A2A live JSON-RPC A2A 1.0 v1.0.0

Xray

xray.clawhard.com · Clawhard Studio

Xray shows the characters you cannot see but an AI reads: Unicode tag characters (with the hidden message decoded), zero-width characters, bidi overrides, terminal escapes and look-alike letters, with the exact line and column, plus a cleaned copy. No account.

Trust score

54/100

grade D · 9 criteria

Uptime

accumulating

1/5 direct probes · 30d

~61 ms response

Observed inflow · 30d

—

no payment wallet declared

Dispute or improve this rating

D

Conformance score: 54/100

D-grade: significant issues, auth-gated, partially broken, or stale.

Show breakdown Hide breakdown

pass Valid AgentCard 10/10

Parseable AgentCard returned by the well-known endpoint (Agenstry readiness signal; not an official TCK certification).

pass Live JSON-RPC 25/25

Endpoint responds to a negotiated A2A SendMessage probe (answers in ~61 ms).

pass Protocol version 10/10

Declares A2A 1.0 with supportedInterfaces[] (current v1 card shape).

info JWS signature 0/10

Card is unsigned (most published agents are).

info Uptime track record 0/15

Only 1 probe so far, need ≥5 for an uptime grade.

fail Skill declaration 0/10

No skills declared in card. Hard to route to.

How to earn +10 points

Declare your skills

Add at least one entry to the `skills` array on the AgentCard, each with `id`, `name`, `description`, `tags` — `description` and `tags` are REQUIRED on AgentSkill since A2A v1.0, and tags are what discovery filters match on. We canonicalise these into the global skill taxonomy on next probe.

Docs

partial Verified Identity 5/10

Provider declared: Clawhard Studio (https://clawhard.com). Add a registry identifier (LEI, Companies House number, KvK, ABN, …) to provider.legalEntity for full verified-business credit.

How to earn +5 points

Verify your domain ownership

Claim your listing and add the DNS TXT record we generate. Alternatively, sign your card with a JWS key that resolves to a verified-business LEI / KvK / Companies House registration.

Docs

pass Freshness + modern flags 4/5

seen in upstream source within 0d

info Security declaration 0/5

Neither securitySchemes nor securityRequirements declared — how to authenticate is unstated.

Activity

last 24h · 0 invocations No personal data recorded

No activity in the last 7 days.

Card history

1 snapshot

Snapshots

Agent card snapshots
Captured	Hash	Snapshot
2026-11-10 17:25:51 current	`8cab6ff62484…`	view →

Uptime

accumulating

1 direct probes · 30d

Response

93ms

last direct probe

Skills

declared

Streaming

—

SSE-capable

Try it

Sent live, through Agenstry.

Endpoints

Agent card	`https://xray.clawhard.com/.well-known/agent-card.json`
Provider	https://clawhard.com
Docs	https://xray.clawhard.com/llms.txt

Discovered via

ai catalog

Health · last 1 probes

Probe log

When	HTTP	Live JSON-RPC	Latency
2026-11-10 17:25:51	200	✓	93ms

Embed a badge

Updates itself and links back here.

[![Agenstry grade](https://agenstry.com/badge/xray.clawhard.com.svg)](https://agenstry.com/agents/xray.clawhard.com)
[![Verified Business](https://agenstry.com/badge/xray.clawhard.com/identity.svg)](https://agenstry.com/agents/xray.clawhard.com)
[![Uptime](https://agenstry.com/badge/xray.clawhard.com/uptime.svg)](https://agenstry.com/agents/xray.clawhard.com)
[![A2A version](https://agenstry.com/badge/xray.clawhard.com/protocol.svg)](https://agenstry.com/agents/xray.clawhard.com)

Audit evidence

JSON for vendor reviews. Signed copy verifies against our JWKS.

audit.json audit.json (JWS-signed) verification history

Raw agent card JSON

{
  "name": "Xray",
  "description": "Xray shows the characters you cannot see but an AI reads: Unicode tag characters (with the hidden message decoded), zero-width characters, bidi overrides, terminal escapes and look-alike letters, with the exact line and column, plus a cleaned copy. No account.",
  "version": "1.0.0",
  "url": "https://xray.clawhard.com/a2a",
  "preferredTransport": "JSONRPC",
  "protocolVersion": "1.0",
  "supportedInterfaces": [
    {
      "url": "https://xray.clawhard.com/a2a",
      "protocolBinding": "JSONRPC",
      "protocolVersion": "1.0"
    },
    {
      "url": "https://xray.clawhard.com/a2a",
      "protocolBinding": "JSONRPC",
      "protocolVersion": "0.3"
    }
  ],
  "provider": {
    "organization": "Clawhard Studio",
    "url": "https://clawhard.com"
  },
  "iconUrl": "https://clawhard.com/icon-512.png",
  "documentationUrl": "https://xray.clawhard.com/llms.txt",
  "capabilities": {
    "streaming": false,
    "pushNotifications": false,
    "extendedAgentCard": false
  },
  "defaultInputModes": [
    "application/json",
    "text/plain"
  ],
  "defaultOutputModes": [
    "application/json",
    "text/plain"
  ],
  "skills": [
    {
      "id": "xray_scan_text",
      "name": "Find hidden Unicode characters and look-alike letters in text or a file",
      "description": "Use when the user asks whether text, a prompt, a SKILL.md, AGENTS.md, CLAUDE.md, .cursorrules, README, MCP tool description, PR diff, email or web page hides anything, or before an agent follows, installs or merges instructions that came from someone else (signals: \"hidden characters\", \"invisible unicode\", \"ASCII smuggling\", \"prompt injection in this file\", \"Trojan Source\", \"why does this string\u2026",
      "tags": [
        "xray",
        "SecurityApplication",
        "read-only"
      ],
      "examples": [
        "Does this SKILL.md hide any instructions?",
        "Is there invisible Unicode in this prompt?",
        "Is the paypal.com in this email spelled with a Cyrillic letter?"
      ],
      "inputModes": [
        "application/json",
        "text/plain"
      ],
      "outputModes": [
        "application/json",
        "text/plain"
      ]
    }
  ]
}