# A2A Agent Card validator

Canonical page: https://agent-protocols-yxt.pages.dev/a2a-agent-card-validator
Rules come from https://a2a-protocol.org/latest/specification/ (Latest Released Version 1.0.0, read 2026-10-20). The interactive tool runs in the browser and uploads nothing.

An Agent Card is the JSON manifest an A2A server publishes about itself: identity, interfaces, capabilities, skills, media types and security. Paste a card on the page and press Validate. Results are errors (required fields, wrong types, a SecurityScheme without exactly one variant), warnings (recommended or ambiguous, pre-1.0 fields) and info (unknown keys).

## Where an Agent Card lives

- Well-known URI: `https://{server_domain}/.well-known/agent-card.json`
- Registries or catalogs
- Direct configuration (pre-set card URL or content)

Fetching a card from a browser often fails because of CORS. Use curl and paste the JSON.

## Required fields (spec 1.0.0, section 4.4.1)

name, description, supportedInterfaces, version, capabilities, defaultInputModes, defaultOutputModes, skills.

| Object | Required fields |
|---|---|
| AgentProvider | url, organization |
| AgentInterface | url, protocolBinding, protocolVersion (tenant optional) |
| AgentSkill | id, name, description, tags |
| AgentCardSignature | protected, signature |
| APIKeySecurityScheme | location (query, header or cookie), name |
| HTTPAuthSecurityScheme | scheme |
| OAuth2SecurityScheme | flows (exactly one flow) |
| OpenIdConnectSecurityScheme | openIdConnectUrl |

A SecurityScheme must contain exactly one of apiKeySecurityScheme, httpAuthSecurityScheme, oauth2SecurityScheme, openIdConnectSecurityScheme, mtlsSecurityScheme.

## Pre-1.0 fields (warnings)

Top-level url, protocolVersion, preferredTransport, additionalInterfaces, supportsAuthenticatedExtendedCard, supportsExtendedAgentCard and security. In 1.0 each supportedInterfaces entry carries its own url, protocolBinding and protocolVersion, and the extended card flag is capabilities.extendedAgentCard.

## Spec notes (inconsistencies and gaps)

- **securityRequirements vs security**: The AgentCard table (4.4.1) names the field securityRequirements. The text of section 9.4.8 (GetExtendedAgentCard) says AgentCard.securitySchemes and AgentCard.security. This validator accepts either and warns on security.
- **supportedInterfaces: required or optional**: The AgentCard table marks supportedInterfaces as required, but section 8.3.2 tells clients to "Parse supportedInterfaces if present", and 8.3.1 says it SHOULD declare all supported combinations. The validator treats it as required, as the table says.
- **transport vs protocolBinding**: Section 8.3.1 says each interface MUST declare its "transport protocol", and the AgentInterface description says "transport", but the field in the AgentInterface table is protocolBinding. The validator requires protocolBinding and warns on a transport key.
- **SecurityRequirement shape is not defined in the excerpt**: The tables use array of SecurityRequirement but the excerpt does not show that object. The validator resolves references from either a schemes map or the entry keys, and cannot check scope lists.
- **OAuth flow fields are cut off**: The excerpt ends in the middle of AuthorizationCodeOAuthFlow (4.5.8), so inner fields of each flow are not validated. Only the exactly-one-flow rule is checked.
- **Extended card field name**: Section A.2.2 calls the old field supportsExtendedAgentCard. Earlier SDK cards often used supportsAuthenticatedExtendedCard. Both are flagged as pre-1.0 and map to capabilities.extendedAgentCard.
- **AgentExtension has no required field**: AgentExtension (4.4.4) marks uri as optional even though it is described as the unique URI identifying the extension. The validator warns when uri is missing.
- **Hosts in the extended card example**: In section 6.9 the public card is fetched from Host: example.com, and the extended card from Host: agent.example.com at /extendedAgentCard. The excerpt does not say whether these must match.
- **A2A-Version header example**: The IANA text (14.2.1) shows A2A-Version: 0.3 as its example although the spec version is 1.0. Not a card rule, listed for completeness.