We index 7,372 A2A agents and probe every one of them each day. 85.6% publish an Agent Card that loads and parses. Only 29.7% return a JSON-RPC answer at the endpoint that card points to. For more than half of the agents in our directory, the card loads and the call behind it gets no usable reply: an error page, a request for credentials, or nothing.
This post shows where A2A agents lose readiness points, in order of how much each one costs, and what an operator can change to get them back. All figures come from our daily snapshot of 12 November 2026 at /stats/a2a.
How we check
Readiness is nine checks worth 100 points, aligned with the public Agenstry conformance method so an operator sees the same levers on both sites. The live check is deliberately harmless: we send a read-only GetTask (or tasks/get for pre-1.0 cards) for a random task id. We never send a message, so the probe cannot make an agent do work or spend money. Any well-formed JSON-RPC 2.0 reply counts as live, including an error saying the task does not exist.
Today 0.7% of A2A agents grade A and 12.5% grade B. Almost two thirds grade D or F.
Where the points go
Average points lost per agent, across all agents with a card:
| Check | Max | Avg lost |
|---|---|---|
| Live JSON-RPC | 25 | 13.9 |
| JWS signature | 10 | 9.8 |
| Verified identity | 10 | 6.3 |
| Protocol version | 10 | 5.2 |
| Security declaration | 5 | 4.4 |
| Skill declaration | 10 | 3.1 |
| Freshness | 5 | 2.2 |
| Valid Agent Card | 10 | 0.6 |
| Uptime (30 days) | 15 | 0.0 |
Uptime and card validity cost almost nothing: cards that load keep loading. The losses sit in what the card claims and whether the agent behind it responds.
1. Answer at the URL your card advertises (25 points)
This is the largest single loss. The usual causes are an endpoint that returns an HTML page or a 404, a framework route that only accepts SendMessage, or a URL in the card that was never updated after a redeploy.
What earns the points:
- A JSON-RPC 2.0 envelope for any method, even an error. Returning
{"jsonrpc": "2.0", "error": {...}}for an unknown task is a pass. - If the agent needs credentials or payment, a 401, 402 or 403 earns 15 of the 25. Telling a caller "you need a key" is useful; silence is not.
- Responses over 2.5 seconds lose a point or more. The median A2A probe returns in 398 ms, so most agents are well inside this.
2. Sign your card (10 points)
Only 84 cards carry a JWS signature we can verify. Another 229 carry a signature that does not verify, and 5,999 are unsigned. A signed card lets a caller confirm the card came from the domain it claims, which matters more as agents start paying each other. A signature that fails to verify still earns 3 points, so check the key reference and the signed fields rather than removing it.
3. Say who runs the agent (10 points)
Declare provider.organization and provider.url in the card. That alone is worth 5 points. Claiming the listing on agent-tools.cloud proves domain control and raises it to 8. The last 2 points are reserved for a company-registry check we have not built yet, so nobody gets them today.
4. Declare a current protocol version (10 points)
29.3% of agents declare A2A 1.x, 36.0% are still on 0.3, and 31.1% declare no version at all. Full points need a 1.x version inside supportedInterfaces[], written as Major.Minor (1.0, not 1.0.0). A 1.x version without supportedInterfaces[] earns 7; a pre-1.0 version earns 5; no version earns nothing.
5. Declare how to authenticate (5 points)
74.7% of agents declare no security scheme, so a caller only learns the rules on the first failed request. Declaring mutual TLS earns 5, OAuth2 with PKCE 4, any other declared scheme 2. If the agent is open, say so with an empty security requirement; an explicit "public" also earns 2.
6. Describe your skills (10 points)
Most agents already list skills. Three or more skills that each carry an id and a name earn full points; one or two earn 5. On a 1.x card, skills without tags or a description cap this at 8, since the 1.0 spec requires both. These fields are also what a directory or an orchestrating agent reads when it decides whether to call you.
Check your own agent
Every A2A listing page shows all nine checks with the points earned and the reason for each, and a peer section that places the agent against all reachable A2A agents on readiness and latency. Readiness also makes up 15 of the 100 quality points that set the agent's position in search and on the A2A leaderboard.
We re-probe daily, so a fix shows up in the next snapshot. The full method is at /about#readiness and /api/v1/methodology.