Protocol support
a2a-exposed speaks A2A 1.0 (primary) and 0.3 (compatible) on one JSON-RPC endpoint. The version is chosen by the A2A-Version header or by the method name.
Work is asynchronous. Peers read the result with GetTask or an HTTPS push URL.
A2A 1.0
SendMessage, GetTask, CancelTask, ListTasks, CreateTaskPushNotificationConfig, and GetTaskPushNotificationConfig. Enums are ProtoJSON (TASK_STATE_*, ROLE_*).
The card's supportedInterfaces lists 1.0 first and 0.3 second. securitySchemes has bearer and pairing. See agent card.
A2A 0.3
On the same endpoint: message/send, tasks/get, tasks/cancel, and tasks/pushNotificationConfig/set and get. The 0.3 card is /.well-known/agent.json.
OAuth
Device Authorization Grant (RFC 8628 (opens in a new tab)) at POST /oauth/device_authorization and POST /oauth/token. The approval page is /device. Metadata is /.well-known/oauth-authorization-server (RFC 8414 (opens in a new tab)). A 401 carries resource_metadata (RFC 9728 (opens in a new tab)).
MCP
POST /mcp is a remote MCP server (Streamable HTTP) for an agent address. Public-front mode and --mcp off leave it out.
| MCP version | Behaviour |
|---|---|
| 2026-07-28 | Stateless. Each request carries _meta. server/discover, tools/list, tools/call. No initialize session. |
| 2025-11-25, 2025-06-18, 2025-03-26 | initialize, then ping, tools/list, tools/call. JSON responses, no session. |
An unknown version returns -32022. Clients register with a Client ID Metadata Document or, for older clients, POST /oauth/register. Consent uses the approval password. Claude Code is in testing. See compatibility and Claude Code.
Public-front mode
Forwards SendMessage, GetTask and CancelTask (1.0 and 0.3). ListTasks and every push-notification call answer -32003. Streaming stays on the upstream. A call on another peer's task or context stops before the upstream. See public front.
Landing page
GET / with Accept: text/html is a small HTML page: name, description, skills, links to the card and to /device. The page is markup only. Other clients get JSON (name, description, agentCard, a2a, pairing), including ?format=json.
That page is the Worker's, on the agent's hostname. This website is the docs and the hosted service.