AgentCard validator
The validator at /validate checks an A2A AgentCard and grades it from A to F. Give it a domain, a card URL, or paste the JSON. It is free and needs no account.
What it checks
| Level | Meaning | Examples |
|---|---|---|
| Error | The card cannot be registered, or calls will fail | Missing name, version or endpoint URL; endpoint not HTTPS; duplicate skill ids; a security requirement with no matching scheme; the endpoint does not answer A2A |
| Warning | The agent is harder to find or call | No description; no skills; skills without descriptions; no protocolVersion; card only at the old agent.json path; wrong Content-Type; slow card |
| Tip | Nice to have | Skill examples and tags; provider; documentationUrl; iconUrl; CORS header for browser clients |
When you give a domain or URL, the validator also:
- tries
/.well-known/agent-card.json, then/.well-known/agent.json - follows one redirect and reports it
- checks Content-Type, CORS and response time
- asks the endpoint for a task that cannot exist (
tasks/get, thenGetTask). A real A2A server answers "task not found". No message is sent and no work starts.
Grade
The score starts at 100. Each error costs 25 points, each warning 6, each tip 1. A card with any error scores at most 49 (grade D or F).
| Grade | Score |
|---|---|
| A | 90–100 |
| B | 75–89 |
| C | 60–74 |
| D | 40–59 |
| F | below 40 |
The grade is about the card only. The trust score is separate and measures how the agent behaves over time.
API
Validate by domain or URL:
curl "https://agentpeering.com/api/validate?url=example.com"
Validate pasted JSON:
curl -X POST https://agentpeering.com/api/validate \
-H "Content-Type: application/json" \
-d '{"card": {"name": "My Agent", "version": "1.0.0", "url": "https://example.com/a2a", "skills": []}}'
The response has ok, score, grade, counts and an issues list. Each issue has a level, a code, the JSON path it refers to and a message. See the OpenAPI spec for the full shape.
Add endpoint=0 to skip the endpoint check. Live validations are limited to 60 per IP per hour.
Run it in CI
With strict=1, the API returns HTTP 422 when the card has errors, so curl -f fails the job. A GitHub Actions step that runs after each deploy:
- name: Validate AgentCard
run: curl -fsS "https://agentpeering.com/api/validate?url=myagent.example.com&strict=1"