BotCreds Agent Artifacts vs Conversion Agent Discovery

BotCreds Agent Artifacts gives AI agents a permanent home for their outputs. Post a single HTML file to the REST API. The plugin parses it, extracts scripts and styles, saves them as static files, enqueues them properly via WordPress APIs, and serves the result at a clean public URL with strict security headers. No build tools. No infrastructure. One API call. How It Works POST raw HTML to /wp-json/wp/v2/artifacts The plugin extracts and blocks and saves them as static files in wp-content/uploads/artifacts/{id}/ JS and CSS are enqueued via wp_enqueue_script() / wp_enqueue_style() — no inline scripts in rendered output The HTML body is sanitized with wp_kses() and an expanded allowed-tags list (canvas, SVG, inputs, video, audio, data-* attributes) The artifact is served at yourdomain.com/artifacts/{slug}/ with a strict Content Security Policy From the caller’s perspective: POST HTML, get URL. Everything else happens server-side. Features Deployment Single REST API call — no SDK, no library, any HTTP client works Update artifacts in place — POST to /wp-json/wp/v2/artifacts/{id} and the public URL stays the same Optional artifact_description field for internal documentation Head content preservation — tags and other elements from submitted HTML are preserved in output External script support — tags are registered as external dependencies and enqueued alongside local assets Asset cache busting — enqueued files are versioned with filemtime() so browsers fetch updates automatically Clean redeploys — old asset files are deleted before new ones are written Security Content Security Policy on every artifact page — blocks external script injection and cross-origin data exfiltration by default Trusted CDN list out of the box: cdn.jsdelivr.net, unpkg.com, cdnjs.cloudflare.com, esm.sh, cdn.skypack.dev — scripts and styles load from these without any configuration Per-artifact API allowlist — artifacts that call external APIs declare their origins via an HTML pragma comment ( ) or a deploy-time meta field; the plugin adds them to connect-src automatically Additional security headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy Custom capability type — artifact capabilities are separate from standard post capabilities; only Administrators can create artifacts by default Developer Hooks botcreds_agent_artifacts_csp — filter the full CSP header value for any artifact botcreds_agent_artifacts_allowed_html — filter the wp_kses allowed-tags array botcreds_agent_artifacts_grant_to_role() — helper to grant capabilities to additional roles Custom template — drop single-artifact.php in your active theme to replace the render template Use Cases OpenClaw (AI personal assistant) OpenClaw agents can deploy interactive dashboards, daily digests, data visualizations, and mini-apps in a single tool call. Generate the HTML, POST it, get the URL — no manual steps, no context switching. For artifacts that fetch live data, add a pragma comment to the HTML and the CSP is updated automatically: For recurring reports (daily digests, weekly summaries), store the artifact ID after the first deploy and update in place on subsequent runs. The URL never changes. Claude Code (terminal-based coding agent) Claude Code sessions can invoke a shell deploy script directly after generating output. Add a scripts/deploy-artifact.sh to your project and reference it in your CLAUDE.md — Claude will use it to ship outputs without leaving the terminal. No manual copy-paste, no browser switching. Codex (OpenAI coding agent) Same pattern as Claude Code. Add deployment instructions to your AGENTS.md and Codex can write HTML, call the deploy script, and report the live URL — all in one agent run. GitHub Actions (versioned project) For projects that build a static HTML output — dashboards, reports, documentation, changelogs — a GitHub Actions workflow can deploy to an artifact on every push to main. The artifact ID is stored as a repository variable so the public URL stays stable across all future deploys. Push → build → deploy → done. Example: Deploy via REST API curl -X POST "https://your-site.com/wp-json/wp/v2/artifacts" \ -u "username:application-password" \ -H "Content-Type: application/json" \ -d '{ "title": "My App", "status": "publish", "meta": { "artifact_html": " Hello. ", "artifact_description": "Built by my AI agent" } }' The response link field is the public URL of the deployed artifact. Example: Artifact with Live Data Include the fetch pragma in your HTML — no configuration needed: fetch('https://api.openweathermap.org/data/2.5/weather?q=Denver&appid=YOUR_KEY') .then(r => r.json()) .then(d => document.getElementById('weather').textContent = d.weather[0].description); Example: GitHub Actions Deployment name: Deploy Artifact on: push: branches: [main] jobs: deploy: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: npm ci && npm run build - name: Deploy to Artifact env: WP_SITE: ${{ secrets.ARTIFACT_WP_SITE }} WP_USER: ${{ secrets.ARTIFACT_WP_USER }} WP_PASS: ${{ secrets.ARTIFACT_WP_PASS }} ARTIFACT_ID: ${{ vars.ARTIFACT_ID }} run: | PAYLOAD=$(jq -n --arg title "My Dashboard" --rawfile html dist/index.html \ '{title: $title, status: "publish", meta: {artifact_html: $html}}') ENDPOINT="$WP_SITE/wp-json/wp/v2/artifacts" [ -n "$ARTIFACT_ID" ] && ENDPOINT="$ENDPOINT/$ARTIFACT_ID" curl -sf -X POST "$ENDPOINT" -u "$WP_USER:$WP_PASS" \ -H "Content-Type: application/json" -d "$PAYLOAD" | jq -r '.link'

Conversion Agent Discovery helps WordPress sites expose public, read-only discovery surfaces for AI agents without pretending to support capabilities that are not implemented. It is designed to improve measurable agent accessibility for public, read-only discovery checks without calling external scanners automatically. Features include: Markdown negotiation for public content with Accept: text/markdown. Content Signals in robots.txt. Generated llms.txt and /.well-known/llms.txt. Editable AI Instructions page for official brand facts and LLM guidance, starting empty with English templates by default. Runtime Front-end Placement for exact, design-safe AI Instructions link placement across matching public header, footer, or page content components. [conversion_ai_instructions_link] shortcode for manual placement. Generated /.well-known/api-catalog. Generated /.well-known/agent-skills/index.json and virtual SKILL.md files. Local Agent Skills discovery schema generated by the site. Read-only WebMCP tool registration with runtime diagnostics for compatible browsers. Production-oriented Agentic Browsing readiness guidance for PageSpeed and Lighthouse checks. Optional origin isolation headers and optional Origin-Trial header for browser WebMCP runtime support. Opt-in declarative WebMCP form annotations for exact rendered form opening tags. Public read-only REST endpoints for site search, recent content, single content reads, site context, and contact handoff. Agentic Browsing diagnostics that separate plugin-controlled discovery surfaces from theme accessibility and layout stability checks. Admin settings page with a global public switch. Conversion Agent Discovery does not publish fake OAuth, MCP Server Card, A2A, or commerce metadata. The AI Instructions feature was inspired by Chris Long’s public LinkedIn post and Nectiv case study showing that AI Instructions pages can be cited by ChatGPT in branded queries. It also credits the earlier Seer Interactive AI Information page by Wil Reynolds and Alisa Scharf that Chris Long identified as an important example. References: Chris Long’s LinkedIn post: https://www.linkedin.com/posts/chris-long-marketing_holy-moly-seos-ai-instruction-pages-influence-share-7466096236799053824-_rpb/ Nectiv case study: https://nectivdigital.com/blog/aeo-experiment-chatgpt-cited-an-ai-instructions-page-in-48-hours Nectiv AI Instructions example: https://nectivdigital.com/ai-instructions Seer Interactive AI Information example: https://www.seerinteractive.com/ai-information Omniscient Digital AI Info example: https://beomniscient.com/ai-info/ llms.txt proposal by Jeremy Howard: https://llmstxt.org/ Important: this plugin does not guarantee LLM citations, search rankings, AI Overview visibility, or model behavior. It provides controlled public discovery surfaces for experimentation. External Services This plugin does not send requests to external services automatically and does not transmit visitor or site data to third parties. The generated Agent Skills discovery document uses a local schema URL served by the WordPress site at /.well-known/agent-skills/discovery-0.2.schema.json; it does not depend on an external schema service. The plugin contains optional external links that administrators or users may open manually: https://conversion.ag/ is linked for Conversion attribution and plugin author information. The plugin does not send visitor or site data to Conversion; the link is opened only when a user clicks it manually. Conversion’s privacy policy is available at https://www.conversion.com.br/politica-de-privacidade/. https://github.com/agencia-conversion/conversion-agent-discovery is linked as the public development repository and release source. The plugin does not send visitor or site data to GitHub; the link is opened only when a user clicks it manually. GitHub’s terms are available at https://docs.github.com/en/site-policy/github-terms/github-terms-of-service and GitHub’s privacy statement is available at https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement. https://wordpress.org/plugins/wp-graphql/ is linked from the admin screen when WPGraphQL is not detected, so administrators can optionally install it. The plugin does not send visitor or site data to WordPress.org; the link is opened only when an administrator clicks it manually. WordPress.org’s privacy policy is available at https://wordpress.org/about/privacy/ and terms are available at https://wordpress.org/about/terms-of-service/. https://pagespeed.web.dev/ is linked from the Agentic Browsing admin screen so administrators can manually test their public site in PageSpeed Insights. The plugin does not send visitor or site data to Google automatically; the link is opened only when an administrator clicks it manually. Google’s privacy policy is available at https://policies.google.com/privacy and terms are available at https://policies.google.com/terms. The developer-only tools/run-agentic-lighthouse.sh script is not run by WordPress and is never executed automatically. If a developer runs it manually, it uses npx to download and run Lighthouse from the npm registry and audits only the URL supplied by the developer. The optional WebMCP Origin Trial token field is empty by default. If an administrator adds a public Chrome origin trial token, the plugin sends it as an Origin-Trial response header on public pages together with the opt-in WebMCP origin isolation headers. The plugin does not request or generate tokens and does not make a server-side request to Google or Chrome services. Conversion’s privacy policy is available at https://www.conversion.com.br/politica-de-privacidade/. Privacy Conversion Agent Discovery does not track users and does not send site data to external services automatically. Outbound links in the admin screen and readme are plain manual links. Development Development happens at https://github.com/agencia-conversion/conversion-agent-discovery. The distributed plugin contains readable PHP, JavaScript, CSS, and SVG source files; no build step is required to run the plugin. Local Agentic Browsing validation can be run by developers with: tools/setup-agentic-fixture.sh tools/run-agentic-lighthouse.sh http://localhost:8089/ node tools/assert-agentic-lighthouse.mjs .context/lighthouse-agentic.json CAD_REQUIRE_WEBMCP=1 node tools/assert-agentic-lighthouse.mjs .context/lighthouse-agentic.json when running a Chrome runtime that exposes real WebMCP APIs. Public 0.4.0 launch materials are available in the repository: docs/launch-0.4.0.md docs/local-agentic-browsing-activation.md docs/demo-checklist-0.4.0.md docs/changelog-0.4.0.md