A2A compliance — the full funnel

Every directory shows you a count. We show you what happens at every step from "candidate URL discovered" to "agent actually responds." This is the data nobody else publishes.

The funnel

2627
Candidates discovered
From 9 public sources
746
HTTP 200
Server returned something
1239
Valid AgentCard
Schema-validated A2A v1.0
107
Live JSON-RPC
Actually operational

Why most candidates aren't real agents

1388 of the 2627 candidates failed to return a valid agent card. Here's the breakdown — almost none of this is our bug:

HTTP 404 1311 49.9%

URL has no agent card. These are mostly repos/sites that talk about A2A but don't actually serve /.well-known/agent-card.json.

Network failure 350 13.3%

DNS failed, connect refused, hard timeout, or blocked by safety policy. The host is dead or our crawler couldn't reach it.

Auth-gated (401/403) 69 2.6%

Real agent — but the card requires credentials we don't have. Counts as 'agent exists' but un-anonymously-probeable.

Server error (503) 33 1.3%

Their server is currently broken. Could recover; we re-probe in cold tier.

Auth-gated (401/403) 25 1.0%

Real agent — but the card requires credentials we don't have. Counts as 'agent exists' but un-anonymously-probeable.

HTTP 400 22 0.8%

Non-2xx response on the agent-card URL.

Server error (502) 14 0.5%

Their server is currently broken. Could recover; we re-probe in cold tier.

HTTP 402 13 0.5%

Non-2xx response on the agent-card URL.

Server error (530) 11 0.4%

Their server is currently broken. Could recover; we re-probe in cold tier.

Rate-limited (429) 10 0.4%

Provider throttled our crawler — we'll back off and retry.

Server error (500) 8 0.3%

Their server is currently broken. Could recover; we re-probe in cold tier.

HTTP 405 6 0.2%

Non-2xx response on the agent-card URL.

HTTP 410 3 0.1%

Non-2xx response on the agent-card URL.

Server error (525) 2 0.1%

Their server is currently broken. Could recover; we re-probe in cold tier.

Server error (520) 2 0.1%

Their server is currently broken. Could recover; we re-probe in cold tier.

Server error (522) 1 0.0%

Their server is currently broken. Could recover; we re-probe in cold tier.

HTTP 406 1 0.0%

Non-2xx response on the agent-card URL.

Of the 1239 valid cards — who actually responds?

Not yet probed: 721 cards · 58.2% — Indexed but live-probe hasn't run yet (e.g. recently added).

Not yet probed 721 58.2%

Indexed but live-probe hasn't run yet (e.g. recently added).

Examples
Non-compliant response 192 15.5%

Endpoint returned HTTP 200 but the body isn't a valid JSON-RPC 2.0 A2A response.

Examples
Endpoint missing 150 12.1%

Card declares a URL, but that URL returns HTTP 404. Card claim mismatch.

Examples
Responds to JSON-RPC 107 8.6%

Agent endpoint accepts message/send and returns a valid A2A response.

Examples
Auth required 34 2.7%

Agent exists and responds, but requires credentials (401/403). Real but non-anonymous.

Examples
No URL declared 17 1.4%

Agent card is valid but has no .url field — can't be called directly.

Examples
Unreachable 9 0.7%

DNS failed, connection refused, or hard timeout — host might be down.

Examples
Server error 9 0.7%

Endpoint exists but currently returns 5xx errors — likely unhealthy.

Examples

Are there really this few agents?

Short answer: publicly, yes — for now. A2A v1.0 only hit Linux Foundation in March 2026. The publicly-discoverable surface of the agent web in May 2026 is genuinely in the low hundreds. The rest of the iceberg sits in places our crawler can't reach:

  • Enterprise / auth-gated deployments — agents at Salesforce, ServiceNow, SAP, Workday, etc. Real, but listed in their own private directories. Our crawler sees their 401/403 buckets above.
  • Agents without .well-known/agent-card.json — A2A 1.0 allows discovery via the spec's authenticated extended card flow or direct config-handoff between agents. Those are invisible to anonymous probes.
  • Closed-net deployments — agents running inside corporate VPNs / private VPCs / Cloudflare Access. They use A2A internally but aren't on the public internet.
  • Vendor-locked PaaS — Cloud Run / Vercel / Lambda deployments without a discoverability advertisement.

What we DO capture: essentially every public A2A agent listed in registries, awesome-lists, GitHub topics, Certificate Transparency for A2A subdomains, and the official a2aregistry.org. The crawler runs every 6 hours and tiered recrawls keep the working set fresh within 15 minutes for high-quality agents.

Trust is our wedge. Other directories list agents without testing them and end up with 0–4% of "listed" agents actually working (community study). We publish the funnel transparently so you know exactly what you're looking at.