient experience feel like a normal website instead of a builder dashboard. Both lists are deliberate, and both are visible in the same 47 lines.

Sharing a single page versus sharing a URL space

The two screenshots below describe the experience. Same prompt to the same friend. Different shape of share link on each side.

A small story that makes this concrete

Earlier this week I built a tiny recipe browser as a test. I asked the agent for a home page that lists recipes, a /recipe/[id] route for the detail view, and an /api/recipes endpoint that returns the JSON. The agent finished in about ninety seconds. I copied the share link from the URL bar in the preview pane.

A friend opened the link, then asked me a question I had not considered: "can I share a specific recipe with someone?" I said yes, just paste the link plus /recipe/3. They tried it. It worked. They sent it to a third person. That person also opened the link, also navigated to /recipe/3 directly, never saw the home page.

A different friend, more technical, opened a terminal and ran curl <link>/api/recipes. They got JSON back. They asked if I had set up CORS. I had not. The AI had defaulted to permissive headers, so the third person could in principle have called my AI-built API from a totally different web page. None of this was anything I had explicitly designed. It was downstream of one fact: the proxy preserves path, query, and method.

That is the kind of behavior that does not show up in a marketing page about "share your AI app." You only notice it once the recipient pokes at the link in ways the original tutorial did not mention.

What this costs you, honestly

Sharing a URL space is not free of trade-offs, and pretending it is would be dishonest.

The recipient is hitting your live dev server. If you push a broken change, the link goes broken too, on whatever device your friend has it open on. There is no "production version" that lags behind. The artifact is the development instance.

The link has no auth. Anyone who has the URL can reach every route and every API endpoint the AI built. The privacy boundary is the unguessability of the vmId, which is fine for sharing with friends and bad for anything that touches private data. If you need real auth, tell the agent to add it inside the app, or move the project through the publish flow at src/app/api/publish/route.ts, which maps a custom domain in front of the VM.

Cold starts exist. After roughly ten minutes of inactivity, the VM pauses. The next click on the link wakes it back up, which adds latency on the first request. Not a deal-breaker, just an expectation to set with whoever you share with.

Frequently asked questions