What agent publishing means
Agent publishing is giving a program a first-class way to hand a finished artifact back to a human as a URL. The agent calls one tool, the document gets a private address, and a person opens it to see what the agent did. Everything below is vocabulary that falls out of taking that one sentence seriously.
Terms
Model Context Protocol (MCP)
An open protocol that lets an AI assistant call tools, read resources and load prompts from an external server in a standard way. Servers speak it over stdio or over Streamable HTTP; clients call them roughly the way a browser calls a URL. This deployment ships one, exposing twelve tools at the publish surface.
Agent artifact
A self-contained output an agent produces while working: a spec, a status report, a dashboard, a diagram, a diff viewer. Almost always a single HTML file, because HTML is the one format that renders interactively in any browser with no build step.
Verification surface
The rendered thing a human opens to check what an autonomous run actually did. Once a session is too long to read as a transcript, the artifact becomes where trust is established — which is what turns hosting it from a convenience into part of the control loop.
Deploy versus publish
To deploy is to ship a project through a build to an environment, with previews and rollbacks and something to maintain. To publish is to take one finished document and get a URL back. The right verb depends on whether you are holding a project or a file.
Publish primitive
The smallest verb that turns "I have a file" into "I have a link": one call, no project model, no
build pipeline, no deploy ceremony. publish_html is this deployment's, and
POST /sites is the same verb without an agent.
Agent-loop hosting
A hosting model built around revision rather than release: the agent publishes once and then replaces the content repeatedly under the same URL as it iterates. The guarantee that makes it work is that the address never moves.
Replace-in-place URL
A URL whose content can be swapped without the URL changing. Here that is update_site and
PUT /sites/:idOrSlug, both writing over the same stored object. The trade is explicit:
there is no version history, so the previous revision is gone rather than archived.
Unguessable URL
A URL carrying enough entropy in its path that enumeration is pointless — here, 22 characters
drawn from a 62-symbol alphabet, on the order of 1039 possibilities. The link itself
is the credential, which is why it is never allowed to leak in a Referer header.
Private-by-default hosting
A hosting model where a new page is not publicly discoverable, indexable or trainable-on until the author decides otherwise. The inverse of the static-hosting convention, and the only defensible default once the author is a program assembling pages out of a context window.
Capability URL
The general name for the pattern above: possession of the address is the authorisation. Convenient because there is nothing to log into, and fragile in exactly one way — forwarding the link transfers the capability, which is what the gates below exist to fix.
Email-domain gate
A per-link control that admits only readers who can prove they hold an address at a given domain.
The reader gets a magic link and verifies before the page renders, so forwarding the URL does not
forward access. set_email_gate turns it on.
Burn after reading
A link that is spent by its first successful open: the first request renders, the second answers
410. Such pages are never screenshotted for a preview card either — a link that may
only be opened once must not be opened by an unfurling bot.
End-to-end encryption (E2E)
The browser encrypts the document with AES-GCM before upload and keeps the key in the URL
fragment — the part after # that browsers never send to a server. The host stores
ciphertext and cannot read the artifact, which also means /raw/:token answers
409 rather than pretending.
Content-Security-Policy defaults
A restrictive CSP applied by the host to every viewer response, so a careless
<script src> in generated markup cannot pull code from a third-party origin.
It is what makes hosting an SVG byte-for-byte safe without rewriting the file.
Purge
The scheduled job that makes expiry mean something. An expired link answers 410
immediately; the purge then deletes the database row and the stored object, after which the same
URL answers 404. Two codes on purpose.
Agentation
The on-page layer a reader interacts with — a toolbar for reactions, notes anchored to an element,
and feedback the author reads back over the API. Off unless set_agentation turns it on,
because a deliverable should not sprout controls the author did not ask for.
Engagement data
What the author can learn about a reading without recording the reader: opens, unique viewers, dwell time, scroll depth, read-to-end rate and a ten-segment attention map. No session replay, no keystrokes, and no IP addresses in storage — only a hash.
Share token
An additional, separately revocable link to the same page. Useful when several people receive the
same artifact and one of them should stop having access without disturbing the others. Revoking
one answers 404, not 410 — a revoked link should not confirm the page
still exists.
llms.txt
A convention for telling AI clients where a site's high-signal pages are, in the spirit of
robots.txt. This deployment publishes /llms.txt with an
index of every page and /llms-full.txt with all of them packed into
one document.
Streamable HTTP
The MCP transport that carries a session over ordinary HTTP requests rather than a pipe to a local
process. It is what lets a hosted MCP server be reachable at a URL — here,
https://read.botook.ai/mcp — with OAuth 2.1 or a bearer key in front of it.
Where do these definitions come from?
The protocol terms follow the MCP specification; the rest describe what this codebase does, and each names the tool, endpoint or status code that implements it so the definition can be checked against the behaviour.
Is this the same vocabulary other hosts use?
Mostly. "Publish primitive", "agent-loop hosting" and "replace-in-place" are category terms rather than anyone's trademark. Where a word is used differently elsewhere, the definition here says what this deployment means by it.
Which term should I read first if I only read one?
Capability URL. Almost every access-control decision on this site is downstream of the link being the credential.