BotCreds Agent Artifacts
BotCreds Agent Artifacts gives AI agents a permanent home for their outputs. Post a single HTML file to the REST API. The plugin parses it, extracts scripts and styles, saves them as static files, enqueues them properly via WordPress APIs, and serves the result at a clean public URL with strict security headers. No build tools. No infrastructure. One API call. How It Works POST raw HTML to /wp-json/wp/v2/artifacts The plugin extracts and blocks and saves them as static files in wp-content/uploads/artifacts/{id}/ JS and CSS are enqueued via wp_enqueue_script() / wp_enqueue_style() — no inline scripts in rendered output The HTML body is sanitized with wp_kses() and an expanded allowed-tags list (canvas, SVG, inputs, video, audio, data-* attributes) The artifact is served at yourdomain.com/artifacts/{slug}/ with a strict Content Security Policy From the caller’s perspective: POST HTML, get URL. Everything else happens server-side. Features Deployment Single REST API call — no SDK, no library, any HTTP client works Update artifacts in place — POST to /wp-json/wp/v2/artifacts/{id} and the public URL stays the same Optional artifact_description field for internal documentation Head content preservation — tags and other elements from submitted HTML are preserved in output External script support — tags are registered as external dependencies and enqueued alongside local assets Asset cache busting — enqueued files are versioned with filemtime() so browsers fetch updates automatically Clean redeploys — old asset files are deleted before new ones are written Security Content Security Policy on every artifact page — blocks external script injection and cross-origin data exfiltration by default Trusted CDN list out of the box: cdn.jsdelivr.net, unpkg.com, cdnjs.cloudflare.com, esm.sh, cdn.skypack.dev — scripts and styles load from these without any configuration Per-artifact API allowlist — artifacts that call external APIs declare their origins via an HTML pragma comment ( ) or a deploy-time meta field; the plugin adds them to connect-src automatically Additional security headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy Custom capability type — artifact capabilities are separate from standard post capabilities; only Administrators can create artifacts by default Developer Hooks botcreds_agent_artifacts_csp — filter the full CSP header value for any artifact botcreds_agent_artifacts_allowed_html — filter the wp_kses allowed-tags array botcreds_agent_artifacts_grant_to_role() — helper to grant capabilities to additional roles Custom template — drop single-artifact.php in your active theme to replace the render template Use Cases OpenClaw (AI personal assistant) OpenClaw agents can deploy interactive dashboards, daily digests, data visualizations, and mini-apps in a single tool call. Generate the HTML, POST it, get the URL — no manual steps, no context switching. For artifacts that fetch live data, add a pragma comment to the HTML and the CSP is updated automatically: For recurring reports (daily digests, weekly summaries), store the artifact ID after the first deploy and update in place on subsequent runs. The URL never changes. Claude Code (terminal-based coding agent) Claude Code sessions can invoke a shell deploy script directly after generating output. Add a scripts/deploy-artifact.sh to your project and reference it in your CLAUDE.md — Claude will use it to ship outputs without leaving the terminal. No manual copy-paste, no browser switching. Codex (OpenAI coding agent) Same pattern as Claude Code. Add deployment instructions to your AGENTS.md and Codex can write HTML, call the deploy script, and report the live URL — all in one agent run. GitHub Actions (versioned project) For projects that build a static HTML output — dashboards, reports, documentation, changelogs — a GitHub Actions workflow can deploy to an artifact on every push to main. The artifact ID is stored as a repository variable so the public URL stays stable across all future deploys. Push → build → deploy → done. Example: Deploy via REST API curl -X POST "https://your-site.com/wp-json/wp/v2/artifacts" \ -u "username:application-password" \ -H "Content-Type: application/json" \ -d '{ "title": "My App", "status": "publish", "meta": { "artifact_html": " Hello. ", "artifact_description": "Built by my AI agent" } }' The response link field is the public URL of the deployed artifact. Example: Artifact with Live Data Include the fetch pragma in your HTML — no configuration needed: fetch('https://api.openweathermap.org/data/2.5/weather?q=Denver&appid=YOUR_KEY') .then(r => r.json()) .then(d => document.getElementById('weather').textContent = d.weather[0].description); Example: GitHub Actions Deployment name: Deploy Artifact on: push: branches: [main] jobs: deploy: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: npm ci && npm run build - name: Deploy to Artifact env: WP_SITE: ${{ secrets.ARTIFACT_WP_SITE }} WP_USER: ${{ secrets.ARTIFACT_WP_USER }} WP_PASS: ${{ secrets.ARTIFACT_WP_PASS }} ARTIFACT_ID: ${{ vars.ARTIFACT_ID }} run: | PAYLOAD=$(jq -n --arg title "My Dashboard" --rawfile html dist/index.html \ '{title: $title, status: "publish", meta: {artifact_html: $html}}') ENDPOINT="$WP_SITE/wp-json/wp/v2/artifacts" [ -n "$ARTIFACT_ID" ] && ENDPOINT="$ENDPOINT/$ARTIFACT_ID" curl -sf -X POST "$ENDPOINT" -u "$WP_USER:$WP_PASS" \ -H "Content-Type: application/json" -d "$PAYLOAD" | jq -r '.link'
KP Agent Ready
AI agents — tools like ChatGPT, Claude, Copilot, and the growing ecosystem of autonomous AI systems — are increasingly being pointed at websites to gather information, interact with APIs, and perform tasks on behalf of users. For a site to work well with these agents, it needs to speak the right language: publishing structured discovery files, declaring its capabilities, and responding to agent-specific requests in the right format. KP Agent Ready handles all of that for your WordPress site. It implements the current set of agent-readiness standards and the broader AI agent ecosystem — without requiring you to manually create files, edit server configs, or touch a line of code. Everything is managed from a dedicated settings page in the WordPress admin. What It Does RFC 8288 Link Response Headers Every response your site sends will include Link headers pointing agents to your API catalog, agent skills index, and MCP server card. This is how agents find your discovery documents without having to guess URLs. API Catalog — /.well-known/api-catalog Publishes a machine-readable catalog of your site’s APIs in the application/linkset+json format defined by RFC 9727. Each entry in the catalog can point to an OpenAPI specification, human-readable documentation, and a health/status endpoint. If you have not configured any entries yet, the plugin serves a sensible fallback automatically so the endpoint is always valid. Agent Skills Index — /.well-known/agent-skills/index.json Publishes a skills discovery index per the Agent Skills Discovery RFC v0.2.0. This tells agents what your site can do — search your blog, browse your portfolio, submit a contact form, and so on. Skills are built from three sources: Blog articles — a search skill and a browse skill, toggled with a single switch Custom post types — any public CPT registered on your site appears as a checkbox; tick it and it gets a browse skill pointing to its archive Manual entries — define any additional skill with a name, type, description, URL, and an optional sha256 digest MCP Server Card — /.well-known/mcp/server-card.json Publishes an MCP Server Card (SEP-1649) identifying your site to Model Context Protocol clients. Configurable name, version, description, transport endpoint, and a capability list. If you do not have an MCP server running yet, just leave the transport blank — the card is still valid and useful for discovery. OAuth / OIDC Discovery — /.well-known/openid-configuration or /.well-known/oauth-authorization-server If your site exposes protected APIs that require authentication, this feature publishes the discovery metadata agents need to authenticate. Supports both OpenID Connect Discovery 1.0 and RFC 8414. Disabled by default — only enable it if you have the infrastructure in place. OAuth Protected Resource Metadata — /.well-known/oauth-protected-resource Complements the OAuth/OIDC feature by publishing RFC 9728 Protected Resource Metadata. Disabled by default. robots.txt Content Signals Appends Content Signals directives to your robots.txt file, declaring your preferences for how AI systems may use your content: ai-train — whether AI companies may use your content to train models search — whether search engines may index your content ai-input — whether AI retrieval systems (RAG) may use your content as input Markdown Negotiation When an AI agent sends a request with the Accept: text/markdown header, the plugin intercepts the response for singular posts and pages and returns a clean Markdown version of the content. Regular browser requests are completely unaffected. WebMCP Injects a small JavaScript snippet into your page footer that calls navigator.modelContext.provideContext(), exposing your site’s key actions as tools to AI agents running in the browser. Built-in tools include blog search, portfolio navigation, and contact page navigation — each individually toggleable. llms.txt and llms-full.txt Generates physical /llms.txt and /llms-full.txt files in your WordPress web root per the llmstxt.org specification. These files give AI systems a structured, readable index of your site’s content — who you are, what pages exist, and what your posts are about. llms.txt contains your site header and a clean list of links by content type. `llms-full.txt` contains the same structure but expands each entry with an excerpt or truncated content block so AI systems can understand the content without fetching every URL. Files are regenerated automatically when posts are published, unpublished, or trashed, and whenever settings are saved. A manual Regenerate button is available in the llms.txt settings tab. If your host prevents direct file writes, the generated content is displayed in the admin as a copyable textarea so you can create the files manually. Configurable options include a custom intro block, toggling pages and posts independently, selecting additional custom post types, setting the excerpt word limit for llms-full.txt, and defining optional additional links that appear under an ## Optional section in both files. Developer Filters Two filters let themes and other plugins extend the plugin’s output without touching settings: kp_agent_skills — add entries to the agent skills index: add_filter( 'kp_agent_skills', function ( array $skills ): array { $skills[] = [ 'name' => 'my-skill', 'type' => 'api', 'description' => 'Does something useful.', 'url' => 'https://yoursite.com/api/endpoint', ]; return $skills; } ); kp_webmcp_tools — add tools to the WebMCP context: add_filter( 'kp_webmcp_tools', function ( array $tools ): array { // $tools is the PHP array that becomes the JS tools array return $tools; } );
