Artifacts for WordPress

Agents write self-contained HTML. This plugin makes that HTML a first-class WordPress content type: stored like a post, served byte-identical, with revisions, statuses, permalinks, redirects, an archive, an author and provenance — and an Abilities/MCP surface so an agent can publish, update, roll back and learn what the site looks like.

• Requires: WordPress 6.9+ (the Abilities API is in core), PHP 8.1+
• License: GPL-2.0-or-later
• Slug / text domain: wp-artifacts

What "byte-identical" means here

The bytes you send are the bytes a visitor downloads. No theme, no wp_head, no wp_footer, no admin bar, no emoji script, no the_content filters, no wpautop. Requests are intercepted at parse_request and template_redirect priority 1, before WordPress builds a page at all.

The one exception is opt-in: wrap: true serves the artifact inside the site header and footer. Nothing else touches the payload.

Install

git clone https://github.com/draganescu/wp-artefact wp-content/plugins/wp-artifacts
wp plugin activate wp-artifacts

Set a permalink structure other than "Plain" — artifact URLs need rewrite rules. Site Health tells you if you forgot.

URLs

The a prefix and the archive slug are settings, and are filterable with wp_artifacts_url_prefix and wp_artifacts_archive_slug.

Publishing from an agent

This plugin registers abilities and nothing else — it stands up no MCP server of its own. Install the WordPress MCP Adapter and it picks them up automatically: its default server reads meta.public to decide what to expose and meta.mcp.type to sort tools from resources and prompts. Point your client at the adapter's endpoint, by default:

https://example.com/wp-json/mcp/mcp-adapter-default-server

The site style resource (wp://site/style) and the agent guide are discovered as a resource and a prompt; the rest are reachable as tools. Where and how that server is routed, and who may reach it, are the adapter's settings to make — this plugin does not second-guess them. Each ability still enforces its own capability check on every call.

Authentication is likewise the adapter's business: application passwords out of the box, or OAuth through whichever plugin you install. This plugin stores no credentials and has no auth UI.

Claude / Claude Code: add the endpoint as a remote MCP server and authenticate with an application password (Users → Profile → Application Passwords).

ChatGPT: add it as a connector with the same URL.

Whatever the client, the flow is the same:

1. wp-artifacts/guide — read how this site wants artifacts built.
2. wp-artifacts/site-style — palette, fonts, spacing, logo, rendered header and footer.
3. wp-artifacts/publish with status: "private" — you get a share_url to show someone.
4. wp-artifacts/update with status: "publish" when it is approved.

Without the adapter the plugin degrades quietly: the abilities are still registered, so they are callable over the core abilities REST route and over WP-CLI, and artifacts serve exactly the same.

Abilities

WP-CLI

wp artifact publish ./dashboard.html --title="Q3 dashboard" --status=publish
wp artifact publish ./build --title="Landing page" --status=private   # a directory becomes a bundle
wp artifact list
wp artifact revisions 42
wp artifact rollback 42 41
wp artifact style
wp artifact guide

Security

Scripts need unfiltered_html

Publishing an artifact whose content or assets contain script — a `