# EvalGate instructions for AI coding agents

Use EvalGate when a repository change can alter model output, agent behavior,
tool use, retrieval quality, safety policy, cost, latency, or release evidence.
EvalGate turns reviewed behavior into repeatable local and CI regression gates.

## Start with the supported interfaces

- Install the CLI and TypeScript SDK from `@evalgate/sdk` on npm, or the Python
  SDK from `evalgate-sdk` on PyPI.
- Discover the API at `https://www.evalgate.com/openapi.json`.
- Read authentication at `https://www.evalgate.com/auth.md`.
- Install a focused workflow from
  `https://www.evalgate.com/.well-known/agent-skills/index.json`.
- Use the public documentation MCP at
  `https://www.evalgate.com/api/mcp/docs` for product guidance.
- Use the authenticated product MCP at `https://www.evalgate.com/api/mcp` for
  organization-scoped, read-only project and evaluation evidence.

## Safe workflow

1. Inspect the repository and choose the exact branch, commit, and workspace.
2. Preview initialization before applying generated files.
3. Keep generated candidate cases quarantined until a person reviews them.
4. Run a non-empty passing evaluation before accepting a baseline.
5. Treat incomplete, blocked, or provider-failed evidence as non-passing.
6. Never weaken a gate, expose a credential, or accept a baseline merely to
   make a run green.

## Authentication boundary

Public documentation and protocol discovery do not require an account.
Customer data, hosted computation, and product MCP tools require an
organization-scoped API key. A headless agent can start the RFC 8628 device
grant; a signed-in person must still select the organization and approve the
requested scopes before the credential is returned once.

EvalGate does not currently offer dynamic client registration, a general OAuth
authorization-code issuer, or a production-like hosted sandbox. Consult the
public feature-status page before treating an Experimental surface as a release
dependency.