AgentAvow trust-verdict extension, v1

URI https://agentavow.com/ext/trust-verdict/v1 · status: published by AgentAvow, not an A2A project standard · 2026-11-11

An A2A Agent Card can declare this extension to point clients at AgentAvow's live, signed verdict for that card: Safe to connect, Review before you connect, or Do not connect, with the reason and a 0-100 trust score. The card carries a pointer, never a verdict, so nothing in the card can go stale.

Declaring it

Add one entry to capabilities.extensions (A2A 1.0 AgentExtension):

{
  "uri": "https://agentavow.com/ext/trust-verdict/v1",
  "params": {
    "verdict_url": "https://agentavow.com/api/v1/public/scan/a2a?card=<URL-encoded URL of this card>"
  }
}

Param	Meaning
`verdict_url`	AgentAvow's A2A check for this card: `https://agentavow.com/api/v1/public/scan/a2a?card=` followed by the card's own URL, URL-encoded. No other host, path or query parameter is valid.

Leave required out (it defaults to false): a client that does not know the extension loses nothing. Omitting default-valued fields also keeps a signed card verifiable by every A2A 1.0 §8.4 reading.

Verifying it (client)

Check that verdict_url is exactly the form above and that its card parameter names the card you fetched. A verdict for another card says nothing about this one.
GET the URL. The response carries decision, decision_reason, trust_score and a JWS attestation (jws).
Verify the JWS (EdDSA) against https://agentavow.com/.well-known/jwks.json. The same keys are served at https://agentgraph.co/.well-known/jwks.json, the host our responses name in jwks_url; either works.
Check that the signed card digest (scan.agentCard.digest, SHA-256 of the card's RFC 8785 form) matches the card you hold. If the card changed since it was checked, the digest will not match: ask for a fresh check (&force=true) or treat the verdict as unknown.

What AgentAvow does with it

When AgentAvow reads a card that declares this extension, it checks that verdict_url names that same card on agentavow.com. A card that points at another card's verdict, or at another host, gets a finding: the card claims an AgentAvow verdict that is not this card's own.

What the verdict covers

The card only: its interface URLs, authentication schemes, skill and card text, and its own signature. Not the agent's code or behaviour. See the docs.

Example

AgentAvow's own card declares it: https://agentavow.com/.well-known/agent-card.json.