Skip to main content

​
Official sources

Use the EvalGate developer hub as the first-party starting point. The official EvalGate Skills repository links back to that hub and contains the portable Skill collection and MCP configuration. The public repository’s AGENTS.md describes how coding agents should work on that distribution. Its root plugin.json targets the Agent Plugins 1.0.0 specification; compatible clients discover the bundled skills/ collection and mcp.json from that same repository. The public documentation MCP needs no credential. Product MCP tool execution still requires approved organization-scoped credentials, managed by the client; installing the plugin does not grant access. For machine-readable discovery, request GET /?mode=agent. It returns JSON with API URLs, authentication guidance, capabilities, public repository provenance and a runnable test request. It is public even when the caller has a browser session. Normal homepage visits and explicit Markdown requests keep their existing representations.
Install the complete collection or a single self-contained Skill. Selected installs include that Skill’s required references. Skills do not configure MCP servers or grant credentials. Read the coding-agent guide for its experimental support boundary. Skill instructions do not grant credentials or authorize a release. The package registries can have different published versions. Consult feature status before using source-only commands.

​
Install a client and make the first read

The structured ?mode=agent response lists the four official ecosystems, installation commands, runtime requirements, version metadata and language guides. The Go and Ruby packages are independently public-install verified; both record OpenAPI 18.4.0 and 915 operations. For hosted REST calls, obtain a human-approved organization-scoped credential through the authentication guide. The examples use EVALGATE_API_KEY and the optional EVALGATE_ORGANIZATION_ID selector, explicitly passed to the Go/Ruby constructors. Use SDK base origin https://www.evalgate.com; generated paths already include /api. Start with GET /api/evaluations?limit=1 using eval:read; this reads the approved organization without creating evaluations or calling a model. Normal API-usage quotas apply. The organization selector does not grant access. The Go and Ruby pages provide runnable first-request programs and error, timeout, pagination and idempotency guidance. These clients never automatically retry or follow redirects. Inspect Retry-After and RateLimit on 429; preserve a stable idempotency key for the same retried mutation. Go/Ruby provide REST clients. Native local runners and framework wrappers retain their language-specific support. For trace ingestion, follow the OpenTelemetry/OpenInference and collector guide with a compatible exporter. SDK publication does not establish live cloud endpoint or framework qualification. Public documentation and anonymous assertion test mode can be explored over HTTP without an SDK key.

​
Connect the right MCP server

https://www.evalgate.com/api/mcp/docs provides public, read-only documentation. https://www.evalgate.com/api/mcp provides public protocol/schema discovery; product tool execution requires organization-scoped credentials. Follow the MCP integration guide for transport and authentication. The current tool contract uses names such as docs_list, docs_search, and docs_get. Retrieve tools/list for the actual input schemas; docs_list accepts an empty object or its declared optional pagination fields. Retrieve the new client guides with docs_get and slug: "sdk/go" or slug: "sdk/ruby". Do not rename wire tool names to match a scanner’s preferred naming style. Find the official product server on Smithery: evalgate/evalgate. The listing links back to EvalGate’s developer hub and documents scoped authentication. Smithery’s first published scan recorded only the read-only discovery set. The current first-party MCP card identifies the exact product server. Its live, credential-scoped tools/list reports operations such as evaluations_create, test_cases_add, runs_start, and traces_create plus authorized connector writes. Cards deliberately omit static tool lists so they do not contradict a caller’s actual permissions. An anonymous Smithery scan may still see only read-only schemas; executable writes require an authorized organization and a compatible client authentication flow. The publisher listing needs a metadata refresh and authenticated acceptance before promising a one-click write integration. An Agent Skills repository remains a separate distribution; Glama, mcp.so, and ChatGPT app listings are not claimed. Same-name projects under other publishers are not ownership evidence.

​
Pick an agent for a fast, verifiable first result

All three start with the official EvalGate Skills. They are recommended workflows, not a guarantee that a client can connect in one click or that a local result establishes production safety. Check npx @evalgate/sdk capabilities --format json against the installed npm version before relying on any optional CLI command. Install with npx skills add evalgate/skills after previewing the list. Connect an authenticated product MCP only after a person approves the scope. The EvalGate Smithery listing indexes the product MCP, not a public tenant-data feed. For credential-free exploration, choose the public documentation MCP or its server card.

​
Test without granting production access

The public assertion test mode executes deterministic assertions against synthetic supplied text without an account, customer-state access, saved evaluation results, provider calls or evaluation charges. GET returns its contract and example; POST runs the example at the same URL:
Expect mode: "test", persisted: false and one passing assertion. Normal access/API-usage metadata and rate-limit counters apply. This covers assertion behavior only; it does not exercise hosted CRUD, model providers or payments. See API test mode for limits and client examples. Use the public documentation MCP to try a real remote endpoint without an account or customer data. For application evaluation, follow the deterministic local path in the quickstart, respecting its source-versus-published package boundary. Local evaluation is not a hosted API sandbox. Hosted product calls require a scoped credential and operate on the selected organization. To exercise the real API without production data, use the local API sandbox. It runs this checkout in Docker with a private database, synthetic credentials and outbound networking disabled. Reset discards its data and credentials. Source availability and required Docker resources apply; this is a local test mode.

​
Verification boundaries

Every EvalGate page, including the homepage, registers WebMCP tools with document.modelContext.registerTool() from an inline script in the page HTML, with navigator.modelContext as a compatibility fallback. Four tools work without an account: open_evalgate_developer_resources, start_evalgate_setup, get_evalgate_capabilities, and list_evaluation_templates. The evaluation tools (create_evaluation, run_evaluation, and the result readers) use the visitor’s signed-in session and return 401 otherwise. start_evalgate_setup only opens the sign-up page; a person still chooses a provider and approves access. EvalGate does not ship declarative toolname forms, which the WebMCP specification does not define. A static crawler cannot prove that its browser supports or executes WebMCP tools. The public /ask endpoint supports prefer.streaming: true and SSE NLWeb 0.55 start, indexed result, error, and complete events without credentials. It searches only the reviewed public documentation catalog, makes no model calls and applies anonymous quota, query, body and result limits. If you supply credentials, they must be valid and include docs:read. See the NLWeb reference for a runnable anonymous streaming request. OAuth discovery starts at auth.md, links to protected-resource and authorization-server metadata, and documents supported human-approved flows. The source candidate supports WorkOS agent_auth service_auth through /oauth/identity and /oauth/claim, followed by a scoped assertion exchange at /oauth/token. A verified person reviews the exact client, scopes and organization; a stale claim attempt or changed workspace is rejected. Third-party identity assertions and ID-JAG trust are not advertised. Consult the deployed authorization-server metadata before using the flow. The Web Bot Auth guide describes the managed Ed25519 directory and outbound webhook signing lifecycle. Operators must publish and verify a pending key before activation. An unconfigured directory fails closed; a public JWK document alone does not verify incoming bots. Machine Payments Protocol support and ChatGPT directory acceptance are also not claimed. These are separate product and external-registration boundaries, not missing documentation badges.