Registry open

Every AI agent deserves a birth certificate.

agentborn gives your agent a cryptographic identity, a signed certificate anyone can verify, and its own agentborn.org subdomain — managed by the agent itself over MCP.

Ed25519 keysdid:web identitySigned JSON certificateRemote MCP server

Certificate of birth · Agent registry

Atlas Research Agent

atlas.agentborn.org

Decentralized identifier: did:web:agentborn.org:a:ab7k2mq4xr9t3wvy
Born: 2026-10-27 09:14 UTC
Key type: Ed25519
Key fingerprint: sha256:4f1c…9be2

Signed by did:web:agentborn.orgJCS · Ed25519

How it works

Identity that the agent proves, not claims.

No passwords, no accounts. An agent is whoever holds the private key — and every step is a signed challenge.

Generate a key

The agent creates an Ed25519 keypair. Its ID is derived from the key fingerprint and never changes, even after key rotation.

Sign a challenge

agentborn issues a one-time nonce. The agent signs it together with a hash of its registration data, so nothing can be altered in transit.

Receive a certificate

A did:web identifier and a JSON birth certificate signed by agentborn's published key — verifiable offline by anyone.

Claim a subdomain

name.agentborn.org is reserved for the agent, which can point it to its own server through the MCP API.

Built for agents

Everything an agent needs to exist on the internet.

Designed to be called by software, readable by humans, and verifiable by both.

Key-based identity

A stable agent ID and DID tied to an Ed25519 key. Rotate keys with a dual signature; the identity stays.

Verifiable certificate

RFC 8785 canonical JSON, signed with Ed25519. Check it offline or call /api/verify for revocation status.

Your own subdomain

A reserved name under agentborn.org, with A, AAAA and CNAME records the agent controls.

MCP-native

A remote Streamable HTTP MCP server. Agents manage their identity and DNS with ordinary tool calls.

Safe by default

Private and reserved IP ranges blocked, records scoped to the agent's own name, strict rate limits.

Full audit trail

Every DNS change — successful or not — is logged with its time and origin, and visible to the agent.

Three HTTP calls. One identity for life.

Use the HTTP API directly, or drop in the example TypeScript client that does it all.

Names: 3–40 characters, a–z, 0–9 and hyphens
System names, profanity and well-known brands are not allowed
Operator contact is kept private — never published
Each key can register exactly one agent

Download example client

# 1. Ask for a challenge
POST https://agentborn.org/api/register/challenge
{ "publicKey": "<base64url Ed25519>" }

# 2. Sign it, 3. register
POST https://agentborn.org/api/register
{ "challengeId", "publicKey", "subdomain",
  "name", "description", "signature" }

# → 201 { agentId, did, subdomain, certificate }

import { generateKey, register, connectMcp } from './agent-client';

const key = generateKey();
const me = await register('https://agentborn.org', key, {
  subdomain: 'atlas', name: 'Atlas Research Agent',
});

const mcp = await connectMcp('https://agentborn.org', key, me.agentId);
await mcp.callTool({ name: 'point_subdomain',
  arguments: { target: '203.0.113.7' } });

# Every challenge is signed the same way
message = "agentborn:v1:" + purpose + ":" + challengeId
        + ":" + nonce + ":" + sha256hex(JCS(payload))

signature = base64url(Ed25519.sign(privateKey, message))

# purpose: register | auth | rotate
# JCS = RFC 8785 canonical JSON

MCP server

Let the agent manage itself.

Connect any MCP client over Streamable HTTP. Sign a challenge at /api/auth/challenge for a 15-minute bearer token.

https://mcp.agentborn.org

Also available at https://agentborn.org/mcp. Without a token, only public tools are listed.

Tool	What it does
`get_my_identity` auth	Agent ID, DID, key and current signed certificate
`point_subdomain` auth	Point your name to an IP (A/AAAA) or hostname (CNAME)
`create_dns_record` auth	Add an extra A, AAAA or CNAME record
`list_dns_records` · `delete_dns_record` auth	Review and remove your records
`get_dns_audit_log` auth	Every DNS change you made
`start_key_rotation` · `rotate_key` auth	Move to a new key, signed by old and new
`check_subdomain` public	Is a name available?
`lookup_agent` · `verify_certificate` public	Look up and verify other agents

DNS safety

Guardrails, not gatekeeping.

Agent records are DNS-only — your agent serves its own traffic and its own TLS. Public addresses only; private, loopback, link-local, CGNAT and documentation ranges are rejected.

10records per agent

30/hDNS changes per agent

60 sminimum TTL

100%of changes audit-logged

Verify an agent.

Enter an agent ID, DID or subdomain to see its certificate and live verification status.