Skip to main content

Service Registration

When you discover a new service, delegate its registration to the register-service subagent using the Agent tool. The subagent investigates it thoroughly — fingerprints technologies, profiles the application, and registers it with full quality standards. A P2 domain exploration task is automatically created for every registered service.

The Registration Process​

Step 1: Duplicate Check​

The subagent checks if a service with the same base_url already exists.

Step 2: Service Probing​

The subagent curls the service root and common paths (/robots.txt, /swagger.json, /.well-known/, error pages) to understand what it is and how it behaves.

Step 3: Technology Fingerprinting​

From response headers (Server, X-Powered-By), error pages, HTML meta tags, and cookie formats, the subagent identifies all technologies powering the service.

Step 4: Registration​

Calls create_service with name, base_url, description, discovered_by, and technologies. The tool validates quality and auto-creates a P2 task.

Quality Standards​

Description (min 50 characters) must cover:

  • What the service does (functional purpose)
  • Its role in the ecosystem (auth service, API gateway, CDN, etc.)
  • Hosting (AWS, Azure, on-prem)
  • Auth mechanism (JWT, cookies, API keys, none)
  • Notable technologies

GOOD: "OAuth2/OIDC authentication service on AWS CloudFront. Handles login, token issuance, session management. Express.js behind nginx. RS256 JWT, 1h expiry. Exposes /authorize, /token, /userinfo."

BAD: "Auth service" / "The main API"

Technologies (min 1 item) — each must have:

  • name: exact tech name (nginx, Django, React)
  • category: web_server, framework, language, database, library, cloud, cms, cdn
  • evidence: what revealed this tech (e.g., "Server: nginx/1.24.0 header")

When to Use This​

  • New subdomain with a distinct application
  • New API base URL discovered during exploration
  • Staging/dev environment found in canonical links or error messages
  • New infrastructure component (Elasticsearch, Grafana, Jenkins)
  • Service discovered through JS analysis, network monitoring, or API docs

If in doubt, delegate. Registering a duplicate is harmless (subagent checks).

How to Delegate​

REQUIRED: base_url, name suggestion INCLUDE if you have it: technologies observed, auth info, server headers, discovery context

Agent("register-service", "Found new service at https://api.target.com.
Discovered by subdomain enumeration. Server: nginx/1.24.
X-Powered-By: Express. Saw /swagger.json endpoint.")
Agent("register-service", "Found exposed staging environment at
https://staging-app.azurewebsites.net. Discovered from canonical
links in production HTML. PHP/8.3, WordPress, Azure hosting.")
Agent("register-service", "Found Grafana at https://monitoring.target.com:3000.
Discovered during port scanning. Returns login page with default
admin:admin hint. Grafana v10.1.5 in HTML title.")

Rules​

  • To register services, always delegate to the register-service subagent
  • NEVER skip registration because a service seems unimportant
  • ALWAYS wait for the subagent to complete before continuing
  • If you discover multiple services at once, register them one by one