Activitynorthpinebakery.comFreelancers and small agencies
A client emails a change while you’re at another job. Your agent makes it, you approve it from your phone, and it’s live before lunch.
For people who build websites with AI
Your agent finished the fix. Now it can ship it.
ArtiFTP is built for AI agents like Grok and Cursor. They can upload files to your hosting only with your OK, and never outside the site folder you set.
The problem
AI can build the change in minutes. Getting it onto the site still takes you.
You ask your agent for a new price list, a fixed typo, a fresh page. It’s done before you finish your coffee. Then it sits in the chat as a zip file until you get home, log into cPanel, find the right folder and upload it yourself. Your customer waits. You’re the bottleneck in your own workflow.
9:04 AMAgent finishes the fix
sitting in chat as a .zip
6:40 PMYou upload it in cPanel
The alternative, giving an AI your permanent FTP password, is worse.
The answer
Connect once. Choose the folder. Approve when it matters.
Connect your host once.
Add your SFTP or FTP login from GoDaddy, any cPanel host or your own server. It’s encrypted the moment you save it.
Fence off the folder.
Pick exactly where agents are allowed to work, like
/public_htmlor just/public_html/blog. Everything outside that folder doesn’t exist to them.Approve from your phone.
When an agent needs access, you get an email with a request that says what it wants to do. Tap Approve and it can work. Tap Revoke and it’s locked again.
See it work
One request, start to finish.
Scroll to play it through. Everything here is a made-up example site.
- You text your agent: “Swap the summer specials for the fall ones.”
- It builds the page and asks for access to
/public_html/menuon northpinebakery.com, with a purpose line saying why. - You tap Approve on your phone. The session opens with list, read and write, and no delete.
- It uploads
specials.htmlandfall-specials.jpginto/public_html/menu. - It tries
../config/settings.php. Refused: outside your folder. - Your Activity screen lists the request, the approval, both uploads and the refusal.
- It tries to delete
old-menu.html. Refused: delete isn’t allowed in /menu. It sends you a new request asking for that one delete. - The new request shows the delete as an amber Allow once card. You turn it on and tap Approve. The delete runs once, on that exact file. A second delete, of
summer-banner.jpg, is refused: Allow once already used. - You revoke the session. It locks instantly and the agent can no longer connect.
Rules for every folder
You decide what an agent can do, folder by folder.
For each folder, choose whether agents can list files, read them, write them or delete them. Anything outside your rules is refused and the agent is told exactly why, unless you’ve turned on an away window. When something needs a one-off exception, the agent sends a new request and you switch on Allow once as you approve it. On the approve screen it’s an amber card for that one operation. It works exactly one time, on that exact file, and your folder rules never change.
| Folder | List | Read | Write | Delete |
|---|---|---|---|---|
| /menuWeekly menu pages | ||||
| /imagesPhotos | ||||
| /blogPosts | ||||
| /Everything else |
Default deny. A folder starts with nothing allowed until you switch it on. Tap a cell to try it. Exceptions aren’t set here: they’re granted one operation at a time, on the approve screen.
1Refused
delete /menu/old-menu.html
Delete isn’t allowed in /menu.
2Allow once
delete /menu/old-menu.html · 4.2 KB
The agent sends a new request for that one delete. On the approve screen it’s an amber Allow once card. You turn it on and tap Approve, and the delete runs once.
3Allow once Used
delete /menu/summer-banner.jpg
It covered one operation on one exact file. A second delete is refused: Allow once already used.
REFUSEDdelete /menu/old-menu.htmlDelete isn’t allowed in /menu
REFUSEDwrite /../config.phpOutside your allowed folders
REFUSEDdelete /menu/summer-banner.jpgAllow once already used
REFUSEDOutside your rules
REFUSEDAllow once already used
REFUSEDDoesn’t match what you allowed once
REFUSEDPath outside the site folder
Security
Encrypted at rest. Invisible to agents.
Your hosting password is encrypted with AES-256-GCM, with a separate key for each site, and no agent ever sees it. Agents get sessions, not passwords, and every session is limited to the folder you chose and ends when you revoke it or your timer runs out.
- Rules for every folder
- Nothing runs without your OK
- Revoke any session instantly
- Full activity log
Who it’s for
Built for people who’d rather be doing something else.
Business owners with a website
Keep your agent handling the updates without handing over the keys to your hosting account.
AI power users
Let Grok, Cursor or your own agent deploy real work, with a human approval step you actually control.
Anyone nervous about AI touching their site
You decide the folder, the permissions and the time limit, and you can pull access instantly.
Owners who are away
On a shift or on the road, you can turn on a timed auto-approve window so your agent keeps working without waiting for you. Only you can turn it on, it ends by itself within 7 days at most, you accept a risk notice first, and your agent still can’t reach anything outside your site’s folder.
Side by side
Why not just give the agent your password?
Handing over your FTP password pass: ••••••••
The agent can reach and delete anything in your account
Access lasts until you change the password
No record of what changed
The password is sitting in a chat or a file somewhere
You find out after something breaks
ArtiFTP ••••••••
The agent can only do what you allow, folder by folder
Access ends when you revoke or the timer runs out
Every request, approval, file operation and refusal is logged
The password stays encrypted and is never shown
Nothing happens without your OK
Pricing
Simple plans. Coming soon.
Starter$4.99/mo1 to 2 sites
Pro$9.99/mo3 to 6 sites
Unlimited$14.99/moUnlimited sites
Every plan includes phone approval, per-folder rules, Allow once, instant revoke and the activity log.
Early access
Stop being the upload step.
Your agent does the work. You keep the final say.
Get early access
Name, business, email, and which AI agent you use. We’ll open seats in waves.