BotCreds Agent Artifacts vs Botkibble

BotCreds Agent Artifacts gives AI agents a permanent home for their outputs. Post a single HTML file to the REST API. The plugin parses it, extracts scripts and styles, saves them as static files, enqueues them properly via WordPress APIs, and serves the result at a clean public URL with strict security headers. No build tools. No infrastructure. One API call. How It Works POST raw HTML to /wp-json/wp/v2/artifacts The plugin extracts and blocks and saves them as static files in wp-content/uploads/artifacts/{id}/ JS and CSS are enqueued via wp_enqueue_script() / wp_enqueue_style() — no inline scripts in rendered output The HTML body is sanitized with wp_kses() and an expanded allowed-tags list (canvas, SVG, inputs, video, audio, data-* attributes) The artifact is served at yourdomain.com/artifacts/{slug}/ with a strict Content Security Policy From the caller’s perspective: POST HTML, get URL. Everything else happens server-side. Features Deployment Single REST API call — no SDK, no library, any HTTP client works Update artifacts in place — POST to /wp-json/wp/v2/artifacts/{id} and the public URL stays the same Optional artifact_description field for internal documentation Head content preservation — tags and other elements from submitted HTML are preserved in output External script support — tags are registered as external dependencies and enqueued alongside local assets Asset cache busting — enqueued files are versioned with filemtime() so browsers fetch updates automatically Clean redeploys — old asset files are deleted before new ones are written Security Content Security Policy on every artifact page — blocks external script injection and cross-origin data exfiltration by default Trusted CDN list out of the box: cdn.jsdelivr.net, unpkg.com, cdnjs.cloudflare.com, esm.sh, cdn.skypack.dev — scripts and styles load from these without any configuration Per-artifact API allowlist — artifacts that call external APIs declare their origins via an HTML pragma comment ( ) or a deploy-time meta field; the plugin adds them to connect-src automatically Additional security headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy Custom capability type — artifact capabilities are separate from standard post capabilities; only Administrators can create artifacts by default Developer Hooks botcreds_agent_artifacts_csp — filter the full CSP header value for any artifact botcreds_agent_artifacts_allowed_html — filter the wp_kses allowed-tags array botcreds_agent_artifacts_grant_to_role() — helper to grant capabilities to additional roles Custom template — drop single-artifact.php in your active theme to replace the render template Use Cases OpenClaw (AI personal assistant) OpenClaw agents can deploy interactive dashboards, daily digests, data visualizations, and mini-apps in a single tool call. Generate the HTML, POST it, get the URL — no manual steps, no context switching. For artifacts that fetch live data, add a pragma comment to the HTML and the CSP is updated automatically: For recurring reports (daily digests, weekly summaries), store the artifact ID after the first deploy and update in place on subsequent runs. The URL never changes. Claude Code (terminal-based coding agent) Claude Code sessions can invoke a shell deploy script directly after generating output. Add a scripts/deploy-artifact.sh to your project and reference it in your CLAUDE.md — Claude will use it to ship outputs without leaving the terminal. No manual copy-paste, no browser switching. Codex (OpenAI coding agent) Same pattern as Claude Code. Add deployment instructions to your AGENTS.md and Codex can write HTML, call the deploy script, and report the live URL — all in one agent run. GitHub Actions (versioned project) For projects that build a static HTML output — dashboards, reports, documentation, changelogs — a GitHub Actions workflow can deploy to an artifact on every push to main. The artifact ID is stored as a repository variable so the public URL stays stable across all future deploys. Push → build → deploy → done. Example: Deploy via REST API curl -X POST "https://your-site.com/wp-json/wp/v2/artifacts" \ -u "username:application-password" \ -H "Content-Type: application/json" \ -d '{ "title": "My App", "status": "publish", "meta": { "artifact_html": " Hello. ", "artifact_description": "Built by my AI agent" } }' The response link field is the public URL of the deployed artifact. Example: Artifact with Live Data Include the fetch pragma in your HTML — no configuration needed: fetch('https://api.openweathermap.org/data/2.5/weather?q=Denver&appid=YOUR_KEY') .then(r => r.json()) .then(d => document.getElementById('weather').textContent = d.weather[0].description); Example: GitHub Actions Deployment name: Deploy Artifact on: push: branches: [main] jobs: deploy: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: npm ci && npm run build - name: Deploy to Artifact env: WP_SITE: ${{ secrets.ARTIFACT_WP_SITE }} WP_USER: ${{ secrets.ARTIFACT_WP_USER }} WP_PASS: ${{ secrets.ARTIFACT_WP_PASS }} ARTIFACT_ID: ${{ vars.ARTIFACT_ID }} run: | PAYLOAD=$(jq -n --arg title "My Dashboard" --rawfile html dist/index.html \ '{title: $title, status: "publish", meta: {artifact_html: $html}}') ENDPOINT="$WP_SITE/wp-json/wp/v2/artifacts" [ -n "$ARTIFACT_ID" ] && ENDPOINT="$ENDPOINT/$ARTIFACT_ID" curl -sf -X POST "$ENDPOINT" -u "$WP_USER:$WP_PASS" \ -H "Content-Type: application/json" -d "$PAYLOAD" | jq -r '.link'

AI agents, LLMs, and crawlers have to wade through navigation bars, sidebars, ads, and comment forms to reach the content they want, and every element costs tokens. Cloudflare measured an 80% reduction in token usage when converting a blog post from HTML to Markdown (16,180 tokens down to 3,150). Botkibble adds a Markdown endpoint to every published post and page. Cloudflare offers Markdown for Agents at the CDN edge on Pro, Business, and Enterprise plans. Botkibble does the same thing (for free) at the origin, so it works on any host. GitHub Repository Three ways to request Markdown: .md suffix: append .md to any post or page URL (e.g. example.com/my-post.md) Query parameter: add ?format=markdown to any post or page URL Content negotiation: send Accept: text/markdown in the request header What’s in every response: Structured metadata header with title, date, categories, tags, word count, character count, and estimated token count (in YAML frontmatter format, readable by any AI agent) Clean Markdown converted from fully-rendered post HTML (shortcodes run, filters applied) Content-Type: text/markdown and Vary: Accept response headers Content-Signal header for AI signal declaration — defaults to ai-train=no, search=yes, ai-input=yes — see contentsignals.org X-Markdown-Tokens header with estimated token count Discovery via in the HTML head and Link HTTP header Automatic cache invalidation when a post is updated or deleted Performance: Botkibble writes Markdown to disk on the first request, then serves it as a static file. A built-in Fast-Path serves cached files during WordPress’s init hook, before the main database query runs. No extra configuration needed. Add a web server rewrite rule and Botkibble bypasses PHP entirely, serving .md files the same way a server would serve an image or CSS file: Method Avg. response time Standard HTML 0.97s Markdown (cold, first request) 0.95s Markdown (cached, PHP Fast-Path) 0.87s Markdown (Nginx/Apache direct) 0.11s Serving directly from disk is 88% faster than a full WordPress page load. See the Performance section below for Nginx and Apache configuration. Security: Drafts, private posts, and password-protected content return 403 Forbidden Rate limits cache-miss regenerations (20/min by default) to mitigate DoS abuse X-Robots-Tag: noindex keeps Markdown versions out of search results Link: rel="canonical" points search engines back to the HTML version Cache variants (optional): You can persist alternate cached representations by adding ?botkibble_variant=slim (or any other variant name). Variant caches are stored under: /wp-content/uploads/botkibble/_v/ / .md What it does NOT do: Expose drafts, private posts, or password-protected content Serve non-post/page content types by default Require any configuration. Activate and it works. Why Markdown? HTML is expensive for AI systems to process. Cloudflare measured an 80% reduction in token usage when converting a blog post from HTML to Markdown (16,180 tokens down to 3,150). Cloudflare now offers Markdown for Agents at the CDN edge via the Accept: text/markdown header, available on Pro, Business, and Enterprise plans. This plugin does the same thing at the origin, so it works on any host. It also adds .md suffix URLs, ?format=markdown query parameters, YAML frontmatter, static file caching, and server-level offloading. If you use Cloudflare, both share the same Accept: text/markdown header, Content-Signal headers, and X-Markdown-Tokens response headers. Cloudflare currently defaults to Content-Signal: ai-train=yes, search=yes, ai-input=yes with no way to change it. Botkibble defaults to ai-train=no and lets you override the full signal per site via the botkibble_content_signal filter. Performance & Static Offloading This plugin supports static file offloading by writing Markdown content to /wp-content/uploads/botkibble/. Nginx Configuration To bypass PHP entirely and have Nginx serve the files (including variants) directly: # Variants location ~* ^/(_v/[^/]+/.+)\.md$ { default_type text/markdown; try_files /wp-content/uploads/botkibble/$1.md /index.php?$args; } # Default location ~* ^/(.+)\.md$ { default_type text/markdown; try_files /wp-content/uploads/botkibble/$1.md /index.php?$args; } Apache (.htaccess) Add this to your .htaccess before the WordPress rules: RewriteEngine On # Variants RewriteCond %{DOCUMENT_ROOT}/wp-content/uploads/botkibble/_v/$1/$2.md -f RewriteRule ^_v/([^/]+)/(.+)\.md$ /wp-content/uploads/botkibble/_v/$1/$2.md [L,T=text/markdown] # Default RewriteCond %{DOCUMENT_ROOT}/wp-content/uploads/botkibble/$1.md -f RewriteRule ^(.*)\.md$ /wp-content/uploads/botkibble/$1.md [L,T=text/markdown] Even without these rules, the plugin uses a “Fast-Path” that serves cached files from PHP before the main database query is executed. Credits We thank Cristi Constantin (https://github.com/cristi-constantin) for contributing cache variants, URL and SEO improvements, and fixing important bugs.