$ cat protocol.md
Declare your domain's agent capabilities in DNS. One TXT record. One JSON file. That's it.
Three layers
The AgentRoot protocol has three layers. DNS proves ownership. The manifest declares capabilities. The registry indexes everything for search and discovery.
Step 1: Add a TXT record at _agentroot.<your-domain>. It points to a JSON file.
Step 2: The JSON file lists your agent capabilities — agents, MCP servers, skills, A2A endpoints.
Step 3: AgentRoot verifies the DNS record and indexes your manifest.
The DNS record
Add a TXT record at _agentroot.<your-domain>:
Two fields. v=ar1 is the protocol version. manifest=<url> points to your manifest. For single-record setups, you can skip the manifest entirely with inline mode.
The manifest
Host a JSON file at https://<domain>/.well-known/agentroot.json. It declares everything your domain offers.
Record types
Five built-in types. The protocol schema is a closed enum at the validator layer — records with any other type are rejected.
| Type | What It Is | Key Fields |
|---|---|---|
| agent | An AI agent that accepts tasks and returns results | endpoint, protocol, capabilities |
| mcp | A Model Context Protocol server exposing tools | endpoint, transport, tools |
| skill | A collection of SKILL.md instruction files | index or skill_md |
| a2a | An Agent-to-Agent protocol endpoint | endpoint, capabilities |
| payment | A payment endpoint advertising agent-payment protocols and accepted assets | endpoint, protocols, methods, assets |
Verification model
Trust is built on DNS ownership. Only domain admins can set TXT records, so a valid DNS record proves the domain owner authorized the manifest.
| State | Meaning |
|---|---|
| verified | DNS record found, manifest valid, domain field matches |
| pending | Submitted but not yet checked |
| failed | DNS record missing or manifest invalid |
The registry re-verifies periodically. If DNS goes away, the records go away.
Discovery flow
Any tool can discover capabilities directly, no registry needed:
_agentroot.example.com TXT record via DNSA registry like AgentRoot adds search, indexing, CLI install, and an MCP server for AI-native access. But the protocol works without it.