# A2A Agent Card Auditor (`phoenix2810/a2a-agent-card-auditor`) Actor Fetch and validate a public domain .well-known/agent-card.json against the A2A protocol v1.0 spec. - **URL**: https://apify.com/phoenix2810/a2a-agent-card-auditor.md - **Developed by:** [Sanskar Jaiswal](https://apify.com/phoenix2810) (community) - **Categories:** Developer tools, AI, Open source - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing Pay per usage This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-usage ## What's an Apify Actor? Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. - **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use). - **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`. - **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`. - **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`. - **Any other language** — the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## A2A Agent Card Auditor Fetches and validates a public domain's `/.well-known/agent-card.json` against the Agent2Agent (A2A) protocol v1.0 specification. Returns presence, HTTP status, Content-Type, JSON validity, field-level validation for all required and optional fields, per-interface and per-skill analysis, security scheme and signature checks, a readiness score, letter grade, and actionable recommendations. The Agent2Agent (A2A) protocol is an open standard for interoperability between independent AI agent systems. Agents publish an AgentCard at the well-known URI `/.well-known/agent-card.json` (per RFC 8615) so clients can discover their identity, capabilities, skills, transport interfaces, and authentication requirements. ### Use cases - AI agent builders validating their AgentCard before publishing to an A2A registry or catalog - Enterprise teams deploying A2A agents and running launch/migration QA against the well-known endpoint - Agent registry and audit startups checking conformance of submitted agents at scale - Platform teams monitoring production agents for protocol-version drift, missing fields, or broken HTTPS interfaces - Security teams verifying that declared security schemes and JWS signatures are present and well-formed - DevRel teams auditing competitor or partner agent discovery posture ### Input | Field | Type | Required | Default | Description | |-------|------|----------|---------|-------------| | startUrl | string | yes | `https://example.com` | Public domain or base URL to audit. The actor appends `/.well-known/agent-card.json` and fetches the Agent Card. HTTP and HTTPS only. Private IP ranges are blocked. | | timeoutSeconds | integer | no | 10 | Timeout for the HTTP request to the well-known endpoint (3-30). | | maxBytes | integer | no | 65536 | Maximum response body size to download and parse (1024-524288). The Agent Card is JSON and should be small. | ### Output | Field | Type | Description | |-------|------|-------------| | inputUrl | string | The domain URL provided as input | | wellKnownUrl | string | The resolved `/.well-known/agent-card.json` URL that was fetched | | finalUrl | string | Final URL after redirects | | https | boolean | Whether the final response was served over HTTPS | | httpStatus | integer | HTTP status code of the well-known endpoint response, or null if the request failed | | contentType | string | Content-Type response header from the well-known endpoint | | cardFound | boolean | Whether an Agent Card was found and parseable as JSON | | jsonValid | boolean | Whether the response body parsed as valid JSON | | parseError | string | JSON parse error message when the body is not valid JSON, or null | | name | string | Agent name from the Agent Card | | description | string | Agent description from the Agent Card | | version | string | Agent version string from the Agent Card | | interfaces | array | Per-interface analysis (url, protocolBinding, protocolVersion, tenant, issues) | | interfaceCount | integer | Number of supported interfaces declared | | capabilities | object | Agent capabilities summary (streaming, pushNotifications, extendedAgentCard, extensionCount) | | provider | object | Agent provider details (url, organization) when present, or null | | skills | array | Per-skill analysis (id, name, description, tagsCount, examplesCount, inputModes, outputModes, issues) | | skillCount | integer | Number of skills declared | | securitySchemes | object | Security schemes summary (count of declared security schemes) | | securitySchemeCount | integer | Number of declared security schemes | | signatures | array | Per-signature analysis (protected, signature present, issues) | | signatureCount | integer | Number of JWS signatures declared | | iconUrl | string | Agent icon URL when present, or null | | documentationUrl | string | Agent documentation URL when present, or null | | defaultInputModes | array | Default input media types declared on the Agent Card | | defaultOutputModes | array | Default output media types declared on the Agent Card | | issues | array | Aggregated issue descriptions across all validation checks | | score | integer | A2A Agent Card readiness score (0-100) | | grade | string | Letter grade (A+, A, B, C, D, E, F) | | checkedAt | string | ISO timestamp | | recommendations | array | Actionable recommendations for improving A2A Agent Card readiness | #### Validation checks performed - Required fields: name, description, version, supportedInterfaces, capabilities, defaultInputModes, defaultOutputModes, skills - Interface validation: HTTPS URLs for HTTP-based transports, known protocol bindings (JSONRPC, GRPC, HTTP+JSON), known protocol versions (0.2, 0.3, 1.0), tenant string shape - Skill validation: required id, name, description, tags; optional examples, inputModes, outputModes - Capabilities: streaming, pushNotifications, extendedAgentCard booleans; extensions array with required uri - Provider: url (HTTPS), organization - Security schemes: count and shape - Signatures: JWS protected and signature base64url strings - Content-Type: application/a2a+json (preferred), application/json (accepted), HTML flagged as likely error page - HTTPS enforcement for the well-known endpoint and interface URLs ### Example input ```json { "startUrl": "https://example.com" } ``` ### Example output ```json { "inputUrl": "https://example.com", "wellKnownUrl": "https://example.com/.well-known/agent-card.json", "finalUrl": "https://example.com/.well-known/agent-card.json", "https": true, "httpStatus": 200, "contentType": "application/a2a+json", "cardFound": true, "jsonValid": true, "parseError": null, "name": "Recipe Agent", "description": "Agent that helps users with recipes and cooking.", "version": "1.0.0", "interfaces": [ { "index": 0, "url": "https://agent.example.com/a2a", "protocolBinding": "JSONRPC", "protocolVersion": "1.0", "tenant": null, "issues": [] } ], "interfaceCount": 1, "capabilities": { "streaming": true, "pushNotifications": false, "extendedAgentCard": null, "extensionCount": 0, "issues": [] }, "provider": { "url": "https://example.com", "organization": "Example Corp", "issues": [] }, "skills": [ { "index": 0, "id": "recipes", "name": "Recipes", "description": "Suggest recipes", "tagsCount": 1, "examplesCount": 1, "inputModes": [], "outputModes": [], "issues": [] } ], "skillCount": 1, "securitySchemes": { "count": 1, "issues": [] }, "securitySchemeCount": 1, "signatures": [], "signatureCount": 0, "iconUrl": null, "documentationUrl": null, "defaultInputModes": ["text/plain"], "defaultOutputModes": ["text/plain"], "issues": [], "score": 78, "grade": "B", "checkedAt": "2026-08-15T12:00:00.000Z", "recommendations": [ "Consider adding JWS `signatures` to allow clients to verify Agent Card authenticity and detect tampering." ], "error": null } ``` ### Security - Fetches only the `/.well-known/agent-card.json` path on the provided domain. - Public HTTP/HTTPS only. Rejects URL credentials, private IPv4 literals, private IPv6 literals, and DNS that resolves to private IP ranges. - Revalidates every redirect destination against the same SSRF rules before following. - Does not execute any code from the Agent Card JSON. Does not fetch interface URLs, provider URLs, icon URLs, or documentation URLs referenced inside the card. - No login or credentials required. ### Pricing | Event | Description | Price | |-------|-------------|-------| | Actor start | Charged once per run | $0.005 | | Domain audited | Charged per domain audited for A2A Agent Card readiness | $0.01 | Typical cost per run: ~$0.015. ### FAQ **What is the A2A protocol?** The Agent2Agent (A2A) protocol is an open standard (backed by Google and the A2A community) for interoperability between independent AI agent systems. Agents publish an AgentCard describing their identity, capabilities, skills, interfaces, and security requirements. **Where should the Agent Card be hosted?** At `https://{domain}/.well-known/agent-card.json`, following the RFC 8615 well-known URI convention. This actor fetches exactly that path. **What if my domain does not have an Agent Card?** The actor reports a 404 or missing-card result with a score of 0 and recommends creating the endpoint so A2A clients can discover the agent. **Does the actor validate deep OAuth2 or API key security scheme structures?** The actor checks that security schemes are declared and well-shaped objects, and counts them. Deep OpenAPI-style security scheme validation (OAuth flow URIs, scopes, etc.) is intentionally out of scope for a discovery and structure auditor. **Does the actor fetch the interface URLs or verify they respond?** No. The actor validates the interface URL is HTTPS and well-formed but does not send requests to the agent endpoint. That is a separate runtime concern. **Can I run this on private/internal domains?** No. The actor blocks private IP literals and DNS that resolves to private IP ranges for SSRF safety. # Actor input Schema ## `startUrl` (type: `string`): Public domain or base URL to audit. The actor appends /.well-known/agent-card.json and fetches the A2A Agent Card. HTTP and HTTPS only. Private IP ranges are blocked. ## `timeoutSeconds` (type: `integer`): Timeout for the HTTP request to the well-known endpoint. ## `maxBytes` (type: `integer`): Maximum response body size to download and parse. The A2A Agent Card is JSON and should be small. ## Actor input object example ```json { "startUrl": "https://example.com", "timeoutSeconds": 10, "maxBytes": 65536 } ``` # Actor output Schema ## `results` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "startUrl": "https://example.com" }; // Run the Actor and wait for it to finish const run = await client.actor("phoenix2810/a2a-agent-card-auditor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "startUrl": "https://example.com" } # Run the Actor and wait for it to finish run = client.actor("phoenix2810/a2a-agent-card-auditor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}") for item in client.dataset(run.default_dataset_id).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "startUrl": "https://example.com" }' | apify call phoenix2810/a2a-agent-card-auditor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "type": "http", "url": "https://mcp.apify.com/?tools=fetch-actor-details,phoenix2810/a2a-agent-card-auditor" } } } ``` The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer ` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations). ## OpenAPI specification Download the OpenAPI definition: https://api.apify.com/v2/actors/WhFDf1wUTn1q7D0RN/builds/jy57BdeKr6LbcKJIu/openapi.json