Skip to content

A2A compliance: the full funnel

Every directory shows you a count. We show you what happens at every step from "candidate URL discovered" to "agent actually responds." This is the data nobody else publishes.

The funnel

6841
Candidates discovered
From 9 public sources
2600
HTTP 200
Server returned something
5313
Valid AgentCard
Schema-validated A2A v1.0
470
Live JSON-RPC
Actually operational

Real agents, but un-probeable by us

112 of the 6841 candidates returned 401/403 on the agent-card URL. Some of these are stale URLs in our discovery feed that happen to point at credentialed endpoints (CDN paths, admin pages, etc.); others are real agents whose card requires authentication. Both count as "agent exists," but we can't anonymously probe them.

Auth-gated (401/403) 78 1.1%

Real agent — but the card requires credentials we don't have. Counts as 'agent exists' but un-anonymously-probeable.

Auth-gated (401/403) 34 0.5%

Real agent — but the card requires credentials we don't have. Counts as 'agent exists' but un-anonymously-probeable.

Why most candidates didn't return a valid agent card

4129 of the 6841 candidates failed at the card-fetch step (404, server error, network failure, or returned 200 but with invalid card body). Almost none of this is our bug; it's stale URLs in upstream discovery feeds.

HTTP 404 2356 34.4%

URL has no agent card. These are mostly repos/sites that talk about A2A but don't actually serve /.well-known/agent-card.json.

Network failure 1524 22.3%

DNS failed, connect refused, hard timeout, or blocked by safety policy. The host is dead or our crawler couldn't reach it.

Server error (503) 57 0.8%

Their server is currently broken. Could recover; we re-probe in cold tier.

HTTP 402 43 0.6%

Non-2xx response on the agent-card URL.

Server error (530) 33 0.5%

Their server is currently broken. Could recover; we re-probe in cold tier.

Server error (502) 26 0.4%

Their server is currently broken. Could recover; we re-probe in cold tier.

Rate-limited (429) 20 0.3%

Provider throttled our crawler — we'll back off and retry.

HTTP 400 20 0.3%

Non-2xx response on the agent-card URL.

HTTP 410 14 0.2%

Non-2xx response on the agent-card URL.

Server error (500) 12 0.2%

Their server is currently broken. Could recover; we re-probe in cold tier.

HTTP 405 9 0.1%

Non-2xx response on the agent-card URL.

Server error (525) 5 0.1%

Their server is currently broken. Could recover; we re-probe in cold tier.

Server error (522) 4 0.1%

Their server is currently broken. Could recover; we re-probe in cold tier.

Server error (526) 3 0.0%

Their server is currently broken. Could recover; we re-probe in cold tier.

Server error (520) 2 0.0%

Their server is currently broken. Could recover; we re-probe in cold tier.

Server error (521) 1 0.0%

Their server is currently broken. Could recover; we re-probe in cold tier.

Of the 5313 valid cards: who actually responds?

Not yet probed: 3175 cards · 59.8%: Indexed but live-probe hasn't run yet (e.g. recently added).

Not yet probed 3175 59.8%

Indexed but live-probe hasn't run yet (e.g. recently added).

Examples
Non-compliant response 640 12.0%

Endpoint returned HTTP 200 but the body isn't a valid JSON-RPC 2.0 A2A response.

Examples
No URL declared 483 9.1%

Agent card is valid but has no .url field — can't be called directly.

Examples
Responds to JSON-RPC 470 8.8%

Agent endpoint accepts message/send and returns a valid A2A response.

Examples
Endpoint missing 289 5.4%

Card declares a URL, but that URL returns HTTP 404. Card claim mismatch.

Examples
Auth required 148 2.8%

Agent exists and responds, but requires credentials (401/403). Real but non-anonymous.

Examples
Unreachable 89 1.7%

DNS failed, connection refused, or hard timeout — host might be down.

Examples
Server error 17 0.3%

Endpoint exists but currently returns 5xx errors — likely unhealthy.

Examples
Not yet probed 2 0.0%

Indexed but live-probe hasn't run yet (e.g. recently added).

Examples

Are there really this few agents?

Short answer: publicly, yes. For now. A2A v1.0 only hit Linux Foundation in March 2026. The publicly-discoverable surface of the agent web in May 2026 is genuinely in the low hundreds. The rest of the iceberg sits in places our crawler can't reach:

  • Enterprise / auth-gated deployments: agents at Salesforce, ServiceNow, SAP, Workday, etc. Real, but listed in their own private directories. Our crawler sees their 401/403 buckets above.
  • Agents without .well-known/agent-card.json: A2A 1.0 allows discovery via the spec's authenticated extended card flow or direct config-handoff between agents. Those are invisible to anonymous probes.
  • Closed-net deployments: agents running inside corporate VPNs / private VPCs / Cloudflare Access. They use A2A internally but aren't on the public internet.
  • Vendor-locked PaaS: Cloud Run / Vercel / Lambda deployments without a discoverability advertisement.

What we DO capture: essentially every public A2A agent listed in registries, awesome-lists, GitHub topics, Certificate Transparency for A2A subdomains, and the official a2aregistry.org. The crawler runs every 6 hours and tiered recrawls keep the working set fresh within 15 minutes for high-quality agents.

Trust is our wedge. Other directories list agents without testing them and end up with 0–4% of "listed" agents actually working (community study). We publish the funnel transparently so you know exactly what you're looking at.