Novence

Site extras

Widgets and data files

Static hosting is not a dead end. Drop in a booking or shop widget, or ship JSON with the site for menus and hours. No plugin marketplace. No SSR.

Third-party widgets

Paste a script or iframe in your HTML. Novence serves the file as-is and does not strip tags. Works now for bookings, checkout, analytics, and BYO forms.

  • Cal.com or similar — scheduling. Yes/no: /integrations/cal-com
  • Snipcart, Shopify Buy Button, Stripe Payment Links — shop / pay
  • Google Analytics, DataFast, or any client analytics script
  • Formspree / Web3Forms — if you skip Novence Forms

Never put nv_ keys in HTML, client JS, or git. Public widget keys (Cal.com event links, Snipcart public key) are fine.

Baked-in data files

Upload /data/{collection}.json. Page JS fetches it same-origin. The owner (or agent) updates that one file and deploys. .json is already on the allowlist — no platform feature required.

<!-- index.html -->
<ul data-novence="menu"></ul>
<script>
  fetch("/data/menu.json")
    .then((r) => r.json())
    .then((items) => {
      const root = document.querySelector('[data-novence="menu"]');
      root.innerHTML = items
        .map((item) => "<li>" + item.name + " — " + item.price + "</li>")
        .join("");
    });
</script>

Same pattern for hours, team, services, FAQ, and inventory lists. Changing the JSON is a new deploy on Free. Pro/Scale can PUT the file live with put_site_data (still keep it in the project so the next deploy does not wipe it). Cache is about 60s. Do not store secrets in /data — the URL is public.

Owner edit

Pro/Scale, off by default. PATCH dataEditEmails (the baker) and dataEditNames (menu, hours). They bookmark /{path} (default /edit) on the live origin — custom domains included. Email OTP (15 minutes), then a generated form for 48 hours. No nv_ key. No JSON textarea. Agent put_site_data is unchanged. Empty emails turns it off. The path is noindex.

Visitor Site MCP

Pro/Scale, off by default. PATCH siteMcp to read or forms. The live origin serves /.well-known/mcp.json; visitor agents connect to https://api.novence.ai/sites/{suffix}/mcp with no nv_ key. Tools: list_pages, get_site_data; forms also list_forms and submit_form. Share-gated platform hosts stay private. Control-plane MCP at /mcp is unchanged.

What fits

  • Hours, phone, address, seasonal copy — one JSON object
  • Menu, team, services, FAQ, inventory — /data/*.json + bind script
  • Contact / quote leads — Novence Forms
  • Bookings, payments, shop checkout — BYO widget
  • Private CRM, logged-in prices, secrets — host a real backend elsewhere
  • A WordPress plugin that runs PHP — impossible on this host

Widgets and data FAQ

Do I need a Novence plugin?

No. There is no plugin marketplace and no per-site server. Improve the site in the files you upload: third-party widgets in HTML, and JSON data files fetched by page JS.

Will third-party scripts be stripped?

No. HTML is served as-is. The Worker does not rewrite tags. Content-Security-Policy is report-only, so Cal.com, Snipcart, Shopify Buy Button, GA, and similar CDN widgets load today. Never put nv_ keys in the page.

How do I update a menu or hours?

Ship /data/menu.json (or hours.json, team.json). Page JS fetches it same-origin. Change the file and deploy again. .json is already on the upload allowlist.

Can the owner edit live content without a deploy?

On Pro/Scale, the agent can PUT /data/{name}.json (put_site_data) without a deploy. For a non-technical owner, opt in with PATCH dataEditEmails + dataEditNames (optional dataEditPath, default /edit). They open that path on the live site (custom domains included), enter the saved email, get a 15-minute OTP, then a generated form for 48 hours. Off by default. Never a JSON textarea. Include /data files in the next deploy or a repo upload that omits them can wipe them. Not a WordPress CMS.

Can other agents use my live site without an nv_ key?

On Pro/Scale, opt in with PATCH /v1/projects/{id} { "siteMcp": "read" } or "forms", or MCP update_project_settings site_mcp. Off by default. Discovery is /.well-known/mcp.json on the live origin; tools are at https://api.novence.ai/sites/{suffix}/mcp (list_pages, get_site_data; forms adds list_forms and submit_form). No nv_ key. Share-gated *.novence.ai hosts stay private. Control-plane MCP at /mcp is unchanged.

What does not fit?

WordPress PHP plugins, private CRM data, prices behind login, and owner API secrets in the browser. Bookings and checkout belong in a BYO widget (Cal.com, Stripe Payment Links, Snipcart). Contact leads: Novence Forms.

Ship the files. Host on Novence.

Forms for leads. Widgets for bookings and checkout. JSON for the catalog.

DocsFormsExamplesllms-full.txt