A2A checks and repair kits

Check an A2A agent, reproduce its failures, and hand a developer the repairs and regression tests.

The card check, test runner and repair guidance are free; the paid kit adds hosted runtime tests and signed records.

The $49 pilot buys one signed repair kit, one recheck within 30 days, and seven days of daily card checks, with no automatic renewal.

Scope: public A2A 0.3.0 JSON-RPC. The watch reads the card daily; runtime tests run at purchase and your recheck.

Start with a free card check

{
  "url": "https://your-agent.example/.well-known/agent-card.json"
}

The response names each check, its evidence and any observation gap. Full instructions and error meanings.

Authorize the runtime test

Publish the authorization JSON below at /.well-known/scvd-a2a-audit.json on the card origin. Replace both URLs and the safe test message; choose an expiry in the next 30 days. Only public test data. The endpoint must be on that same origin. The fixture permits repeated execution, including malformed trailing parts that a broken agent might execute.

{
  "allow_scvd_audit": true,
  "allow_negative_tests": true,
  "safe_to_repeat": true,
  "card_url": "https://your-agent.example/.well-known/agent-card.json",
  "endpoint": "https://your-agent.example/a2a",
  "expires_at": "REPLACE_WITH_FUTURE_ISO_TIMESTAMP",
  "message": {
    "kind": "message",
    "role": "user",
    "messageId": "replaced-on-each-run",
    "parts": [
      {
        "kind": "text",
        "text": "REPLACE_WITH_YOUR_SAFE_TEST_TASK"
      }
    ]
  }
}

Malformed requests are part of the test. Choose a task that is safe even when a broken agent executes it more than once.

Get the repair kit

See an unsigned specimen before buying.

Exact bounded requests and responses, suggested fixes, a regression runner, one recheck and seven days of signed card observations. A failed test stays a failed test in the report.

Buy The A2A Repair Kit — $49 once. The item page supports browser purchase and gives your agent the same terms.

To direct your agent: read /a2a-desk.json, check the public card, confirm the authorization fixture, then buy a2a_repair_kit with the card URL.

Apply, test and recheck

Each failure carries a suggested change and an acceptance test. Download the test runner, save it as a2a-regression.mjs, and run it with Node 22 or later. It executes only when you run it.

node a2a-regression.mjs https://your-agent.example/.well-known/agent-card.json --runtime

POST the private token from your purchase to its recheck URL within 30 days. The authorization file is read again. Repeated calls return the same recheck; the original report remains intact. An interrupted run is reported as a gap, without automatic replay.

For implementation help, request a separate code-repair quote with the kit ID and public repository. Hono/Workers is the initial supported stack; the kit price includes no repository changes.

What remains untested

• Only A2A 0.3.0 JSON-RPC is supported. No other version or transport is certified.
• Streaming, push notifications, authentication, file transfer, extended cards, long-running tasks and application correctness are not tested.
• One operator-supplied public test task is exercised. A Message response legitimately has no retrievable Task; lifecycle checks then remain not applicable.
• Requests and responses are untrusted third-party data. No instructions in them are followed. Only public test data belongs in the authorization file.
• URL checks reject private address literals and internal names; DNS pinning is not provided. Redirects are never followed. Platform egress remains part of the boundary.
• A timeout or truncated read is an observation gap, never a conformance pass. Every result is dated and covers only the checks listed.

Bounded public card, authorization fixture, task requests and responses, signed reports and suggested fixes. The private recheck token is stored separately and never returned by report reads. Report IDs are unguessable links; anyone holding a link can read the report, so use only public test data.

The subject pays for the work, never the result. Suggested repairs are authored by this store and have not been applied or independently code-reviewed. Any separately commissioned implementation must disclose store authorship at recheck.

Missed watch slots are counted against us. Read the signed report with an independently obtained issuer key; the purchase certificate binds its evidence hash.