# Sites with a broken A2A agent card

A site-wide report: one row per host, over the agent\_card rows the crawl emitted.

## What this report returns

An A2A agent card (`/.well-known/agent-card.json`) is a site's published identity for its agent: who it is, what it can do, and how to reach it.

A row appears here when any of these is wrong, worst first:

-   **Invalid JSON**The served body isn't a JSON object, so agents can't read the card at all.**Fix** Serve the agent card as a single valid JSON object.
-   **Missing Fields**The card omits an A2A-required field (name, description, version, capabilities, default input/output modes, skills) or declares no coherent endpoint (a `supportedInterfaces` entry with url + `protocolBinding` + `protocolVersion`, or the v0.3 top-level trio).**Fix** Fill in every required field per the A2A spec.
-   **Endpoint Not A2A**Every interface the card advertises answered HTTP 404 or 410 at the message:send route its binding requires, so no A2A client can use the card however well-formed it is.**Fix** Point the interface at a working A2A endpoint, e.g. `"url": "https://example.com/a2a"` serving POST `/a2a/message`:send, or withdraw the interface. A 401 or 403 is not this (authorization may be required), and neither is a timeout.
-   **Insecure Interface**An agent interface URL in the card uses plain http://, so every task, message and credential sent to it travels unencrypted; A2A requires HTTPS for production.**Fix** Serve the interface over https and list it as `"url": "https://agent.example.com/a2a/v1"`.
-   **Insecure Security Scheme URL**An OAuth or OpenID Connect URL in `securitySchemes` (authorization, token, refresh, metadata or discovery) uses plain http://, so credentials and tokens travel unencrypted; OAuth requires TLS.**Fix** Change each to its https:// address, e.g. `"tokenUrl": "https://auth.example.com/token"`.
-   **Deprecated OAuth Flow**A security scheme offers the implicit or password OAuth flow, which A2A deprecates and current OAuth security guidance forbids (password) or advises against (implicit), because they expose the user's password or the access token.**Fix** Offer `authorizationCode` with PKCE, or `deviceCode`, instead.
-   **Invalid Signature**The card's `"signatures"` field is present but structurally wrong (not an array, a protected header that isn't base64url JSON with alg + kid, or a non-base64url signature), so verifiers reject it.**Fix** Sign the card as the A2A specification describes, or remove the field (unsigned cards are fine).

Security checks are provisional; precision has not yet been measured. A clean row is not a security assessment.

## The columns it shows

Every defect this technology can carry is a column in the grid, worst first, so nothing is hidden behind a filter you have to know to apply.

-   Host`host`
-   Agent Card Valid`agentCardValid`
-   A2A Agent Card Conformance Issue Detected`agentCardConformanceIssueDetected`
-   A2A Agent Card Security Risk Detected`agentCardSecurityRiskDetected`
-   Agent Card Findings`agentCardFindings`
-   Agent Card Agent Name`agentCardAgentName`
-   Agent Card Missing Field Names`agentCardMissingFieldNames`
-   Agent Card Endpoint URLs`agentCardEndpointUrls`
-   Agent Card Invalid JSON`agentCardInvalidJson`
-   Agent Card Missing Fields`agentCardMissingFields`
-   Agent Card Endpoint Not A2A`agentCardEndpointNotA2A`
-   Agent Card Insecure Interface`agentCardInsecureInterface`
-   Agent Card Insecure Security Scheme URL`agentCardInsecureSecuritySchemeUrl`
-   Agent Card Deprecated OAuth Flow`agentCardDeprecatedOAuthFlow`
-   Agent Card Invalid Signature`agentCardInvalidSignature`
-   agentCard HTTPS Downgrade`agentCardInsecureRedirect`
-   A2A Internal Endpoint`agentCardInternalEndpoint`
-   A2A Known Test Key`agentCardTestKey`
-   A2A Signing Keys Unassessed`agentCardPartiallyAssessed`
-   Agent Card Endpoint Unverified`agentCardEndpointUnverified`
-   Ruleset Version`rulesetVersion`
-   Security Check Status`securityCheckStatus`
-   Related Security Frameworks`securityFrameworkReferences`

## About A2A agent card

Declares an agent this site operates, for agent-to-agent work.

[Read how A2A agent card is checked](https://agentic-readiness.lumar.io/docs/trust/agent-card), including the specification it is validated against and a worked correct and broken example.

## Running it

This report comes with Agentic Readiness in Lumar and appears on every crawl of any project that has it turned on. [See the whole set](https://agentic-readiness.lumar.io/scan-at-scale), or check a single URL with the [scanner on this site](https://agentic-readiness.lumar.io/), which runs the same code with no account.

[Get Lumar pricing →](https://www.lumar.io/pricing/)