Agent artifacts

GET https://api.peeve.ai/api/agent/{pk_…}/{artifact}

Four generated files describing what your product can do, for agents that fetch rather than connect:

Artifact	Format	For
`llms.txt`	`text/plain`	The capability and route index, following the llmstxt.org convention.
`AGENTS.md`	`text/markdown`	A human- and agent-readable operating guide, with the guardrails on each action.
`server-card.json`	`application/json`	An agent card — name, URL, tool summary.
`mcp.json`	`application/json`	MCP tool definitions, one per agent-safe capability.

Any other artifact name returns 404.

The key goes in the URL

The path segment is your publishable key.

curl https://api.peeve.ai/api/agent/pk_live_xxx/llms.txt

That is deliberate and safe: the publishable key already ships in your widget script tag, so it is public by construction. It scopes the request to your workspace without needing a header, which is what makes these fetchable by a crawler that only knows how to GET a URL.

A secret key in this position returns 404, and would be a serious leak — these URLs end up in crawler logs, referrers and shared links. Only ever use the pk_… key here.

Serve them at your own domain

Most people rewrite these onto their own domain so agents find them where they expect:

/llms.txt                     →  https://api.peeve.ai/api/agent/pk_live_xxx/llms.txt
/AGENTS.md                    →  https://api.peeve.ai/api/agent/pk_live_xxx/AGENTS.md
/.well-known/server-card.json →  https://api.peeve.ai/api/agent/pk_live_xxx/server-card.json
/.well-known/mcp.json         →  https://api.peeve.ai/api/agent/pk_live_xxx/mcp.json

module.exports = {
  async rewrites() {
    const base = `https://api.peeve.ai/api/agent/${process.env.NEXT_PUBLIC_PEEVE_PUBLISHABLE_KEY}`;
    return [
      { source: "/llms.txt", destination: `${base}/llms.txt` },
      { source: "/AGENTS.md", destination: `${base}/AGENTS.md` },
      { source: "/.well-known/server-card.json", destination: `${base}/server-card.json` },
      { source: "/.well-known/mcp.json", destination: `${base}/mcp.json` },
    ];
  },
};

location = /llms.txt {
  proxy_pass https://api.peeve.ai/api/agent/pk_live_xxx/llms.txt;
}
location = /.well-known/mcp.json {
  proxy_pass https://api.peeve.ai/api/agent/pk_live_xxx/mcp.json;
}

{
  "rewrites": [
    { "source": "/llms.txt", "destination": "https://api.peeve.ai/api/agent/pk_live_xxx/llms.txt" },
    { "source": "/AGENTS.md", "destination": "https://api.peeve.ai/api/agent/pk_live_xxx/AGENTS.md" },
    { "source": "/.well-known/server-card.json", "destination": "https://api.peeve.ai/api/agent/pk_live_xxx/server-card.json" },
    { "source": "/.well-known/mcp.json", "destination": "https://api.peeve.ai/api/agent/pk_live_xxx/mcp.json" }
  ]
}

What gets included

The same projection as the MCP server: a capability appears only when it is in the current production map, verified, marked agent-accessible, and not disabled. Draft, stale, broken, human-only and blocked capabilities never reach an agent surface. Routes are included too, excluding any marked broken. Everything is generated on each request from your product map. You never edit these files, and there is nothing to keep in sync.

Requires Growth or above. These endpoints check the same agent_write entitlement as the MCP server. On a lower plan, a disabled agent channel, or with the kill switch on, they return 404 with Agent access is not enabled for this workspace. — so a downgrade stops serving artifacts too.

Caching and CORS

Responses are cached for five minutes (Cache-Control: public, max-age=300) and served with Access-Control-Allow-Origin: *, so any client can fetch them. A workspace with no verified capabilities yet still returns a valid document — llms.txt says No verified capabilities yet, AGENTS.md says No verified, agent-accessible capabilities yet. You get an honest empty file, not an error.

Artifacts or MCP?

Use artifacts

For crawlers, search agents, and anything that discovers products by fetching well-known URLs. No connection, no protocol, cacheable.

Use MCP

For assistants a person actively uses — Claude, Cursor. Live, listable, auditable, and revocable per user.

Both project the same capabilities, and both are guide-only. Serving both is normal. See the artifact reference for the exact contents of each file.

Get started

Authentication

Widget

MCP server

Agent artifacts

Reference

Agent artifacts

The key goes in the URL

Serve them at your own domain

What gets included

Caching and CORS

Artifacts or MCP?

Use artifacts

Use MCP

​The key goes in the URL

​Serve them at your own domain

​What gets included

​Caching and CORS

​Artifacts or MCP?

Use artifacts

Use MCP

The key goes in the URL

Serve them at your own domain

What gets included

Caching and CORS

Artifacts or MCP?