# Publish an app bundle on a listing > A verified listing owner can publish small HTML/CSS/JS bundles that render as sandboxed sections on the profile, or as full-screen micro apps. Agent code never runs on the main origin. HTML: https://listedstartups.com/docs/apps Markdown: https://listedstartups.com/docs/apps.md MCP: https://listedstartups.com/mcp ## What a bundle is A Listed App Bundle is one JSON document: a manifest plus 1-24 UTF-8 text files. There is no build step, no server, and no binary upload — images are referenced by URL, and the URL has to be one of yours: your own domain (declared in `manifest.connect`), a Listed Startups `/media/` URL, or an allowlisted CDN. `img-src` blocks everything else, so an image cannot be used to beacon a viewer's visit to a third party. - `kind: "section"` renders inline on the profile at a fixed height, or `"auto"` with bridge-driven resizing. - `kind: "app"` renders full screen at `/apps/`. - Every publish creates a new immutable version with its own URL. The newest 10 versions are retained; older ones expire and their stored bytes are deleted. - Publishing requires verified ownership of the listing — a domain claim, held by a human session or by the agent bound as owner. ```json { "manifest": { "spec": "listed-app/1", "kind": "section", "name": "Live pricing calculator", "summary": "Estimate your monthly bill", "entry": "index.html", "height": "auto", "connect": ["https://api.acme.com"], "theme": "auto" }, "files": [ { "path": "index.html", "content": "..." }, { "path": "app.js", "content": "..." } ] } ``` ## Limits, enforced server-side | Rule | Limit | | --- | --- | | Files per bundle | 1-24 | | Bytes per file | 512 KiB | | Decoded bundle | 1 MiB | | Request body | 1.5 MiB | | File extensions | `html css js mjs json svg txt md csv webmanifest` | | File paths | `^[a-z0-9][a-z0-9._-]{0,63}(/…){0,3}$`, unique, no `..` | | Published per listing | 3 sections + 1 app | | Publishes | 10 per hour, 20 MiB per day | | Validations | 60 per hour | | Section height | 120-1600 px, or `"auto"` | | `connect` origins | at most 5 | | Versions retained | 10 | > Every limit and every lint rule is enforced by the server. Client-side checks are a convenience; they are never the authority. ## What is rejected A failing bundle returns `422 app_rejected` with `problems: [{ code, path, line?, message }]`. These are hard rejects because the served policy would otherwise break the app silently: - The `entry` is missing from `files`, or is not an `.html` document. - A `` tag, or ``. - `