what a tool needs
A tool is a small web page that does one thing. Twist hosts the files and gives it a page.
the folder
- An index.html at the top, with everything it loads next to it.
- If your project has a build step, like Vite or React, run the build and upload the dist folder it makes.
- Relative paths: ./app.js, not /app.js. In Vite, set base: './'.
- Everything runs in the browser. There's no server for your code.
twist.json
Optional, next to index.html. Without it, a new tool takes its name from the page title.
- name: up to 40 characters.
- description: the one line tagline under the name and on every card, up to 80 characters.
- network: other sites the tool loads from or calls. See below.
- permissions, only if the tool uses them: camera, microphone, midi, clipboard-read, screen-capture, autoplay. Copying, downloads, full screen and dialogs work without asking.
- A README.md next to it becomes the tool's about: a short paragraph on what it is, then numbered steps.
other sites
- A tool can only reach the sites listed under network, up to 20. Everything else is blocked.
- Plain hosts like api.example.com, over https. *.example.com covers its subdomains but not example.com itself.
- Only APIs that work without a secret key. Twist doesn't hold API keys, and tools can't ask visitors for theirs.
saving data
Each tool has its own address, so it can use localStorage and IndexedDB like any site. What it saves stays in each person's browser, separate from other tools, and carries over to new versions.
limits
- 500 files, 25 MB in total, 10 MB per file.
- 500 MB per account, across all your tools and their media. Every kept version counts, so a 20 MB tool with ten versions uses 200 MB.
- A tool keeps the files of its newest 10 versions. Older ones stay in its history without their files, and can't be restored.
- Up to 8 images or videos on a tool's page: images up to 8 MB, MP4 or WebM videos up to 40 MB and 60 seconds. The first one is the cover.
what stops a publish
- No index.html at the top.
- An API key in the code.
- Apps or installers.
- A twist.json that isn't valid, or lists more than 20 sites.
- Going over the limits above.
the safety check
Before anyone else sees a version (when a tool goes public, and each new version of a public tool), an automatic check looks at its screenshot, text and code for phishing, scams, wallet drainers and anything that collects passwords, keys or card details. It takes a minute or so. Visitors keep the previous version until the new one passes. Private versions aren't checked, since nobody else can see them.
- Most tools pass without anyone noticing.
- If it's unclear, the version waits for a quick look from Twist, and you get an email with the decision.
- If it's clearly harmful, the version is blocked and the account's tools go private.
- A password field, or a form that sends what people type to another site, always gets the check.
after it's up
- It starts private. To make it public, open it, click edit, add a one line tagline and pick public. Or ask your agent.
- Each new version gets a fresh screenshot as its cover, until you add your own image.
- To update it, ask your agent to publish it again from the same folder, or open it, click edit, and drop the new folder under versions. Dropping a folder on the publish page makes a new tool.
- A new version that passes its checks goes to everyone right away. You can restore an older one from the editor.
- Its link, twist.tools/you/tool, comes from its first name and stays the same if you rename it.
- To delete it, open it, click edit, then delete this tool at the bottom. Its files go too, and it can't be undone.
- Agents read the full guide at twist.tools/llms.txt.