Skip to content

DISC-013Find

A2A agent card published

Whether your shop publishes an Agent2Agent (A2A) agent card at /.well-known/agent-card.json.

What we check

We look for an A2A agent card at /.well-known/agent-card.json, the standard path in the Agent2Agent Protocol 1.0.0 (release v1.0.1, 2026-05-28). The card must be a JSON object with the fields A2A marks as required: name, description, version, capabilities, defaultInputModes, defaultOutputModes, skills and supportedInterfaces. An older A2A 0.3 card, which has a top-level "url" instead of supportedInterfaces, is also accepted and labelled as the 0.3 shape. We do not request the older pre-0.3 agent.json path.

Why it matters

If your shop runs its own agent, for example a shopping assistant or a customer-service agent, other AI agents can hand tasks to it over A2A, such as asking about a product or the status of an order. The agent card is how a shopper's agent learns that your agent exists, what it can do and how to reach it. If you run no such agent, there is nothing to publish.

How we check

We make one request for /.well-known/agent-card.json. PASS: a JSON object with every required field present and not empty, served as application/json or another +json media type. The result also reports how many skills the card lists. WARN: the body is not JSON, is not an object, lacks required fields (we name up to four of them), or is served under another media type. FAIL: the path returns 404 or 410, or returns your site's ordinary HTML page. SKIPPED: bot management answered, your robots.txt disallows the path for our crawler, or the server returned a status such as 429 or a 5xx.

How to fix it

  1. Publish a card only if your shop runs an agent that other agents can call over A2A. Put it at /.well-known/agent-card.json.
  2. Include name, description, version, capabilities, defaultInputModes, defaultOutputModes, skills (each with id, name, description and tags) and supportedInterfaces (url, protocolBinding, protocolVersion).
  3. Serve it as application/json with Cache-Control and an ETag.
  4. If your card still uses the A2A 0.3 top-level "url", move to supportedInterfaces when you next update it.

What good looks like

{
  "name": "Example Shop Assistant",
  "description": "Answers product and order questions for Example Shop.",
  "version": "1.0.0",
  "capabilities": { "streaming": true },
  "defaultInputModes": ["text/plain"],
  "defaultOutputModes": ["text/plain", "application/json"],
  "skills": [
    { "id": "order-status", "name": "Order status",
      "description": "Looks up an order by number and email.", "tags": ["orders"] }
  ],
  "supportedInterfaces": [
    { "url": "https://example.com/a2a/v1", "protocolBinding": "JSONRPC", "protocolVersion": "1.0" }
  ]
}

Sources