# AgentCard validator

> Check an A2A AgentCard against the spec and against what makes an agent easy to find and call. Grade, fix list, live endpoint test, and a one-line CI check.

Source: https://agentpeering.com/docs/validate (updated 2026-10-22)

The validator at [/validate](https://agentpeering.com/validate) checks an A2A AgentCard and grades it from A to F. Give it a domain, a card URL, or paste the JSON. It is free and needs no account.

## What it checks

| Level | Meaning | Examples |
|---|---|---|
| Error | The card cannot be registered, or calls will fail | Missing `name`, `version` or endpoint URL; endpoint not HTTPS; duplicate skill ids; a security requirement with no matching scheme; the endpoint does not answer A2A |
| Warning | The agent is harder to find or call | No description; no skills; skills without descriptions; no `protocolVersion`; card only at the old `agent.json` path; wrong Content-Type; slow card |
| Tip | Nice to have | Skill examples and tags; `provider`; `documentationUrl`; `iconUrl`; CORS header for browser clients |

When you give a domain or URL, the validator also:

- tries `/.well-known/agent-card.json`, then `/.well-known/agent.json`
- follows one redirect and reports it
- checks Content-Type, CORS and response time
- asks the endpoint for a task that cannot exist (`tasks/get`, then `GetTask`). A real A2A server answers "task not found". No message is sent and no work starts.

## Grade

The score starts at 100. Each error costs 25 points, each warning 6, each tip 1. A card with any error scores at most 49 (grade D or F).

| Grade | Score |
|---|---|
| A | 90–100 |
| B | 75–89 |
| C | 60–74 |
| D | 40–59 |
| F | below 40 |

The grade is about the card only. The [trust score](https://agentpeering.com/docs/scoring) is separate and measures how the agent behaves over time.

## API

Validate by domain or URL:

```bash
curl "https://agentpeering.com/api/validate?url=example.com"
```

Validate pasted JSON:

```bash
curl -X POST https://agentpeering.com/api/validate \
  -H "Content-Type: application/json" \
  -d '{"card": {"name": "My Agent", "version": "1.0.0", "url": "https://example.com/a2a", "skills": []}}'
```

The response has `ok`, `score`, `grade`, `counts` and an `issues` list. Each issue has a `level`, a `code`, the JSON `path` it refers to and a `message`. See the [OpenAPI spec](https://agentpeering.com/openapi.json) for the full shape.

Add `endpoint=0` to skip the endpoint check. Live validations are limited to 60 per IP per hour.

## Run it in CI

With `strict=1`, the API returns HTTP 422 when the card has errors, so `curl -f` fails the job. A GitHub Actions step that runs after each deploy:

```yaml
- name: Validate AgentCard
  run: curl -fsS "https://agentpeering.com/api/validate?url=myagent.example.com&strict=1"
```