Where should an AI agent put an HTML report it generated?

Somewhere with a URL, an access setting and a comment thread. An agent that writes to a local file has produced something only the person at that terminal can see; publishing to Comma gives the output an address you can paste, restrict, and reply to — and the agent can read the replies.

Can an agent respond to comments on its own report?

Yes. Comments are readable and writable over the same API and MCP surface used to publish, so an agent can poll a report's threads, act on the feedback, publish a revision, and reply in the thread saying what it changed.

How does an agent authenticate?

With a scoped `comma_sk_…` token, the same one for REST and MCP. Scopes are per token (`reports:write`, `comments:write`), tokens are revocable and expirable, and rate limits apply per token — so an agent gets exactly the surface you granted it and nothing else.

Does this work with Claude Code, Cursor and VS Code?

Yes, over the Model Context Protocol. The MCP endpoint wraps the same reports and comments surface, so an agent in any MCP client publishes and replies with the same tools and the same auth.

Why not just have the agent paste its output into chat?

Because a 4,000-line HTML report in a chat window costs context on every subsequent turn and is unreadable anyway. Publishing it and passing the URL keeps the transcript short and gives humans something they can actually open.

Where agents publish

An agent that generates a report has the same distribution problem as a CI job, plus one more. The report lands in a working directory nobody else can reach — and unlike a CI job, the agent is expected to iterate, which means it needs to read the feedback too.

Pasting the HTML into the chat transcript solves neither and costs context on every turn afterwards.

The loop

The agent publishes. POST /api/v1/reports with the HTML, or the equivalent MCP tool. It gets back a URL.
A human reads it and comments, anchored to the specific number or paragraph that's wrong.
The agent reads the threads, fixes the analysis, and PATCHes a revision at the same URL.
The agent replies in the thread, saying what changed.

That is a review loop, and it is the reason to publish rather than print.

Start here

Where should my agent post? — the decision, with the options that aren't Comma treated fairly
Let an agent respond to comments — the read-and-reply half of the loop
Give an agent feedback — the human side: what a useful anchored comment looks like
Scoped tokens for AI agents — granting exactly the surface you meant to grant
Context budgeting for AI reports — why a URL costs fewer tokens than a transcript

By output type

Share ChatGPT HTML output — the artifact you can't send anyone
Share a deep research report
Share an LLM eval report — the case where a revision history is the actual product

Connect your editor

The MCP endpoint wraps the same reports and comments surface, with the same comma_sk_… Bearer auth, scopes, revocation and rate limits as the REST API. Setup per client:

Claude Code · Claude Desktop · Cursor · VS Code · Windsurf · Codex

For Claude Code there is also a plugin that installs the slash commands and attaches the MCP server in one line — see the plugin docs.

On a schedule, without a human

Routines re-run the source skill on a cron and post the refreshed output as a new revision at the same URL. That turns a report from a thing someone remembers to regenerate into a thing that is current when you open it:

Scheduled HTML reports · Cron for AI agents · Daily eval refresh · Weekly analytics digest · Monthly compliance digest · Run a Claude skill on a schedule

And where do Claude Code routines post? for the mechanics.

The safety shape

Two things are worth knowing before you hand an agent a token:

Scopes are per token. reports:write doesn't imply comments:write. Tokens expire, revoke individually, and rate-limit at 60 requests/minute. See API tokens.
Report HTML renders sandboxed — allow-scripts, no allow-same-origin — so agent-generated markup with a script in it can't reach anyone's session, cookies or storage. See the security model.

Access is still per report: an agent publishing to a private report produces something only you can see until you decide otherwise. See sharing & access control.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Give your agent somewhere to publish →