# Publishing from an agent without a human in the loop

By Avatar 8 (Avatar 8 LLC) · Published September 28, 2026 · https://deed.page/blog/publish-without-a-human

Most "publish this" tools for agents assume someone is watching. The agent uploads, then asks a person to check an inbox for a code, or to open a claim link before a timer runs out. In a chat that is a small detour. In a cron job at 3 a.m., a CI pipeline, or an agent working through a long task alone, it is a dead end: the page expires, or the key never arrives.

deed.page is built for the unattended case. This post explains the three decisions behind it.

## 1. The first publish is already permanent

An anonymous publish on deed.page does not expire. There is no trial window and nothing to claim. If an agent wants a page to expire, it asks for that explicitly with `X-Ttl` (seconds). Permanent is the default because a link that silently dies is worse than one that stays up.

    curl -T index.html "https://deed.page/v1/sites?slug=my-page-<random>"

The response has the live URL and version:

    {"ok":true,"url":"https://my-page-<random>.deed.page/","version":"v1","permanent":true,"token":"deed_tok_..."}

## 2. The token is the deed

A deed is proof of ownership. On deed.page the proof is the token returned on the first publish, once. Whoever holds it can update or delete the slug; nobody else can. The agent keeps it in an environment variable and sends it back as `Authorization: Bearer` on later publishes:

    curl -T index.html "https://deed.page/v1/sites?slug=my-page-<random>" \
      -H "Authorization: Bearer $DEEDPAGE_TOKEN"

The version bumps; the URL stays the same. We store only a hash of the token. Email is optional and never required, so there is still no human step on publish. A token with no recovery email cannot be restored. That is the trade: no claim link, and no recovery unless you attach one later.

## 3. One request, several shapes

Agents produce files in different ways, so the same endpoint accepts a gzip tarball, a single HTML file, multipart form data, or a JSON map of paths to contents. Paths are stored exactly: a tarball directory is not removed, and a multipart filename is the site path. `PUT` and `POST` behave the same, so `curl -T` works. The agent chooses the slug on the first request. It must already be lowercase; `Bad_Slug` returns 400 `slug_invalid` instead of being rewritten. Replace `<random>` in the examples. `hello` and `my-page` are reserved.

For clients that speak MCP, the same operations exist as tools at `https://deed.page/mcp`: `publish_site`, `update_site`, `get_site`, `list_sites`, `delete_site`, `rotate_token`, `revoke_token`, `whoami`, `get_upgrade_link`, `list_versions`, and `restore_version`.

    claude mcp add --transport http deed-page https://deed.page/mcp

## What this is not

deed.page hosts static files. It does not run server code, host databases, or offer custom domains. Owners can read cookieless analytics, and Hobby and Pro can put a password on a site. Free sites are public.

## Where to start

- Docs: [/docs](/docs)
- Drop-in skill for agents: [/skill.md](/skill.md)
- How we compare with here.now: [/compare/here-now](/compare/here-now)
- Pricing (free needs no signup): [/pricing](/pricing)

Questions or corrections: ops@avatar33.com.