Title: BotCreds Agent Artifacts Author: Joe Boydston Published: June 19, 2026 Last modified: June 19, 2026 --- Search plugins ![](https://ps.w.org/botcreds-agent-artifacts/assets/banner-772x250.png?rev=3578746) ![](https://ps.w.org/botcreds-agent-artifacts/assets/icon-128x128.png?rev=3578746) # BotCreds Agent Artifacts By [Joe Boydston](https://profiles.wordpress.org/jboydston/) [Download](https://downloads.wordpress.org/plugin/botcreds-agent-artifacts.1.3.6.zip) * [Details](https://xho.wordpress.org/plugins/botcreds-agent-artifacts/#description) * [Reviews](https://xho.wordpress.org/plugins/botcreds-agent-artifacts/#reviews) * [Installation](https://xho.wordpress.org/plugins/botcreds-agent-artifacts/#installation) * [Development](https://xho.wordpress.org/plugins/botcreds-agent-artifacts/#developers) [Support](https://wordpress.org/support/plugin/botcreds-agent-artifacts/) ## Description **BotCreds Agent Artifacts** gives AI agents a permanent home for their outputs. Post a single HTML file to the REST API. The plugin parses it, extracts scripts and styles, saves them as static files, enqueues them properly via WordPress APIs, and serves the result at a clean public URL with strict security headers. No build tools. No infrastructure. One API call. #### How It Works 1. POST raw HTML to `/wp-json/wp/v2/artifacts` 2. The plugin extracts ` ``` #### Example: GitHub Actions Deployment ``` name: Deploy Artifact on: push: branches: [main] jobs: deploy: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: npm ci && npm run build - name: Deploy to Artifact env: WP_SITE: ${{ secrets.ARTIFACT_WP_SITE }} WP_USER: ${{ secrets.ARTIFACT_WP_USER }} WP_PASS: ${{ secrets.ARTIFACT_WP_PASS }} ARTIFACT_ID: ${{ vars.ARTIFACT_ID }} run: | PAYLOAD=$(jq -n --arg title "My Dashboard" --rawfile html dist/index.html \ '{title: $title, status: "publish", meta: {artifact_html: $html}}') ENDPOINT="$WP_SITE/wp-json/wp/v2/artifacts" [ -n "$ARTIFACT_ID" ] && ENDPOINT="$ENDPOINT/$ARTIFACT_ID" curl -sf -X POST "$ENDPOINT" -u "$WP_USER:$WP_PASS" \ -H "Content-Type: application/json" -d "$PAYLOAD" | jq -r '.link' ``` ## Installation 1. Upload the `botcreds-agent-artifacts` folder to `/wp-content/plugins/` 2. Activate **BotCreds Agent Artifacts** in the WordPress admin under **Plugins** 3. Go to **Settings Permalinks** and click **Save Changes** to flush rewrite rules 4. Create a WordPress **Application Password** for your agent user: **Users Profile Application Passwords** ## FAQ ### Does this work with any REST client or AI agent? Yes. Any HTTP client that can POST JSON with Basic Auth (username + Application Password) works. No SDK or special library required. curl, Python’s urllib, Node’s fetch — anything goes. ### Are artifacts sandboxed? Artifact pages are served with a Content Security Policy that blocks external script injection and cross-origin fetch/XHR by default. The CSP is filterable (`botcreds_agent_artifacts_csp`) for custom use cases, and per-artifact API origins can be declared via the `artifact: fetch` pragma or the `artifact_connect_src` meta field. ### What scripts and CDNs are allowed without configuration? The following CDNs are in the default `script-src` allowlist: `cdn.jsdelivr.net`,` unpkg.com`, `cdnjs.cloudflare.com`, `esm.sh`, `cdn.skypack.dev`. External modules loaded from these CDNs work in artifact HTML without any additional configuration. ### How do I allow my artifact to call an external API? Two options: **Option 1 — HTML pragma (recommended):** Add a comment to your submitted HTML: The plugin strips the comment from output and adds the origin to `connect-src`. **Option 2 — Deploy-time meta field:** Pass `artifact_connect_src` as an array: “ meta”: { “artifact_connect_src”: [“https://api.example.com”] } Both options accept only `https://` origins. No wildcards, no `http://`. ### How do I update an artifact without changing its URL? POST to `/wp-json/wp/v2/artifacts/{id}` with the same fields. The existing asset files are cleared, new files are written, and the public URL (`/artifacts/{slug}/`) does not change. ### What HTML elements and attributes are allowed? The plugin allows a superset of `wp_kses_allowed_html('post')` including `