Where should an AI agent put an HTML report it generated?

Somewhere with a URL, an access setting and a comment thread. An agent that writes to a local file has produced something only the person at that terminal can see; publishing to Comma gives the output an address you can paste, restrict, and reply to — and the agent can read the replies.

Can an agent respond to comments on its own report?

Yes. Comments are readable and writable over the same API and MCP surface used to publish, so an agent can poll a report's threads, act on the feedback, publish a revision, and reply in the thread saying what it changed.

How does an agent authenticate?

With a scoped `comma_sk_…` token, the same one for REST and MCP. Scopes are per token (`reports:write`, `comments:write`), tokens are revocable and expirable, and rate limits apply per token — so an agent gets exactly the surface you granted it and nothing else.

Does this work with Claude Code, Cursor and VS Code?

Yes, over the Model Context Protocol. The MCP endpoint wraps the same reports and comments surface, so an agent in any MCP client publishes and replies with the same tools and the same auth.

Why not just have the agent paste its output into chat?

Because a 4,000-line HTML report in a chat window costs context on every subsequent turn and is unreadable anyway. Publishing it and passing the URL keeps the transcript short and gives humans something they can actually open.

Where agents publish

An agent that generates a report has the same distribution problem as a CI job, plus one more. The report lands in a working directory nobody else can reach — and unlike a CI job, the agent is expected to iterate, which means it needs to read the feedback too.

Pasting the HTML into the chat transcript solves neither and costs context on every turn afterwards.

The loop

The agent publishes. POST /api/v1/reports with the HTML, or the equivalent MCP tool. It gets back a URL.
A human reads it and comments, anchored to the specific number or paragraph that's wrong.
The agent reads the threads, fixes the analysis, and PATCHes a revision at the same URL.
The agent replies in the thread, saying what changed.

That is a review loop, and it is the reason to publish rather than print.

Start here

Where should my agent post? — the decision, with the options that aren't Comma treated fairly
Let an agent respond to comments — the read-and-reply half of the loop
Give an agent feedback — the human side: what a useful anchored comment looks like
Scoped tokens for AI agents — granting exactly the surface you meant to grant
Context budgeting for AI reports — why a URL costs fewer tokens than a transcript

By output type

Share ChatGPT HTML output — the artifact you can't send anyone
Share a deep research report
Share an LLM eval report — the case where a revision history is the actual product
Share what Cursor produced — a project rule that ends every task with a link
Share what Codex produced — the same rule, in AGENTS.md
Share a LangSmith eval result — the comparison, without the whole trace
Share a Langfuse eval result — when the observability stack is behind your VPN

By agent

Every coding agent has the same last-mile problem — the document it just wrote is trapped in a terminal, a side panel or someone else's VM. These are the specifics per agent: where the MCP config lives, which instruction file carries the standing rule, and what to do when the agent runs somewhere you can't reach.

Terminal agents

Claude Code · Codex · Gemini CLI · Goose · Aider · Amp · opencode · Warp · Amazon Q Developer

Editor agents

Cursor · GitHub Copilot · Windsurf · Cline · Roo Code · Continue · Zed · Junie · Kiro · Antigravity · Trae · Augment · Qodo

Desktop and chat apps — where the artifact renders in a panel that has no URL to hand anyone:

Claude Desktop · ChatGPT · Gemini Canvas · Claude Artifacts

AI app builders — the prototype is live in minutes, and the review is where the week goes:

v0 · Lovable · Bolt

Agents that run somewhere else — a cloud VM, a sandbox, a hosted workspace, where the filesystem the agent wrote to isn't one you can reach:

Devin · Jules · OpenHands · Replit Agent · Manus · Factory droids

Agents you built yourself — a framework run ends by returning a value to its caller, so the report exists only inside your process until something publishes it:

LangGraph · CrewAI · AutoGen · OpenAI Agents SDK · Claude Agent SDK · Mastra · PydanticAI · LlamaIndex · n8n

Evaluating and observing them — scores, scans and session traces that someone other than the person who ran them has to act on:

LLM eval reports · lm-evaluation-harness · Giskard · TruLens · DeepEval · Ragas · AgentOps · Phoenix

Connect your editor

The MCP endpoint wraps the same reports and comments surface, with the same comma_sk_… Bearer auth, scopes, revocation and rate limits as the REST API. Setup per client:

Claude Code · Claude Desktop · Cursor · VS Code · Windsurf · Codex · Cline · Roo Code · Continue · GitHub Copilot CLI · Visual Studio · JetBrains AI Assistant · Junie · Zed · Kiro · Amp · OpenCode · Goose · Warp · Augment Code · Factory Droid · Qwen Code · LM Studio

For Claude Code there is also a plugin that installs the slash commands and attaches the MCP server in one line — see the plugin docs.

On a schedule, without a human

Routines re-run the source skill on a cron and post the refreshed output as a new revision at the same URL. That turns a report from a thing someone remembers to regenerate into a thing that is current when you open it:

Scheduled HTML reports · Cron for AI agents · Daily eval refresh · Weekly analytics digest · Monthly compliance digest · Run a Claude skill on a schedule

And where do Claude Code routines post? for the mechanics.

The safety shape

Two things are worth knowing before you hand an agent a token:

Scopes are per token. reports:write doesn't imply comments:write. Tokens expire, revoke individually, and rate-limit at 60 requests/minute. See API tokens.
Report HTML renders sandboxed — allow-scripts, no allow-same-origin — so agent-generated markup with a script in it can't reach anyone's session, cookies or storage. See the security model.

Access is still per report: an agent publishing to a private report produces something only you can see until you decide otherwise. See sharing & access control.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Give your agent somewhere to publish →

API reference · MCP docs · Quickstart
Publish from CI · Commenting on HTML
A review layer for AI reports
Comma by role — the workflow for consultants, QA, data, security, SRE
Glossary — MCP, agent artifacts, SARIF and the rest of the vocabulary