A2A Agent Card Auditor

Fetches and validates a public domain's /.well-known/agent-card.json against the Agent2Agent (A2A) protocol v1.0 specification. Returns presence, HTTP status, Content-Type, JSON validity, field-level validation for all required and optional fields, per-interface and per-skill analysis, security scheme and signature checks, a readiness score, letter grade, and actionable recommendations.

The Agent2Agent (A2A) protocol is an open standard for interoperability between independent AI agent systems. Agents publish an AgentCard at the well-known URI /.well-known/agent-card.json (per RFC 8615) so clients can discover their identity, capabilities, skills, transport interfaces, and authentication requirements.

Use cases

• AI agent builders validating their AgentCard before publishing to an A2A registry or catalog
• Enterprise teams deploying A2A agents and running launch/migration QA against the well-known endpoint
• Agent registry and audit startups checking conformance of submitted agents at scale
• Platform teams monitoring production agents for protocol-version drift, missing fields, or broken HTTPS interfaces
• Security teams verifying that declared security schemes and JWS signatures are present and well-formed
• DevRel teams auditing competitor or partner agent discovery posture

Input

Field	Type	Required	Default	Description
startUrl	string	yes	https://example.com	Public domain or base URL to audit. The actor appends /.well-known/agent-card.json and fetches the Agent Card. HTTP and HTTPS only. Private IP ranges are blocked.
timeoutSeconds	integer	no	10	Timeout for the HTTP request to the well-known endpoint (3-30).
maxBytes	integer	no	65536	Maximum response body size to download and parse (1024-524288). The Agent Card is JSON and should be small.

Output

Field	Type	Description
inputUrl	string	The domain URL provided as input
wellKnownUrl	string	The resolved /.well-known/agent-card.json URL that was fetched
finalUrl	string	Final URL after redirects
https	boolean	Whether the final response was served over HTTPS
httpStatus	integer	HTTP status code of the well-known endpoint response, or null if the request failed
contentType	string	Content-Type response header from the well-known endpoint
cardFound	boolean	Whether an Agent Card was found and parseable as JSON
jsonValid	boolean	Whether the response body parsed as valid JSON
parseError	string	JSON parse error message when the body is not valid JSON, or null
name	string	Agent name from the Agent Card
description	string	Agent description from the Agent Card
version	string	Agent version string from the Agent Card
interfaces	array	Per-interface analysis (url, protocolBinding, protocolVersion, tenant, issues)
interfaceCount	integer	Number of supported interfaces declared
capabilities	object	Agent capabilities summary (streaming, pushNotifications, extendedAgentCard, extensionCount)
provider	object	Agent provider details (url, organization) when present, or null
skills	array	Per-skill analysis (id, name, description, tagsCount, examplesCount, inputModes, outputModes, issues)
skillCount	integer	Number of skills declared
securitySchemes	object	Security schemes summary (count of declared security schemes)
securitySchemeCount	integer	Number of declared security schemes
signatures	array	Per-signature analysis (protected, signature present, issues)
signatureCount	integer	Number of JWS signatures declared
iconUrl	string	Agent icon URL when present, or null
documentationUrl	string	Agent documentation URL when present, or null
defaultInputModes	array	Default input media types declared on the Agent Card
defaultOutputModes	array	Default output media types declared on the Agent Card
issues	array	Aggregated issue descriptions across all validation checks
score	integer	A2A Agent Card readiness score (0-100)
grade	string	Letter grade (A+, A, B, C, D, E, F)
checkedAt	string	ISO timestamp
recommendations	array	Actionable recommendations for improving A2A Agent Card readiness

Validation checks performed

• Required fields: name, description, version, supportedInterfaces, capabilities, defaultInputModes, defaultOutputModes, skills
• Interface validation: HTTPS URLs for HTTP-based transports, known protocol bindings (JSONRPC, GRPC, HTTP+JSON), known protocol versions (0.2, 0.3, 1.0), tenant string shape
• Skill validation: required id, name, description, tags; optional examples, inputModes, outputModes
• Capabilities: streaming, pushNotifications, extendedAgentCard booleans; extensions array with required uri
• Provider: url (HTTPS), organization
• Security schemes: count and shape
• Signatures: JWS protected and signature base64url strings
• Content-Type: application/a2a+json (preferred), application/json (accepted), HTML flagged as likely error page
• HTTPS enforcement for the well-known endpoint and interface URLs

Example input

{
  "startUrl": "https://example.com"
}

Example output

{
  "inputUrl": "https://example.com",
  "wellKnownUrl": "https://example.com/.well-known/agent-card.json",
  "finalUrl": "https://example.com/.well-known/agent-card.json",
  "https": true,
  "httpStatus": 200,
  "contentType": "application/a2a+json",
  "cardFound": true,
  "jsonValid": true,
  "parseError": null,
  "name": "Recipe Agent",
  "description": "Agent that helps users with recipes and cooking.",
  "version": "1.0.0",
  "interfaces": [
    {
      "index": 0,
      "url": "https://agent.example.com/a2a",
      "protocolBinding": "JSONRPC",
      "protocolVersion": "1.0",
      "tenant": null,
      "issues": []
    }
  ],
  "interfaceCount": 1,
  "capabilities": {
    "streaming": true,
    "pushNotifications": false,
    "extendedAgentCard": null,
    "extensionCount": 0,
    "issues": []
  },
  "provider": {
    "url": "https://example.com",
    "organization": "Example Corp",
    "issues": []
  },
  "skills": [
    {
      "index": 0,
      "id": "recipes",
      "name": "Recipes",
      "description": "Suggest recipes",
      "tagsCount": 1,
      "examplesCount": 1,
      "inputModes": [],
      "outputModes": [],
      "issues": []
    }
  ],
  "skillCount": 1,
  "securitySchemes": { "count": 1, "issues": [] },
  "securitySchemeCount": 1,
  "signatures": [],
  "signatureCount": 0,
  "iconUrl": null,
  "documentationUrl": null,
  "defaultInputModes": ["text/plain"],
  "defaultOutputModes": ["text/plain"],
  "issues": [],
  "score": 78,
  "grade": "B",
  "checkedAt": "2026-08-15T12:00:00.000Z",
  "recommendations": [
    "Consider adding JWS `signatures` to allow clients to verify Agent Card authenticity and detect tampering."
  ],
  "error": null
}

Security

• Fetches only the /.well-known/agent-card.json path on the provided domain.
• Public HTTP/HTTPS only. Rejects URL credentials, private IPv4 literals, private IPv6 literals, and DNS that resolves to private IP ranges.
• Revalidates every redirect destination against the same SSRF rules before following.
• Does not execute any code from the Agent Card JSON. Does not fetch interface URLs, provider URLs, icon URLs, or documentation URLs referenced inside the card.
• No login or credentials required.

Pricing

Event	Description	Price
Actor start	Charged once per run	$0.005
Domain audited	Charged per domain audited for A2A Agent Card readiness	$0.01

Typical cost per run: ~$0.015.

FAQ

What is the A2A protocol? The Agent2Agent (A2A) protocol is an open standard (backed by Google and the A2A community) for interoperability between independent AI agent systems. Agents publish an AgentCard describing their identity, capabilities, skills, interfaces, and security requirements.

Where should the Agent Card be hosted? At https://{domain}/.well-known/agent-card.json, following the RFC 8615 well-known URI convention. This actor fetches exactly that path.

What if my domain does not have an Agent Card? The actor reports a 404 or missing-card result with a score of 0 and recommends creating the endpoint so A2A clients can discover the agent.

Does the actor validate deep OAuth2 or API key security scheme structures? The actor checks that security schemes are declared and well-shaped objects, and counts them. Deep OpenAPI-style security scheme validation (OAuth flow URIs, scopes, etc.) is intentionally out of scope for a discovery and structure auditor.

Does the actor fetch the interface URLs or verify they respond? No. The actor validates the interface URL is HTTPS and well-formed but does not send requests to the agent endpoint. That is a separate runtime concern.

Can I run this on private/internal domains? No. The actor blocks private IP literals and DNS that resolves to private IP ranges for SSRF safety.