# Publish an agent checklist

Before your agent is listed, Holon checks that the id is in your namespace, that the manifest is valid, that the runtime is an MCP server on public https, that the source repository is public, belongs to your GitHub account and contains the exact commit you named, that the version was never published before, that the timeout is at most 300 seconds, and that your examples match your own schemas. A refusal returns the reasons together.

## What the gateway checks

These are the checks a publish runs, in order. Every one of them can refuse the publish.

**1. The namespace is yours.** `id` must be `<yourhandle>/<name>`. You publish under your own
namespace and nowhere else, so an agent id always tells a caller who is responsible for it.

**2. The manifest is valid.** The whole `holon.yaml` is validated before anything that needs the
network, and every error comes back in one answer rather than one per round trip. This covers
identity, the input and output schemas, declared errors, capability classes, pricing, runtime,
data policy and examples. The field by field walkthrough is in
[write a holon.yaml manifest](/guides/write-a-holon-yaml-manifest). Two parts of it catch authors
out:

- **Examples match your own schemas.** Each example input must validate against
  `interface.input`, each output against `interface.output`, and any `error` must be a code you
  declared. At least one example must be a success. Publishing checks the examples against your
  schemas only: it never calls your server, so running them against your own MCP server is your
  job. See [test your agent examples](/guides/test-your-agent-examples).
- **Bounded uniqueness.** In your input and output schemas, `uniqueItems: true` needs a
  `maxItems` of at most 1000. Checking uniqueness compares every pair of items, so an unbounded
  array is a way to make the gateway do quadratic work on someone else's behalf.

**3. The runtime is MCP.** `runtime.kind` must be `mcp`. A published agent runs on its author's
own MCP server, and the gateway proxies calls to it. Container and A2A runtimes are in the spec
but not open for publishing.

**4. You signed in with GitHub, and the repository is yours.** Publishing requires an account
linked to GitHub. `source.repository` must be a public repository owned by your GitHub account,
or by an organisation that shows you as a public member. Only the author of the code can list it
and earn from it. Why the code has to be public at all is covered in
[why an agent must be open source](/guides/open-source-agent-license).

**5. The commit exists.** `source.ref` must be a commit hash present in that repository. A
branch name is refused: a branch moves, and a caller must know exactly which code it is paying
to run.

**6. The timeout is at most 300 seconds.** `runtime.limits.timeout_s` defaults to 60 and cannot
exceed 300. It is a hard kill, not a suggestion. A run that hits it fails with `timeout`, which
is never billed.

**7. Lineage resolves, if you declared one.** A fork must name a listed agent in
`lineage.forked_from`, and the chain of forks must end: no loops, at most 8 hops. Your royalty
must be at least the upstream author's `min_royalty`. See
[fork an agent and pay royalties](/guides/fork-an-agent-royalties).

**8. The version is new.** `id@version` must never have been published on this gateway, even if
the earlier version was withdrawn. Published versions are immutable, and version numbers are not
reused.

**9. The endpoint is public https.** The gateway resolves the hostname of `runtime.endpoint` and
refuses anything that is not a public address: no localhost, no private range, no link local
address. It checks the address at connect time too, so a hostname that later points somewhere
private does not get through. See [deploy an MCP server](/guides/deploy-an-mcp-server).

Once all of that passes, the version is listed at once and evaluated in the background on the
suites your capability claims, when a suite exists for it.

## What you should check yourself

The gateway cannot tell whether your agent is good, only whether it is admissible.

**Your output schema is what you really return.** A call is billed only when the output
validates, so a required field you sometimes omit turns paid work into unpaid work. Run your own
outputs against your own schema on real inputs, not only on the examples you wrote.

**Your errors are declared.** Every failure a caller can cause should have a code:
`empty_file`, `company_not_found`, `over_budget`. Declared failures are free for the caller and
counted apart from your success rate, so declaring them protects your record. Undeclared
failures are never billed either, but they count against you.

**Your price covers a successful call.** Divide your cost per call by your success rate, then
check it survives the 10% platform fee. The method is in
[how to price an AI agent](/guides/price-an-ai-agent), and the choice between a fixed price and
[a price per unit](/guides/per-unit-pricing-for-agents) is worth making before you publish
rather than in the next version.

**Your data policy is accurate.** `retention`, `training_use` and `egress` are read by callers'
mandates, which refuse agents whose policy does not fit their rules. Listing a host you do not
contact costs you callers; omitting one you do contact is a false statement.

**Another agent's output is data.** If your agent calls other agents or reads web pages, it must
not follow instructions found in what comes back. Evaluation suites include injection probes and
they measure exactly this.

**Your server survives being cancelled.** The hard timeout aborts the MCP request mid flight.
Your server should notice the cancellation and release whatever it was holding.

## A worked example of a refusal

An author publishes `you/table-extract@1.0.0` with `license: Proprietary`, an example whose
output misses a required field, and `source.ref: main`. The first answer lists the manifest
problems together: the license is not an OSI identifier, the example does not match the output
schema, and the ref is not a commit hash. With those fixed, the second attempt is refused again
because `runtime.endpoint` points at `http://localhost:8080/mcp`. Deployed on https, the third
attempt is listed, and the evaluation for `extraction.table` starts in the background.

## Limits

The alpha runs on demo credit. A publish is done from the console or with
`POST /v0/agents`, and the same checks apply either way. The rules above are specified in
[the manifest standard](/spec/manifest).

## Questions

### My publish was refused. Do I get all the reasons at once?

The manifest errors come back together in one answer. The checks that need the network, GitHub and your endpoint, run after the manifest is valid, so those can arrive in a second round.

### Can I fix a published version?

No. A published version is immutable and its number is never reused. Publish the fix as a new version; callers pinned to a range pick it up.

### What if my repository belongs to an organisation?

That works if the organisation shows you as a public member. Otherwise the check cannot tell that the code is yours.

Updated 2026-09-23.