agentic‑readiness docs
/
Scan at scale Blog Build one › Run a scan ›
Menu

Scan at scaleSites with a broken A2A agent card

Sites with a broken A2A agent card

A site-wide report: one row per host, over the agent_card rows the crawl emitted.

What this report returns

An A2A agent card (/.well-known/agent-card.json) is a site's published identity for its agent: who it is, what it can do, and how to reach it.

A row appears here when any of these is wrong, worst first:

  • Invalid JSONThe served body isn't a JSON object, so agents can't read the card at all.Fix Serve the agent card as a single valid JSON object.
  • Missing FieldsThe card omits an A2A-required field (name, description, version, capabilities, default input/output modes, skills) or declares no coherent endpoint (a supportedInterfaces entry with url + protocolBinding + protocolVersion, or the v0.3 top-level trio).Fix Fill in every required field per the A2A spec.
  • Endpoint Not A2AEvery interface the card advertises answered HTTP 404 or 410 at the message:send route its binding requires, so no A2A client can use the card however well-formed it is.Fix Point the interface at a working A2A endpoint, e.g. "url": "https://example.com/a2a" serving POST /a2a/message:send, or withdraw the interface. A 401 or 403 is not this (authorization may be required), and neither is a timeout.
  • Insecure InterfaceAn agent interface URL in the card uses plain http://, so every task, message and credential sent to it travels unencrypted; A2A requires HTTPS for production.Fix Serve the interface over https and list it as "url": "https://agent.example.com/a2a/v1".
  • Insecure Security Scheme URLAn OAuth or OpenID Connect URL in securitySchemes (authorization, token, refresh, metadata or discovery) uses plain http://, so credentials and tokens travel unencrypted; OAuth requires TLS.Fix Change each to its https:// address, e.g. "tokenUrl": "https://auth.example.com/token".
  • Deprecated OAuth FlowA security scheme offers the implicit or password OAuth flow, which A2A deprecates and current OAuth security guidance forbids (password) or advises against (implicit), because they expose the user's password or the access token.Fix Offer authorizationCode with PKCE, or deviceCode, instead.
  • Invalid SignatureThe card's "signatures" field is present but structurally wrong (not an array, a protected header that isn't base64url JSON with alg + kid, or a non-base64url signature), so verifiers reject it.Fix Sign the card as the A2A specification describes, or remove the field (unsigned cards are fine).

Security checks are provisional; precision has not yet been measured. A clean row is not a security assessment.

The columns it shows

Every defect this technology can carry is a column in the grid, worst first, so nothing is hidden behind a filter you have to know to apply.

  • Hosthost
  • Agent Card ValidagentCardValid
  • A2A Agent Card Conformance Issue DetectedagentCardConformanceIssueDetected
  • A2A Agent Card Security Risk DetectedagentCardSecurityRiskDetected
  • Agent Card FindingsagentCardFindings
  • Agent Card Agent NameagentCardAgentName
  • Agent Card Missing Field NamesagentCardMissingFieldNames
  • Agent Card Endpoint URLsagentCardEndpointUrls
  • Agent Card Invalid JSONagentCardInvalidJson
  • Agent Card Missing FieldsagentCardMissingFields
  • Agent Card Endpoint Not A2AagentCardEndpointNotA2A
  • Agent Card Insecure InterfaceagentCardInsecureInterface
  • Agent Card Insecure Security Scheme URLagentCardInsecureSecuritySchemeUrl
  • Agent Card Deprecated OAuth FlowagentCardDeprecatedOAuthFlow
  • Agent Card Invalid SignatureagentCardInvalidSignature
  • agentCard HTTPS DowngradeagentCardInsecureRedirect
  • A2A Internal EndpointagentCardInternalEndpoint
  • A2A Known Test KeyagentCardTestKey
  • A2A Signing Keys UnassessedagentCardPartiallyAssessed
  • Agent Card Endpoint UnverifiedagentCardEndpointUnverified
  • Ruleset VersionrulesetVersion
  • Security Check StatussecurityCheckStatus
  • Related Security FrameworkssecurityFrameworkReferences

About A2A agent card

Declares an agent this site operates, for agent-to-agent work.

Read how A2A agent card is checked, including the specification it is validated against and a worked correct and broken example.

Running it

This report comes with Agentic Readiness in Lumar and appears on every crawl of any project that has it turned on. See the whole set, or check a single URL with the scanner on this site, which runs the same code with no account.

Get Lumar pricing