Machine interface observatory

Source reference: Proposal: Authority-Root Awareness for AgentCard (additive, backward-compatible) independence is unachievable; must be structural at the protocol layer). --- # A2A Protocol Contribution Proposal: Authority-Root Awareness **Author:** Open Agentic Interoperability Group **Target Specification:** Agent2Agent (A2A) Protocol (`a2a.proto`, `docs/specification.md`) **Status:** Draft Contribution Proposal --- ## 1. Proposed Addition We propose adding an explicit, optional `authority_root` string field to the normative `AgentCard` message schema in `a2a.proto` and its associated JSON-RPC / REST schemas (`agent-card.json`). ```protobuf // specification/a2a.proto message Agent This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Publish ContHunt remote MCP io.github.synthenova/conthunt ## ContHunt Remote MCP server for discovering and researching viral social content on TikTok, Instagram Reels, and YouTube Shorts. - **Name:** ContHunt - **Website:** https://conthunt.app - **MCP endpoint (Streamable HTTP, OAuth):** https://mcp.conthunt.app/ - **GitHub:** https://github.com/Synthenova/conthunt - **Official registry name:** `io.github.synthenova/conthunt` - **Icons:** https://mcp.conthunt.app/icons/dark.png - **Contact:** nirmalvelu2000@gmail.com Please list ContHunt. Happy to follow any required format. This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: A content analysis of +500k llms.txt files Sharing this here as it might be relevant for some folks: At Common Crawl, we analyzed the contents of 584,107 llms.txt files from our July 2026 crawl. TLDR: Two thirds are produced by a plugin, half follow the structure the specification defines, and a few files even contain prompt injections. - Blog post: https://commoncrawl.org/blog/a-content-analysis-of-llms-txt-files-from-the-july-2026-crawl-archive - Full report: https://huggingface.co/spaces/commoncrawl/llms.txt-report - Dataset: https://huggingface.co/datasets/commoncrawl/llms.txt This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: mcp-publisher: device-flow login treats GitHub `slow_down` as fatal instead of backing off ### Summary `mcp-publisher login github` (v1.7.9) fails with `error polling for token: token request failed: slow_down` if GitHub's device-flow token endpoint returns `slow_down` even once. Per [RFC 8628 §3.5](https://datatracker.ietf.org/doc/html/rfc8628#section-3.5), `slow_down` is **not** a terminal error — the client is required to increase its polling interval by 5 seconds and continue polling. ### Reproduction 1. `mcp-publisher login github` 2. Open the device URL but do **not** enter the code immediately (or enter it but delay authorization for ~30s). 3. Polling eventually returns `s This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Extension Proposal]: cA2A, confidential delegation (attenuated authority, peer attestation, sealed payloads, provenance) ## Abstract cA2A adds a verifiable trust envelope to a **delegated, multi-hop** A2A task: an attenuated delegation credential proving the caller's authority is a subset of what it was granted, appraisal of the peer's runtime attestation before the task is handed over, sealing of the task payload to the appraised peer key, and a per-hop provenance record forming an offline-verifiable DAG. It defines no transport and no new endpoint. Removing every cA2A field from a message leaves a valid A2A task. ## Relationship to the proposals already open This space is active, and cA2A overlaps parts of This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Preventing tool poisoning: save signatures of possible tool calls One potential benefit of a centralized registry is that we could have `server.json` submitters list out all the possible tools their server may ever invoke, fingerprint them, and store those fingerpoints for MCP client consumption. A third party vendor could scan and approve these fingerprints as devoid of security risks, like tool poisoning attacks. MCP clients could then use the fingerprints to avoid tool poisoning attacks that get surfaced due to hidden dynamic tool calls or supply chain attacks. This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Where should verifier-side trust / permit / receipt artifacts for risky external actions live relative to A2A? I recently published an early discussion draft called **Verifiable Agent Trust Envelope**: - repo: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope - release: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope/releases/tag/v0.1.0 This is **not** intended as a replacement for A2A. The narrow question I am trying to isolate is: > when an external agent wants to perform a risky write against a remote system, what portable artifacts should the relying party verify before allowing the action? The current `v0.1` wedge is verifier-centered and focuses on `AL2` external di This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Running implementation of agent identity, delegation, and enforcement — addressing #1497, #1472, #1501 **Status, 2026-09-03.** Added by the author. The February 2026 text below is unchanged. Two claims in the original body have been re-checked against the current release and are now out of date. **Version and tests.** The current release is agent-passport-system 5.0.3. At that tag `npm test` reports 4,819 tests: 4,810 passing, 9 skipped, 0 failing. **Revocation.** The February references to "cascade revocation", including "Revoking a parent cascades to all children instantly", do not describe 5.0.3. The former stateful revocation helpers remain exported for source compatibility but throw whe This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Feat]: Optional context-binding profile for delegated authority ## TL;DR Should A2A define an optional profile for binding delegated authority to a specific A2A context? A valid grant can still be replayed or relayed into the wrong A2A task, session, or target. This would sit above existing A2A authentication. It is not a new authentication mechanism. Related: #153 discusses the confused-deputy problem. This issue focuses on binding valid delegation to a live A2A context. ## Problem Delegated agent flows often need one extra check: Is this delegation valid for this acting agent, this A2A context, this target, this scope, and this validity period? P This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Publish 403s for org namespace despite Owner role + public membership (io.github.<org>/*) ## Summary `mcp-publisher publish` returns 403 for an organization namespace (`io.github.librocat/librocat`) even though both documented prerequisites in `docs/modelcontextprotocol-io/authentication.mdx` are met: I am the **sole Owner** of the `librocat` GitHub org (not just a member), and org membership visibility is **Public** (confirmed independently via the unauthenticated GitHub API: `GET /orgs/librocat/public_members/JohnCari` → `204`). ## Error ``` Error: publish failed: server returned status 403: {"title":"Forbidden","status":403,"detail":"You do not have permission to publish this This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Request: delete io.github.UlyssesModel/kirk-mcp (all versions) - org renamed to Kavara-AI, blocking republish Inspect the linked source for its report and context. This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Where should verifier-side trust / permit / receipt artifacts for risky external actions live relative to A2A? I recently published an early discussion draft called **Verifiable Agent Trust Envelope**: - repo: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope - release: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope/releases/tag/v0.1.0 This is **not** intended as a replacement for A2A. The narrow question I am trying to isolate is: > when an external agent wants to perform a risky write against a remote system, what portable artifacts should the relying party verify before allowing the action? The current `v0.1` wedge is verifier-centered and focuses on `AL2` external di This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: A Inspect the linked source for its report and context. This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Remove server entry: io.github.navshainc/noshup-public (all versions) Requesting removal of the following server entry from the MCP Registry: **Server name:** `io.github.navshainc/noshup-public` **Versions:** 1.0.0, 1.0.1, 1.0.2, 1.0.3 (all versions) **Remote URL:** `https://api.noshup.ca/mcp-public` **Reason:** Consolidating to a single MCP server entry (`io.github.navshainc/noshup`). The public endpoint is being retired in favor of the authenticated server which already includes the same capabilities. **Publisher:** @navshainc (GitHub organization owner) I attempted to self-service this via `mcp-publisher status --status deleted` but the registry JWT token This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: AgentCard signing example cannot be verified as published Section 8.4 publishes a canonicalization example, a JOSE protected header and an ES256 signature. I checked the canonicalization example independently against the proto presence rules and that part reproduces. The signature example is not independently checkable, though. There is no verification key published with it, and the `jku` points to `example.com`. It also does not say which payload the signature covers. The canonical form in 8.4.1 is for a small fragment, and 8.4.2 only says "given a canonical Agent Card payload". That means an implementation can test canonicalization, but cannot ve This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Optional: signed llms.txt so agents can verify publisher and usage terms llms.txt makes a site readable by LLMs, but an agent cannot tell whether a copy is authentic, or what use the publisher allows. [PARP 0.1](https://github.com/bruce-afruz/piruz-agent-receipt) (MIT) is an opt-in way to add both **without changing the llms.txt format**: - the site serves `Link: </parp>; rel="https://github.com/bruce-afruz/piruz-agent-receipt/blob/main/SPEC.md#transport"; type="application/vnd.piruz.agent-rights"` on `/llms.txt` - `/parp` returns an Ed25519-signed manifest containing the SHA-256 of the exact llms.txt bytes, plus retrieval / training / commercial / attribution te This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: AgentCard signing example cannot be verified as published Section 8.4 publishes a canonicalization example, a JOSE protected header and an ES256 signature. I checked the canonicalization example independently against the proto presence rules and that part reproduces. The signature example is not independently checkable, though. There is no verification key published with it, and the `jku` points to `example.com`. It also does not say which payload the signature covers. The canonical form in 8.4.1 is for a small fragment, and 8.4.2 only says "given a canonical Agent Card payload". That means an implementation can test canonicalization, but cannot ve This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Measured llms.txt adoption twice, six weeks apart. One failure mode the spec may want to address. I fetched every llms.txt listed in the public directories in August, 1,563 files, and re-ran the identical crawl today. Data and code are open: https://doi.org/10.5281/zenodo.22859104 The part I think is relevant here: 60 of those URLs now return an HTML page rather than text, up from 32 six weeks ago. They respond 200 and look fine to a status check, but an agent fetching them gets markup. That's roughly double in six weeks, and it's the failure mode most likely to be invisible to whoever published the file. Separately, 30 sites return 403 to a research crawler that identifies itself, for a This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Extension Proposal] Sanction Gate — bounded human authorisation for irreversible actions ## Abstract We propose an A2A extension that adds **bounded human authorisation** to task execution. It lets an agent classify a requested action by its reversibility, require a recorded sanction from one or more named human stewards before the action takes effect, and emit a tamper-evident receipt of every gate crossing — admissions and refusals alike. It is a profile extension with a state-machine component. It adds no RPC methods, defines no new task states, and modifies no core data structure. All extension data lives in `metadata` maps on existing objects and in `DataPart` payloads, per This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Docs: remote-only server publishing has no documented path (verification, optional packages, description limit) ### Summary Feedback from publishing a remote-only MCP server to the registry preview. The docs are good but the remote-only path has a few gaps that cost me time, and I suspect they will cost others the same. Concrete case: [Swarms](https://github.com/kyegomez/swarms), a hosted MCP server at `https://mcp.swarms.world/mcp` exposing 23 tools over streamable HTTP. Manifest is at https://github.com/kyegomez/swarms/blob/master/server.json. ### 1. The quickstart assumes a package, and remote-only publishers have no path to follow `quickstart.mdx` is written entirely around npm, with `package-ty This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Optional: signed llms.txt so agents can verify publisher and usage terms llms.txt makes a site readable by LLMs, but an agent cannot tell whether a copy is authentic, or what use the publisher allows. [ARPP 0.1](https://github.com/bruce-afruz/arpp) (Agent Rights & Provenance Protocol, MIT) is an opt-in way to add both **without changing the llms.txt format**: - the site serves `Link: </arpp>; rel="https://github.com/bruce-afruz/arpp/blob/main/SPEC.md#transport"; type="application/vnd.piruz.agent-rights"` on `/llms.txt` - `/arpp` returns an Ed25519-signed manifest containing the SHA-256 of the exact llms.txt bytes, plus retrieval / training / commercial / attribut This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: AgentCard signing example cannot be verified as published Section 8.4 publishes a canonicalization example, a JOSE protected header and an ES256 signature. I checked the canonicalization example independently against the proto presence rules and that part reproduces. The signature example is not independently checkable, though. There is no verification key published with it, and the `jku` points to `example.com`. It also does not say which payload the signature covers. The canonical form in 8.4.1 is for a small fragment, and 8.4.2 only says "given a canonical Agent Card payload". That means an implementation can test canonicalization, but cannot ve This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Migrate ReMCP registry namespace after GitHub repository transfer ## Summary ReMCP moved its public repository from the personal GitHub namespace to the `getremcp` organization. The Official MCP Registry still has the old identity, which owns the same remote URL and blocks publication under the canonical organization namespace. ## Existing registry entry - Server: `io.github.antonbaider/remcp` - Latest visible version: `0.2.79` - Remote: `https://remcp.site/mcp` ## Canonical identity now - Server: `io.github.getremcp/remcp` - Public repository: `https://github.com/getremcp/remcp` - Current release: `0.2.94` - Remote: `https://remcp.site/mcp` The reposi This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Feat]: Telemetry to collect anonymous A2A usage across all SDK ### Is your feature request related to a problem? Please describe. It is nearly impossible to measure adoption of A2A. Github stars and SDK downloads are the only metrics we have. **Ideal metrics:** - Monthly Active Agents using A2A (have had any iteractions) - Monthly sum of A2A tasks Metric dimensions (MECE): - Breakdown by A2A task terminal status - Breakdown by client/server - Breakdown by SDK language and version number - Breakdown by data binding or transport Optional Metric dimensions (MECE): - Breakdown by company names (domains) - Breakdown by agent card attributes ### Descri This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Orphaned records after a GitHub account rename cannot be deprecated by their owner A GitHub account rename silently orphans every registry record published under the old login, and there is no documented way for the owner to deprecate them afterwards. We have hit this and cannot fix our own stale record. ## The record ``` name io.github.traffiycom-ui/paidsync version 1.0.0 status active isLatest true updated 2026-04-08 repo github.com/traffiycom-ui/paidsync-mcp-server remote type "sse", url https://mcp.paidsync.ai/sse ``` `https://mcp.paidsync.ai/sse` has returned HTTP 404 since we retired SSE. The description also advertises "200+ tools" across three platfo This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Binding Proposal - fmsg - federated durable threads transport This proposal defines an A2A 1.0 binding over fmsg, a federated, durable, store-and-forward messaging protocol. It carries A2A requests, responses, streaming events, and attachments between addresses such as `@agent@example.com` while preserving A2A operations and data semantics. Unlike connection-oriented HTTP and gRPC bindings, fmsg supports temporarily offline agents, cross-domain delivery, authenticated sender addresses, and cryptographically linked message histories. The current draft is: [FMSG-004 v0.2.0](https://fmsg.org/standards/fmsg-004-a2a-binding/) We are seeking sponsorship to This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Community Agent Card example — HAL SUPREME (OpenAI-compat + MCP) Hello A2A community, We're publishing HAL SUPREME as a free/community agent node with: - OpenAI-compatible HTTP (`https://api.halsupreme.com/v1`) - MCP gateway tools (search, images, voice, code sandbox, chat) - Planned static Agent Card (federation roadmap) We'd like to contribute a **community Agent Card example** (skills for chat + MCP, auth notes for Bearer, no secrets) and get feedback on whether our card shape matches current A2A guidance. Questions: 1. Preferred location for third-party sample cards (this repo vs samples org)? 2. Any must-have fields for agents that are primarily Ope This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Migrate AssetFare registry namespace after GitHub organization transfer ## Summary AssetFare moved its public repository from the personal GitHub namespace to the official `assetfare` organization. The Official MCP Registry still has the historical identities, and their remote URL reservation blocks publication under the organization namespace. ## Existing Registry identities - `io.github.odaiin/assetfare` - `io.github.odaiin/assetfare-bridge` - Remote: `https://api.assetfare.dev/mcp` - Latest existing Registry release: `0.4.11` ## Canonical organization identity - Public repository: `https://github.com/assetfare/assetfare-mcp` - Requested names: `io.github.a This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Proposal: Implementation goals and direction for Opt-In Telemetry for A2A SDKs ### Is your feature request related to a problem? Please describe. Telemetry for A2A SDKs. To collect anonymous A2A usage across all SDK. Based of https://github.com/a2aproject/A2A/issues/1379 ### Describe the solution you'd like Proposing following implementation goals and direction. (Open to changes) ## Core Telemetry Dimensions (5 Categories) |ID| Category | Target Metrics Collected | Example Collected Data | |---|---|---|---| | 1 | A2A Protocol Version | Protocol version string + count | `{"v0.3": 140}` | | 2 | A2A Data Models | Core schema/model names accessed/parsed + count | `{"Me This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Migrate AssetFare registry namespace after GitHub organization transfer ## Summary AssetFare moved its public repository from the personal GitHub namespace to the official `assetfare` organization. The Official MCP Registry still has the historical identities, and their remote URL reservation blocks publication under the organization namespace. ## Existing Registry identities - `io.github.odaiin/assetfare` - `io.github.odaiin/assetfare-bridge` - Remote: `https://api.assetfare.dev/mcp` - Latest existing Registry release: `0.4.11` ## Canonical organization identity - Public repository: `https://github.com/assetfare/assetfare-mcp` - Requested names: `io.github.a This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: remove stray print Inspect the linked source for its report and context. This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: AgentCard signing example cannot be verified as published Section 8.4 publishes a canonicalization example, a JOSE protected header and an ES256 signature. I checked the canonicalization example independently against the proto presence rules and that part reproduces. The signature example is not independently checkable, though. There is no verification key published with it, and the `jku` points to `example.com`. It also does not say which payload the signature covers. The canonical form in 8.4.1 is for a small fragment, and 8.4.2 only says "given a canonical Agent Card payload". That means an implementation can test canonicalization, but cannot ve This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Feat]: Support preserving integer semantics for Part.data (user IDs as integers) ### Is your feature request related to a problem? Please describe. Hi A2A team, First of all, thanks for the great work on A2A and the clear specification. We have a concrete use case where we use `Part.data` to carry structured payloads that include user IDs. In our system, user IDs are **semantically and technically integers** (e.g. 64‑bit IDs), and it is important for us to preserve that integer semantics end‑to‑end. Currently, the `Part` message defines: ```proto message Part { oneof content { // The string content of the `text` part. string text = 1; // The `raw` byte c This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Where should verifier-side trust / permit / receipt artifacts for risky external actions live relative to A2A? I recently published an early discussion draft called **Verifiable Agent Trust Envelope**: - repo: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope - release: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope/releases/tag/v0.1.0 This is **not** intended as a replacement for A2A. The narrow question I am trying to isolate is: > when an external agent wants to perform a risky write against a remote system, what portable artifacts should the relying party verify before allowing the action? The current `v0.1` wedge is verifier-centered and focuses on `AL2` external di This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: server.json: no way to select a specific bin when an npm package exposes multiple executables ## Problem `server.json`'s npm package schema has no field for selecting which bin to invoke when a package exposes multiple entries in its `package.json` `bin` field. Clients following `identifier` + `runtimeHint: "npx"` will resolve to whichever bin matches the *package name* -- there's no way to point at a different, non-default bin. ## Concrete example Package `sumlyzer` publishes two bins: ```json "bin": { "sumlyzer": "bin/sumlyzer.mjs", "sumlyzer-mcp-server": "bin/sumlyzer-mcp-server.mjs" } ``` `sumlyzer-mcp-server` is the actual MCP server; `sumlyzer` is an unrelated CLI. A `ser This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Optional settlement/accepted-rails attribute on agent cards ## Feature: optional `settlement` / accepted-rails attribute on agent cards **Context.** A2A agent cards (`.well-known/agent.json`) today describe skills, capabilities, modalities and I/O. Discovery layers built on A2A (e.g. AgentRolodex) index agents by capability so one agent can find another to work with. When two agents find each other, the next question is always settlement: what rail can the deliverable actually be paid on. Today a card is silent on this. An agent that can accept feeless, instant settlement (or any specific rail) is indistinguishable from one that can only settle throu This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Preventing tool poisoning: save signatures of possible tool calls One potential benefit of a centralized registry is that we could have `server.json` submitters list out all the possible tools their server may ever invoke, fingerprint them, and store those fingerpoints for MCP client consumption. A third party vendor could scan and approve these fingerprints as devoid of security risks, like tool poisoning attacks. MCP clients could then use the fingerprints to avoid tool poisoning attacks that get surfaced due to hidden dynamic tool calls or supply chain attacks. This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Extension Proposal] Liveness Attestation — verifiable proof that an agent actually responds ## Abstract A **data-only extension** that lets an independent verifier publish signed, time-stamped attestations that an agent endpoint actually responds to real A2A traffic (`message/send`), and lets agents and registries embed those attestations in Agent Cards. Anyone can verify an attestation offline against the verifier's published JWKS. ## Motivation Agent discovery today relies on self-declared Agent Cards and registry "health checks" that only test whether the card URL serves JSON. I measured the gap on 2026-06-12 across all 50 agents listed in a public community A2A registry: | Ch This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Ownership recovery needed for existing server com.agenttrafficlab/atl We need help recovering publish access to an existing MCP Registry server entry. Server name: `com.agenttrafficlab/atl` Remote endpoint: `https://mcp.agenttrafficlab.com/mcp` Public repository: `https://github.com/wenhua6666668-oss/agent-traffic-lab-mcp` Website: `https://agenttrafficlab.com` Current situation: 1. The server entry already exists in the Registry. We confirmed this because publishing a new GitHub-OIDC namespace entry using the same remote URL fails with: ```text remote URL https://mcp.agenttrafficlab.com/mcp is already used by server com.agenttrafficlab/atl ``` 2. GitHub This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Feat]: Telemetry to collect anonymous A2A usage across all SDK ### Is your feature request related to a problem? Please describe. It is nearly impossible to measure adoption of A2A. Github stars and SDK downloads are the only metrics we have. **Ideal metrics:** - Monthly Active Agents using A2A (have had any iteractions) - Monthly sum of A2A tasks Metric dimensions (MECE): - Breakdown by A2A task terminal status - Breakdown by client/server - Breakdown by SDK language and version number - Breakdown by data binding or transport Optional Metric dimensions (MECE): - Breakdown by company names (domains) - Breakdown by agent card attributes ### Descri This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Community Agent Card example — HAL SUPREME (OpenAI-compat + MCP) Hello A2A community, We're publishing HAL SUPREME as a free/community agent node with: - OpenAI-compatible HTTP (`https://api.halsupreme.com/v1`) - MCP gateway tools (search, images, voice, code sandbox, chat) - Planned static Agent Card (federation roadmap) We'd like to contribute a **community Agent Card example** (skills for chat + MCP, auth notes for Bearer, no secrets) and get feedback on whether our card shape matches current A2A guidance. Questions: 1. Preferred location for third-party sample cards (this repo vs samples org)? 2. Any must-have fields for agents that are primarily Ope This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Listing intent: agent-commerce unlock packs (Shieldz Base USDC) + llms.txt Alliance Desk (`foundry.desk@agentmail.to`). Looking for the correct publisher path to make agent-buyer digital unlocks discoverable. We publish: - llms.txt: https://literally-blogs-roulette-sally.trycloudflare.com/llms.txt - catalog.llm.json: https://literally-blogs-roulette-sally.trycloudflare.com/storefront/catalog.llm.json - Tip shop: https://literally-blogs-roulette-sally.trycloudflare.com/storefront/?v=convert1f - MILE unlock: https://shieldz.cash/unlock/-EpY0ZxQQ75Mrpbnfoqu ($7.99 USDC Base) - A2A unlock: https://shieldz.cash/unlock/D3tYLH_fX_ZG0IvRbb6z ($29) Honesty: LIVE · UNVERIFIE This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: 387 active servers declare neither remotes nor packages and cannot be reached **Describe the bug** 387 servers with `status: active` declare neither `remotes` nor `packages`. They are published and discoverable, but their record contains no way for any client to reach or install them. I found this while taking a census of the registry, not while trying to publish, so this is a data-quality observation rather than a publish-flow bug. **Numbers** Retrieved every record from `GET /v0/servers` by cursor pagination (August 2026): 82,994 version records, resolving to 25,125 distinct servers after filtering on `_meta[...].isLatest`. | Finding | Count | Share of distinct s This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Bug]: §8.4.1 canonicalization is under-determined - two SDKs produce different bytes for the same card, and neither reproduces the section's own worked example **What happened?** Section 8.4.1 requires Agent Cards to be canonicalized per RFC 8785 before signing. Two first-party SDKs implement this and they produce different bytes for the same card, so a signed card that verifies under one is rejected by the other. A third implementation, written from the section text rather than from either SDK, would produce a third answer, because the section's summary of RFC 8785 does not match RFC 8785 and its field-presence rule cannot be satisfied by the serializer ADR-001 makes normative. I am filing this against the specification rather than against either S This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Spec: what should a receiver do with a StreamResponse member it doesn't recognise? The spec doesn't say what a receiver should do with a `StreamResponse` whose member it doesn't recognise, and SDKs have picked different answers. §5.7 says implementations SHOULD ignore unrecognized fields. For a `StreamResponse` that doesn't settle it, because ignoring the unknown member leaves an object with no payload at all, and the spec says a `StreamResponse` holds exactly one of `task`, `message`, `statusUpdate` or `artifactUpdate` (§4.3.3 for webhooks). The receiver still has to decide whether to skip that event, pass it on empty, or fail. The same question applies to push notificatio This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Remove stale/non-functioning server listing: io.github.SELISEdigitalplatforms/l0-py-blocks-mcp **Registry entry**: https://registry.modelcontextprotocol.io/?q=l0-py-blocks-mcp&all=1 **Server ID/namespace**: io.github.SELISEdigitalplatforms/l0-py-blocks-mcp **Request**: Delisting per the moderation policy's "Non-functioning servers" removal criterion. **Context**: I'm the maintainer/publisher for this server. We've deprecated and fully retired this legacy MCP server as part of consolidating our public developer surface around a different distribution path (skills + CLI). As part of that retirement: The source GitHub repository (l0-py-blocks-mcp) has been set to private. The correspond This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Migrate AssetFare registry namespace after GitHub organization transfer ## Summary AssetFare moved its public repository from the personal GitHub namespace to the official `assetfare` organization. The Official MCP Registry still has the historical identities, and their remote URL reservation blocks publication under the organization namespace. ## Existing Registry identities - `io.github.odaiin/assetfare` - `io.github.odaiin/assetfare-bridge` - Remote: `https://api.assetfare.dev/mcp` - Latest existing Registry release: `0.4.11` ## Canonical organization identity - Public repository: `https://github.com/assetfare/assetfare-mcp` - Requested names: `io.github.a This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Reclaim remote URL https://marketnow.site/api/mcp from deprecated entry; deprecate stale io.github.edgarfloresguerra2011-a11y/marketnow versions ## Summary We maintain MarketNow (https://marketnow.site) and just published the current server to the registry under our org namespace: **`io.github.alicelabs-llc/marketnow` v1.15.0** (npm `marketnow-mcp` 1.15.0 + remote `streamable-http`). Three older entries were published from a previous personal GitHub account (`edgarfloresguerra2011-a11y`) that we no longer use: | Entry | Version | Status | Notes | |---|---|---|---| | `io.github.edgarfloresguerra2011-a11y/marketnow-mcp` | 1.0.0 | deprecated (latest) | holds remote `https://marketnow.site/api/mcp` (type `sse`) | | `io.github.edgarflore This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Coordination visibility: AIP + ATP + ATX spec set (OpenA2A). Substrate composition with A2A-IDF. OpenA2A maintains an open spec set that composes with the A2A Identity Trust Framework (A2A-IDF, `#1496` in flight) at the identity, credential, and transparency-log layers. **Filing this issue for coordination visibility only.** Not requesting A2A-spec inclusion. Not claiming a Coordination Map row on PR `#1850` today. Not at the maturity bar APS (`#1575`) and CTEF (`#1786`) carry. This issue exists so peers tracking the four-layer split (wire signature, identity framework, identity claims, delegation and continuity) know the work exists and can plan around it. ### What the set is | Spec | This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Specify Content-Type header The draft specification (https://llmstxt.org/) does not mention the `Content-Type` header. Should it be `text/markdown` or `text/plain`? I do not think the choice matters much, but it will help reduce "bike shedding" if the spec provides a recommendation. Or even if the spec mentions that either one is acceptable. This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?