A2A agent card — agent readiness

Why an agent cares

A card is how another agent discovers what this site's agent can do and how to reach it. Crawlers already probe for the path, so a card published in the pre-1.0 shape is a live present-but-wrong surface.

Adoption

Early pilots. Named early adopters exist, behind flags or trials. Nothing has been independently measured yet. For this one in particular, standard inside enterprise agent platforms, still rare on the open web.

Direction of travel: ▲ rising, as at 2026-07-28.

GA inside Microsoft, AWS and Google agent platforms with 150+ supporting organisations, but no verifiably identified public open-web card publisher. Crawler logs show agents requesting the path anyway.

Adopter	Depth	Evidence
Microsoft (Copilot Studio, Azure AI Foundry)	`default-on`	linuxfoundation.org
AWS (Bedrock AgentCore Runtime)	`production`	linuxfoundation.org
Google (Gemini Enterprise)	`production`	a2a-protocol.org
SAP, Salesforce, ServiceNow, Cisco, IBM	`announced`	a2a-protocol.org

What we check

Absence is never a finding. Every check below runs only when this technology is detected, so a site that has not adopted this is not assessed on it and appears in no report. 10 of these 12 can fail it. In Lumar these appear once per site, in the site-wide results of each crawl.

Check	Severity	Raises	On whose authority
Agent Card Invalid JSON	high	conformance, usability	specification: A2A protocol specification
Supporting documents: A2A protocol specification Required by A2A protocol specification. Bad: the served body isn't a JSON object, so agents can't read the card at all. Fix: serve the agent card as a single valid JSON object.
Agent Card Missing Fields	high	conformance, usability	specification: A2A protocol specification
Supporting documents: A2A protocol specification Required by A2A protocol specification. Bad: the card omits an A2A-required field (name, description, version, capabilities, default input/output modes, skills) or declares no coherent endpoint (a supportedInterfaces entry with url + protocolBinding + protocolVersion, or the v0.3 top-level trio). Fix: fill in every required field per the A2A spec.
Agent Card Endpoint Not A2A	high	usability	specification: A2A protocol specification
Supporting documents: A2A protocol specification Related guidance in A2A protocol specification. Bad: every interface the card advertises answered HTTP 404 or 410 at the message:send route its binding requires, so no A2A client can use the card however well-formed it is. Fix: point the interface at a working A2A endpoint, e.g. "url": "https://example.com/a2a" serving POST /a2a/message:send, or withdraw the interface. A 401 or 403 is not this (authorization may be required), and neither is a timeout.
Agent Card Insecure Interface	high	usability, security (CWE-319)	specification: A2A protocol specification
Supporting documents: A2A protocol specification Related guidance in A2A protocol specification. Provisional security check; precision has not yet been measured. Bad: an agent interface URL in the card uses plain http://, so every task, message and credential sent to it travels unencrypted; A2A requires HTTPS for production. Fix: serve the interface over https and list it as "url": "https://agent.example.com/a2a/v1". An advertised agent communication path lacks confidentiality. OWASP Agentic ASI07 (2026) — Insecure Inter-Agent Communication OWASP API API8 (2023) — Security Misconfiguration ASVS V12.2.1 (5.0.0) — TLS for external HTTP services Runtime message integrity and authorization are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.
Agent Card Insecure Security Scheme URL	high	usability, security (CWE-319)	specification: A2A protocol specification, The OAuth 2.0 Authorization Framework, OpenID Connect Discovery 1.0, OAuth 2.0 Device Authorization Grant
Supporting documents: A2A protocol specification, The OAuth 2.0 Authorization Framework, OpenID Connect Discovery 1.0, OAuth 2.0 Device Authorization Grant Related guidance in A2A protocol specification, The OAuth 2.0 Authorization Framework, OpenID Connect Discovery 1.0 and OAuth 2.0 Device Authorization Grant. Provisional security check; precision has not yet been measured. Bad: an OAuth or OpenID Connect URL in securitySchemes (authorization, token, refresh, metadata or discovery) uses plain http://, so credentials and tokens travel unencrypted; OAuth requires TLS. Fix: change each to its https:// address, e.g. "tokenUrl": "https://auth.example.com/token". An advertised HTTP destination permits unencrypted communication. OWASP API API8 (2023) — Security Misconfiguration ASVS V12.2.1 (5.0.0) — TLS for external HTTP services Only advertised transport configuration is observed; API deployment security is not fully assessed. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.
Agent Card Deprecated OAuth Flow	high	usability, security (CWE-522)	specification: A2A protocol specification, Best Current Practice for OAuth 2.0 Security
Supporting documents: A2A protocol specification, Best Current Practice for OAuth 2.0 Security Related guidance in A2A protocol specification and Best Current Practice for OAuth 2.0 Security. Provisional security check; precision has not yet been measured. Bad: a security scheme offers the implicit or password OAuth flow, which A2A deprecates and current OAuth security guidance forbids (password) or advises against (implicit), because they expose the user's password or the access token. Fix: offer authorizationCode with PKCE, or deviceCode, instead. The advertised authentication configuration weakens identity protection. OWASP API API2 (2023) — Broken Authentication ASVS V10.4.4 (5.0.0) — Exclude implicit and password grants No authenticated transaction or bypass is attempted. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.
Agent Card Invalid Signature	high	conformance, usability	specification: A2A protocol specification
Supporting documents: A2A protocol specification Required by A2A protocol specification. Bad: the card's "signatures" field is present but structurally wrong (not an array, a protected header that isn't base64url JSON with alg + kid, or a non-base64url signature), so verifiers reject it. Fix: sign the card as the A2A specification describes, or remove the field (unsigned cards are fine).
A2A Known Test Key	medium	usability, security (CWE-1394)	Lumar readiness bar, beyond HTTP Message Signatures, CFRG Elliptic Curves for JOSE, JSON Web Key, JSON Web Signature, Examples of Protecting Content Using JOSE
Supporting documents: HTTP Message Signatures, CFRG Elliptic Curves for JOSE, JSON Web Key, JSON Web Signature, Examples of Protecting Content Using JOSE Lumar readiness bar: no specification requires this. An explicitly declared Agent Card signing key matches a published RFC test key whose private half is public. Exposed identity material or weak authentication can enable identity misuse. OWASP Agentic ASI03 (2026) — Identity & Privilege Abuse OWASP API API2 (2023) — Broken Authentication ASVS V13.3.2 (5.0.0) — Restrict access to secrets Actual credential use, permissions and privilege abuse are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.
agentCard HTTPS Downgrade	medium	usability, security (CWE-319)	Lumar readiness bar
An advertised HTTP destination permits unencrypted communication. OWASP API API8 (2023) — Security Misconfiguration ASVS V12.2.1 (5.0.0) — TLS for external HTTP services Only advertised transport configuration is observed; API deployment security is not fully assessed. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.
A2A Internal Endpoint	medium	usability, security (CWE-200)	Lumar readiness bar
Public discovery metadata reveals internal service addresses. OWASP API API8 (2023) — Security Misconfiguration Reachability, authorization and SSRF exploitation are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.
Agent Card Endpoint Unverified	informational	nothing	Lumar readiness bar, beyond A2A protocol specification
Supporting documents: A2A protocol specification Lumar readiness bar: no specification requires this. Informational (does not affect agentCardValid): the card was read, but no advertised interface answered an A2A message:send the way a conforming one does — one could not be reached, demanded authorization, or answered something we will not read as conformance. Not convicted is not the same as validated, so the endpoint half of the verdict is withheld.
A2A Signing Keys Unassessed	coverage note	nothing	our own coverage

Examples

Both run through the same checks as a live scan: the first passes, the second is flagged.

correctjson

{
  "name": "Recipe Agent",
  "description": "An A2A agent that helps users with recipes and cooking.",
  "version": "1.0.0",
  "capabilities": {
    "streaming": true
  },
  "defaultInputModes": ["text/plain"],
  "defaultOutputModes": ["text/plain", "application/json"],
  "skills": [
    {
      "id": "find-recipe",
      "name": "Find a recipe",
      "description": "Finds recipes by ingredient.",
      "tags": ["recipes", "cooking"]
    }
  ],
  "supportedInterfaces": [
    {
      "url": "https://recipes.example/a2a/v1",
      "protocolBinding": "JSONRPC",
      "protocolVersion": "1.0"
    }
  ],
  "securitySchemes": {
    "recipesOAuth": {
      "oauth2SecurityScheme": {
        "oauth2MetadataUrl": "https://auth.recipes.example/.well-known/oauth-authorization-server",
        "flows": {
          "authorizationCode": {
            "authorizationUrl": "https://auth.recipes.example/authorize",
            "tokenUrl": "https://auth.recipes.example/token",
            "scopes": {
              "recipes:read": "Read recipes"
            },
            "pkceRequired": true
          }
        }
      }
    }
  }
}

present but wrongjson

{
  "name": "Broken Agent",
  "description": "Served but missing A2A-required fields (no version/capabilities/modes/skills, no coherent endpoint), with a malformed signature, a plain-http endpoint, and a legacy OAuth scheme that offers the password flow over http.",
  "signatures": [
    {
      "protected": "eyJhbGciOiJFUzI1NiJ9"
    }
  ],
  "url": "http://broken-agent.example/a2a",
  "securitySchemes": {
    "legacy": {
      "type": "oauth2",
      "flows": {
        "password": {
          "tokenUrl": "http://auth.broken-agent.example/token",
          "scopes": {}
        }
      }
    }
  }
}

Specifications

Document	Revision	Kind
RFC 9421 — HTTP Message Signatures	Published RFC	specification
RFC 8037 — CFRG Elliptic Curves for JOSE	Published RFC	specification
RFC 7517 — JSON Web Key	Published RFC	specification
RFC 7515 — JSON Web Signature	Published RFC	specification
RFC 7520 — Examples of Protecting Content Using JOSE	Published RFC	specification
A2A protocol specification	Version 1.0.1	specification
RFC 6749 — The OAuth 2.0 Authorization Framework	Published RFC	specification
RFC 9700 — Best Current Practice for OAuth 2.0 Security	Published RFC	specification
OpenID Connect Discovery 1.0	Version 1.0	specification
RFC 8628 — OAuth 2.0 Device Authorization Grant	Published RFC	specification

Last re-read against the published documents: 2026-10-05.