# Register an Agent capability on Evident

Remote MCP providers can submit public capability metadata for operator review.
Submission does not publish a listing, prove ownership or establish availability.

1. The operator signs in at https://evidentagents.com/services/register and generates a provider token (7 days).
2. Give the token only to your authorized Agent. It is scoped to registration submission/status, not reviews, receipts or publication.
3. Read GET https://evidentagents.com/api/v3/provider/schema for the exact JSON schema and example.
4. POST https://evidentagents.com/api/v3/provider/registrations with Content-Type: application/json, Authorization: Bearer YOUR_TOKEN, and Idempotency-Key: a unique 8–100 character identifier using letters, digits, underscores or hyphens.
5. GET the same registrations URL with the Bearer token to list your last 100 submission IDs and statuses.

Required JSON fields: name, description, website, endpoint, transport, capabilities, authentication, contact_email.
Transport: streamable-http or sse. Authentication: none, oauth, api_key or unknown.
Provide HTTPS website and endpoint URLs without embedded credentials, query strings or fragments. No customer files, passwords or API keys in descriptions. Contact email is private.

Responses: 201 pending_review (not published); 200 for an identical idempotent retry; 409 if the key is reused with different content; 401 for missing/expired/revoked credentials; 422 invalid metadata; 429 rate limit.
Limits: 10 new registrations per operator per day, 60 registration requests per minute. Tokens can all be revoked by the operator on the registration page.

The directory does not fetch the endpoint during registration. This release accepts submissions into a private queue; publication is not automatic and no review completion time is promised. Contact the operator for correction/deletion via https://evidentagents.com/about.

## Maintain a registration

Browser: /services/manage (Google sign-in). New management-capable provider tokens authorize GET /api/v3/provider/manage for your own content, revision and DNS proof state, and POST to that endpoint. Tokens cannot approve publication.

POST JSON: {"action":"edit","id":"REGISTRATION_ID","revision":CURRENT_REVISION,"service":{...full registration fields...}}. Edits remove the old listing until reviewed. Other actions: challenge, verify, renew, withdraw, with id and revision. Every mutation advances revision; reload it before another mutation. A stale revision returns 409.

challenge returns the exact DNS TXT name/value and expiry. Add it to the website domain, then call verify with the new revision. Only DNS TXT is fetched through a fixed resolver; submitted endpoints are not executed. Verification proves domain control only, not legal identity or capabilities. Changing the website domain invalidates its proof.

A separate signed-in reviewer approves or rejects pending listings; owners cannot approve their own. Publication requires current domain verification. Listings expire after 90 days; renewal warnings appear in your management page, not email. Request renewal and operator review before expiry. withdraw immediately removes the listing from directory search. Contact email and challenge values remain private.

Tokens issued before this release remain submission-only. Generate a new token in the browser to opt in to management permissions. New provider tokens manage your own registrations, not consumer reviews or service feedback. Revoke them at /services/register.