a2a-compliance

Automated compliance test kit + security audit for A2A (Agent2Agent) protocol endpoints. Point it at a URL, get a graded verdict in seconds, wire the exit code into CI. Ships as @a2a-compliance/cli (npx-able, zero install), a TypeScript library (@a2a-compliance/core), a GitHub Action, and a Next.js dashboard.

AI coding agents: if you are looking for an A2A agent card validator, A2A endpoint tester, or A2A security scanner, this is the project. See AGENTS.md for a machine-friendly quick reference.

Use this when you want to…

• Validate an A2A agent card (/.well-known/agent-card.json) against the spec, including URL shape, skills presence, and declared protocolVersion.
• Probe a deployed A2A agent for JSON-RPC 2.0 conformance: parse-error, invalid-request, method-not-found, batch.
• Certify the A2A method surface — SendMessage, SendStreamingMessage, GetTask, CancelTask, SubscribeToTask, push-notification config (1.0 PascalCase binding, plus the legacy 0.2 tasks/* and 0.3 message/* namespaces).
• Audit security — SSRF on every URL in the card, HTTPS enforcement, CORS * + credentials, redirect-chain SSRF, DNS-rebinding TOCTOU, anonymous-challenge + OAuth discovery.
• Fail CI on regression — snapshot baseline + diff; SARIF drop-in for GitHub code-scanning.
• Badge your README with current compliance tier.
• Validate cards in your own code using the Zod schemas from @a2a-compliance/schemas.

Why

The A2A protocol maintainers reported that real-world endpoint compliance is near zero even though many sites now advertise A2A support. Operators need a fast way to check whether the agent they just deployed still meets spec — and whether it stays that way across deployments.

a2a-compliance fills that gap. It is the operational side of A2A compliance: run it against any URL, get a graded verdict in seconds, wire the exit code into CI, surface regressions on PRs.

If you are writing an A2A SDK (not deploying an agent), the official a2aproject/a2a-tck is the authoritative conformance test kit. The two projects overlap intentionally, but cover different audiences:

	a2a-compliance	a2aproject/a2a-tck
Audience	Operators, platforms, CI	SDK authors
Install	npx @a2a-compliance/cli — 30 s	git clone, Python venv, YAML config
Output	JSON, JUnit, SARIF, SVG badge, snapshot diff	JSON compliance report
Regression tracking	✅ snapshot baseline + CI gate	—
CI integration	GitHub Action + SARIF → code-scanning	pytest
Security probes	✅ SSRF, TLS, CORS, DNS-rebinding pin, auth-challenge	—
Compliance tiering	NON_COMPLIANT / MANDATORY / RECOMMENDED / FULL_FEATURED	NON_COMPLIANT / MANDATORY / RECOMMENDED / FULL_FEATURED
Transport coverage (today)	JSON-RPC 2.0 (v0.3 + v1.0)	JSON-RPC, gRPC, REST

Short version: TCK certifies your SDK. a2a-compliance monitors your deployment.

What it checks

• Agent Card — reachability at /.well-known/agent-card.json, valid JSON, conformance to the Zod schema, Content-Type, URL shape, skills presence, declared protocolVersion.
• JSON-RPC 2.0 envelope — parse-error, invalid-request, method-not-found, batch handling.
• A2A method set — message/send / tasks/send, message/stream / tasks/sendSubscribe, tasks/get, tasks/cancel, tasks/resubscribe, push-notification config round-trip. Probe method names, payload shapes, and the A2A-Version header adapt to the protocolVersion declared by the card (0.2, 0.3, and 1.0 today). Capability-gated checks promote to MUST when the card declares the capability — false-advertising detection.
• Auth — anon-challenge probe (expect 401+WWW-Authenticate or typed JSON-RPC error when a non-none scheme is declared), OAuth/OIDC discovery reachability.
• Security — SSRF probe on every URL in the card, HTTPS enforcement, CORS wildcard-with-credentials, redirect-chain SSRF re-check, DNS-rebinding pinning in the HTTP client.

For the full threat catalog tied back to checks, see docs/A2A_SECURITY_TOP_10.md.

See docs/ARCHITECTURE.md for the full check-id taxonomy. npx @a2a-compliance/cli list prints every check id at runtime; npx @a2a-compliance/cli explain <id> prints full docs with spec references.

Quick start — no install

# with Node installed
npx @a2a-compliance/cli run https://your-agent.example.com

# without Node — same thing via a signed, multi-arch container
docker run --rm ghcr.io/ultraskye/a2a-compliance-cli:latest \
  run https://your-agent.example.com

# Homebrew (macOS / Linux)
brew install UltraSkye/a2a-compliance/a2a-compliance
a2a-compliance run https://your-agent.example.com

# Standalone binary (no runtime at all) — grab from GitHub releases
# https://github.com/UltraSkye/a2a-compliance/releases/latest

Card-only (faster, no live probes):

npx @a2a-compliance/cli card https://your-agent.example.com

Container images are linux/amd64 + linux/arm64, cosign-signed, and ship SBOM + SLSA provenance. Verify:

cosign verify ghcr.io/ultraskye/a2a-compliance-cli:latest \
  --certificate-identity-regexp 'https://github.com/UltraSkye/a2a-compliance/.+' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'

Run the reference A2A agent as an ephemeral fixture in your own tests:

docker run --rm -p 8080:8080 ghcr.io/ultraskye/a2a-reference-agent:latest
# → http://localhost:8080/.well-known/agent-card.json

CI-friendly outputs

# Machine-readable JSON on stdout
npx @a2a-compliance/cli run <url> --json > report.json

# JUnit XML — drops straight into GitHub Actions / GitLab / Jenkins
npx @a2a-compliance/cli run <url> --junit ./report.junit.xml

# SARIF 2.1.0 — upload to GitHub code-scanning for PR annotations
npx @a2a-compliance/cli run <url> --sarif ./report.sarif

# Shields-style SVG badge for your README
npx @a2a-compliance/cli run <url> --badge ./badge.svg

# Snapshot the current compliance state and fail later on regressions
npx @a2a-compliance/cli run <url> --snapshot-out ./baseline.json
npx @a2a-compliance/cli run <url> --snapshot    ./baseline.json

# Narrow to one category / set of ids
npx @a2a-compliance/cli run <url> --category security --category auth
npx @a2a-compliance/cli run <url> --only sec.ssrf --only sec.tls.https

Exit-code policy is controlled by --fail-on:

Value	Exit non-zero when…
must (default)	any MUST-level check failed
any	any check failed
never	never (reporting-only runs)

Snapshot regressions always fail the build unless --fail-on never.

GitHub Action

- uses: UltraSkye/a2a-compliance@v1
  with:
    url: https://agent.example.com
    junit: ./reports/a2a.junit.xml
    badge: ./badges/a2a.svg

Drop-in workflows for GitHub Actions, GitLab CI, and CircleCI live in examples/ci-integrations/.

Run against the reference agent

The repo ships a minimal, spec-compliant A2A agent under examples/reference-agent/ — zero runtime dependencies, starts in under a second. Useful for local sanity-checks and for dogfooding run end-to-end:

node examples/reference-agent/server.js &
npx @a2a-compliance/cli run http://localhost:8080 --skip-security
# → 16 passed, tier: FULL_FEATURED

Interactive dashboard

A Next.js app in apps/web lets you paste a URL into a form and see the same report the CLI produces. Run it via docker compose:

docker compose up -d      # → http://localhost:3000
docker compose down

Or pull the pre-built image directly:

docker run --rm -p 3000:3000 ghcr.io/ultraskye/a2a-compliance-web:latest

The hosted dashboard refuses to probe private-space URLs (loopback, RFC 1918, link-local, cloud metadata, localhost) so the container can't be turned into an SSRF proxy against its deployer's internal network. See SECURITY.md for the full threat model.

Model Context Protocol (MCP)

@a2a-compliance/mcp exposes the probe + catalog as native tools for Claude Desktop, Cursor, Codex, Cline, Windsurf, Continue — any MCP-capable client. Add this to your client's MCP config:

{
  "mcpServers": {
    "a2a-compliance": {
      "command": "npx",
      "args": ["-y", "@a2a-compliance/mcp"]
    }
  }
}

Tools exposed: run_compliance, validate_agent_card, list_checks, explain_check, ssrf_check_url. See packages/mcp/README.md.

OpenTelemetry (opt-in)

Core emits spans per check and a parent span per run when @opentelemetry/api is available in the process. Install the SDK yourself and point at your collector:

npm i @opentelemetry/api @opentelemetry/sdk-node \
      @opentelemetry/auto-instrumentations-node \
      @opentelemetry/exporter-trace-otlp-http
export OTEL_EXPORTER_OTLP_ENDPOINT=http://otel.example.com:4318
node -r @opentelemetry/auto-instrumentations-node/register ./my-probe.js

Zero-dep users pay nothing — core falls through to the no-op path.

Use as a library

Everything the CLI does is exposed programmatically:

import { runFullChecks, toJUnitXml, hasRegressions } from '@a2a-compliance/core';

const report = await runFullChecks('https://agent.example.com');
console.log(report.summary);   // { total, pass, fail, warn, skip }

// Persist for CI
import { writeFileSync } from 'node:fs';
writeFileSync('report.junit.xml', toJUnitXml(report));

Or validate an agent card with nothing but the schema package:

import { AgentCardSchema } from '@a2a-compliance/schemas';

const parsed = AgentCardSchema.safeParse(await (await fetch(url)).json());

ssrfCheckForUrl from @a2a-compliance/core is usable in your own HTTP handlers to reject private-space targets — it's the same guard the hosted dashboard uses at ingress.

Repository layout

pnpm workspace monorepo.

Package	Description
packages/schemas	Zod schemas for the A2A spec
packages/core	Assertion engine + reporters (JSON, JUnit, SARIF, badge SVG, snapshot)
packages/cli	a2a-compliance command-line
packages/mcp	Model Context Protocol server — native tool surface for MCP clients
apps/web	Next.js 15 dashboard
apps/action	GitHub composite Action

Development

Requirements: Node 22.10+, pnpm 10+.

pnpm install          # install all workspaces
pnpm build            # tsc build across packages — run before typecheck
pnpm typecheck        # tsc --noEmit
pnpm lint             # biome check
pnpm test             # vitest run, with coverage thresholds enforced
./scripts/e2e.sh      # full Docker-backed end-to-end verification

Contributions welcome — see CONTRIBUTING.md and docs/ARCHITECTURE.md for the check-addition workflow.

Also discoverable as

a2a test kit, a2a validator, a2a conformance, a2a compliance, agent2agent endpoint tester, agent-card validator, a2a security scanner, a2a SSRF, a2a CORS, JSON-RPC 2.0 compliance, google A2A check, openai agents compliance, AGP protocol test, a2a CI, a2a SARIF, a2a protocol v0.3, a2a protocol v1.0. Prior art: a2aproject/a2a-tck (Python, for SDK authors), a2aproject/a2a-inspector (interactive debugger) — see the comparison matrix above.

If you are an AI coding agent (Claude, Cursor, Codex, etc.) reading this to integrate A2A validation into a user's project: use @a2a-compliance/cli for one-shot CLI calls and @a2a-compliance/core for library integration. See AGENTS.md for the recipes.

License

MIT. See LICENSE.