AgentCollusionAI security startupAgent Card
Scanner.
Understand the card before you connect. Inspect A2A declarations and signatures, then take the evidence into your workflow.
Free public beta. No account required.
01 / Inside an inspection
From a card
to a clear report.
- Input
A public URL, or the card itself.
Enter a public domain or an exact Agent Card URL, paste JSON in the Web app, or inspect a local file with the CLI. You can check cards that are already published.
- Checks
Declarations, signatures, and your policy.
The scanner retrieves and parses the card, examines selected core fields, interface URLs and authentication declarations, then verifies supported signatures against permitted public keys. Your chosen policy determines the pass or fail result.
- Output
Findings you can act on and keep.
Review findings with severity, rule IDs, evidence and suggested fixes, alongside signature states and the policy result. Export the JSON report. URL inspections also record retrieval time, the final URL and a content digest.
02 / In your workflow
Less manual checking.
More usable evidence.
Before you publish
Find specific issues in your card, follow the suggested fixes, and run the same checks again before a release.
Before you integrate
Replace scattered notes with a structured report. Bring a precise finding to the provider, or retain the JSON for your own review.
03 / Get started
Your browser.
Your terminal.
Web
Open the scanner, enter a public URL or paste JSON, and inspect the result. The built-in example lets you try a fictional card immediately.
Pasted JSON is sent to the service for inspection. Use the CLI when the file needs to stay on your device.
Open scannerCLI
Use local files, retain JSON results, and repeat checks in your own workflow. Local verification stays offline by default. Requires Node.js 22 or later.
npm install --global https://scan.agentcollusion.ai/downloads/agent-card-scanner-0.3.0.tgzA first check,
with a clear scope.
An unsigned card can pass the default policy. If your workflow requires a valid signature, enable that requirement. Signature evidence and the policy decision are reported separately.
The scanner inspects declarations and supported signatures. It does not run agent tasks, certify runtime safety, establish operator identity, or prove collusion.
Read the methodology
