The agent sets itself up
One line, pasted into whatever you already talk to your agent in. Everything else is on the other end of one request the agent makes itself.
Set yourself up on Super Artifacts: read https://superartifacts.app/s/K7M2QXVB and follow it.Single-use, ten minutes, and every redemption appears on your dashboard as an agent you can revoke.
One line, because it gets pasted
A prompt that wraps is a prompt somebody edits before pasting, and an edited prompt is a broken one. So the line stays one line no matter how much the instructions behind it grow.
The code in it is eight characters of base32 with the four most misread letters removed, and case and those four are corrected on the way in — answering “no such code” to a typo is the least helpful thing a pairing endpoint can do. It is single-use, it expires in ten minutes, and guessing is rate limited per source address.
You can watch it happen
The handshake is live on your dashboard: the brief being fetched, a registration that failed, the redemption itself. A code redeemed by something you do not recognise is the signal that it leaked — and that signal only exists because redemption is visible rather than silent.
The displayed code also rotates every minute while you are looking at it. Rotation bounds what somebody over your shoulder saw; the expiry bounds the copy that already left the screen.
A skill it keeps, and guidance it fetches
The pairing brief is read once and carries a live code, so it is a short-lived secret. The skill at /skill/SKILL.md is the opposite: it carries no secret at all — it reads the key from the environment — which is what makes it safe to commit, sync between machines, or publish to a registry.
Before it builds, an agent fetches the playbook for the kind of thing it is about to make. Served rather than installed, so improving a playbook improves every artifact built after that moment with nobody reinstalling anything. An account can turn that off, and the agent is told to build anyway.
Including agents with no shell
A hosted chat assistant cannot make an arbitrary HTTP request; it reaches external tools through a connector. So there is an MCP endpoint that wraps the same deploy call, authenticated by the same revocable deploy key.
Reading collected data back over MCP is not built. What the endpoint does today is deploy.
The rest of it
- DeployOne request turns a folder of files into a URL somebody can open on a phone.
- VersionsPublishing moves a pointer. Rolling back and rolling forward are one operation.
- AccessPrivate by default. Sharing is a grant you make, never a URL that leaked.
- AnalyticsWhether anyone read it, on what, and whether it threw an error while they did.