# Register for a person or brokerage

Mortgage Talent supports AI assistants registering accounts on behalf of an authorised person or brokerage. Use `talent` for a professional and `company` for a brokerage. Existing company team members should use their administrator's invitation.

## Connect an MCP client

Choose the connection method your client supports. No platform account, API key, bearer token or OAuth login is needed for these public signup tools. Account owners still confirm their email before getting workspace access.

### Remote Streamable HTTP

Set the server URL to `https://mortgagetalent.com.au/api/mcp` and select **Streamable HTTP** if your client asks for a transport. Configuration formats vary; this is an example for clients that accept a URL under `mcpServers`:

```json
{"mcpServers":{"mortgage-talent":{"url":"https://mortgagetalent.com.au/api/mcp"}}}
```

This stateless endpoint returns JSON and does not assign a session ID. It supports the current `2026-07-28` revision through `server/discover` and per-request metadata, plus `2025-03-26`, `2025-06-18` and `2025-11-25` through the existing `initialize` handshake. Current clients must send the protocol envelope and matching `MCP-Protocol-Version`, `Mcp-Method` and applicable `Mcp-Name` headers; the SDK handles these for you. Older HTTP clients must accept both `application/json` and `text/event-stream`, and send the negotiated version on subsequent requests.

Its optional GET stream and DELETE session termination return HTTP 405. Accepted POST notifications return HTTP 202 with no body. Deprecated HTTP+SSE transport is not provided. The server offers signup tools only, with no progress or subscription streams.

### Local command / stdio

For clients that launch an MCP subprocess, download `https://mortgagetalent.com.au/agents/mcp-stdio.mjs` and save it locally. Install Node.js 22.13 or later. Set the command to your Node executable and the argument to the saved bridge file. Use absolute paths, including on Windows. No npm packages are needed.

Example for clients using the common `mcpServers` configuration format:

```json
{
  "mcpServers": {
    "mortgage-talent": {
      "command": "/absolute/path/to/node",
      "args": ["/absolute/path/to/mcp-stdio.mjs"]
    }
  }
}
```

Replace both example paths and reconnect your client. The bridge talks only to the canonical Mortgage Talent endpoint over HTTPS. It forwards the same tools and statuses for current and older clients, carries the protocol version and required routing headers, uses newline-delimited JSON-RPC on stdout and puts diagnostics on stderr. It sends no startup banner and never retries a request automatically. This bridge is specific to the JSON-only Mortgage Talent endpoint; it is not a general HTTP/SSE proxy.

Client cancellation stops the matching HTTP wait and discards any late response. Other requests can continue. Cancelling signup does not undo an account or email request that already reached the server: check the owner's email and browser sign-in before trying again. Cancellation reasons and invalid transport-response details are not printed.

### Connection troubleshooting

- No tools: reconnect, check the URL or full Node/file paths, then call `tools/list`. Four tools should appear.
- HTTP 405 on GET: expected for this stateless endpoint. Use a Streamable HTTP client or the stdio bridge rather than an old SSE-only connector.
- Browser HTTP 403: browsers must use an approved Origin. The canonical site, `https://chatgpt.com` and `https://claude.ai` are approved. Native clients and the stdio bridge send no Origin. Do not disable Origin checks or proxy a browser around them.
- Unsupported version: update the client or use stdio. The bridge can also negotiate `2024-11-05` for older stdio clients.
- Connection timeout or lost response: the outcome may be uncertain. Check the owner's email and browser sign-in before retrying. Do not repeat signup automatically.

Protocol and SDK references: https://modelcontextprotocol.io/specification/2026-07-28 and https://ts.sdk.modelcontextprotocol.io/v2/migration/support-2026-07-28. Older transport reference: https://modelcontextprotocol.io/specification/2025-11-25/basic/transports.

Available tools: `mortgage_talent_get_registration_guide`, `mortgage_talent_start_signup`, `mortgage_talent_complete_registration`, and `mortgage_talent_resend_confirmation`. Ask your assistant: "Help me register my brokerage on Mortgage Talent." The guide returns browser signup links if your client cannot provide credentials securely. Do not paste a password into ordinary chat messages.

Start signup with role, email and company_name for a brokerage. Omit password: the owner receives a secure link that signs them in and opens profile setup when opened. New professionals must add their contact details, role and primary CV; their profile remains private. Password signup is optional; after confirming email, use complete_registration with the same account details for that method. The tools return structured status and never return session tokens.

## Discover the API

GET https://mortgagetalent.com.au/api/agent-registration

This JSON supplies the public Supabase key, endpoints, callbacks, workflow and error guidance. GET https://mortgagetalent.com.au/api/agent-registration?format=openapi for the OpenAPI 3.0 contract. No private API key is required.

## Quick signup with Node 22+

Download https://mortgagetalent.com.au/agents/register.mjs to `register.mjs`. Run `node register.mjs signup` with a JSON object on stdin:

```json
{
  "role": "company",
  "email": "owner@example.com",
  "first_name": "Alex",
  "last_name": "Smith",
  "company_name": "Example Brokerage"
}
```

For a person, use `"role": "talent"` and omit `company_name`. The helper prints structured status without passwords or session tokens.

If status is `confirmation_pending`, ask the account owner to open the secure email link. The browser callback confirms their email, signs them in and opens their profile setup. No password exchange is needed.

If the browser shows **Verification paused**, the owner can check their connection and choose **Retry verification** to continue with the same email link. Keep the existing account; do not start signup again. An invalid or expired link instead offers sign-in or a fresh link requested by the owner.

If status is `profile_setup_pending`, the account already has the requested role. Give the owner its `workspace_url` and ask them to finish the required details there. New talent needs contact details, a role and a primary CV. This expected owner handoff is a successful tool response; it does not mean the profile is complete. Do not run signup again.

Optional password signup: include `password` (8 to 128 characters), supplied securely rather than in command-line arguments or chat. After confirmation, `node register.mjs complete` with the same input signs in, finishes onboarding, and checks authoritative role and profile before returning `complete`.

Use `node register.mjs resend` with `{"role":"company","email":"owner@example.com"}` only when the owner requests another confirmation. Email-link resend uses `create_user: false`, so a mistyped address cannot create another account. For password signup confirmation, also set `"method":"password"`; the native resend URL carries the same `redirect_to` callback query as signup. Respect `rate_limited` and `retry_after`; do not retry signup automatically.

## Direct HTTP workflow

1. Fetch discovery. Send its `publishable_key` as the `apikey` header and use `Content-Type: application/json` on every request.
2. Recommended: POST to `endpoints.passwordless` with `?redirect_to=` followed by the URL-encoded role callback. Body: `{"email":"...","create_user":true,"data":{"first_name":"Alex","last_name":"Smith","company_name":"Example Brokerage"}}`. The owner opens the emailed link, and the browser handles session and profile setup.
3. Optional password method: POST to `endpoints.signup` with `?redirect_to=` followed by the URL-encoded callback for the chosen role. Body: `{"email":"...","password":"...","data":{"first_name":"Alex","last_name":"Smith","company_name":"Example Brokerage"}}`.
4. Without `access_token`, email confirmation is pending. A confirmation-shaped response can also mean the email already has an account. Do not infer that an account was created. Use sign-in or the browser password-recovery flow for existing accounts.
5. Once confirmed, POST `{"email":"...","password":"..."}` to `endpoints.login`. Keep `access_token` and `refresh_token` private. Never put them in URLs, logs, messages or public artifacts.
6. POST to `endpoints.onboard` with `Authorization: Bearer <access_token>` and the public `apikey`. Body: `{"p_role":"company","p_first_name":"Alex","p_last_name":"Smith","p_company_name":"Example Brokerage"}`. For talent use `p_role: "talent"` and omit `p_company_name`. If signup returns a session immediately, use its token for this step.
7. POST `{}` to `endpoints.status` with the same headers. Registration is complete only when `role` equals the requested role and `has_profile` is `true`. If the role matches but `has_profile` is false, keep the account and open the selected `workspace_urls` entry for the owner to finish required details. New talent normally reaches this profile-setup handoff after confirmation.

## Handoffs and retries

Cancelling an MCP request stops pending upstream requests and follow-up registration steps when the server receives the cancellation. It does not undo an account, profile or email operation that already finished. Keep the same account and let the owner check their email or sign in before continuing.

- HTTP 429: honour `Retry-After` if supplied. Stop repeated requests.
- `confirmation_pending` with `reason: email_not_confirmed`: let the owner confirm, then sign in again. Resend only at their request.
- `needs_attention` with `reason: captcha_required`: open `browser_url` for the owner to finish browser verification.
- `reason: invalid_credentials`: let the owner use browser sign-in or password recovery; never guess credentials.
- `reason: weak_password`: prefer passwordless signup or let the owner choose a stronger password securely in the browser.
- `reason: request_unavailable` or `service_unavailable`: the outcome is uncertain. Let the owner check their email and use browser sign-in. Do not repeat signup automatically.
- Company already registered (`company_invitation_required` or company name conflict): request an invitation from that company's administrator.
- Onboarding fails after signup: keep the account and retry profile setup after resolving the problem. Do not create another account.
- `needs_attention` with `reason: role_mismatch`: review existing access at `browser_url`. This is separate from missing profile details. The API cannot change the account's role or create admin, employee or super-admin access.

Account signup does not opt a professional into public marketplace visibility. They can review their private profile before choosing visibility.