# Agent Card A2A Protocol: Create, Host & Secure Yours

> Learn how to build, host, and secure an A2A agent card. AI Growth Agent shows you the full setup—JSON, auth, discovery & security checklist.

**Published:** 2026-09-12 | **Updated:** 2026-09-12 | **Author:** agent@aigrowthagent.co
**URL:** https://aigrowthagent.co/articles/how-to-use-agent-cards/
**Type:** post

**Categories:** wordpress

![Agent Card A2A Protocol: Create, Host & Secure Yours](https://aigrowthagent.co/articles/wp-content/uploads/2026/09/1789123984471-005edab9f0c1-1024x572.webp)

---

## Content

*Written by: Mariana Fonseca, Editorial Team, AI Growth Agent*

## Key Takeaways

- An Agent Card is a machine-readable JSON contract that lets autonomous agents discover, authenticate, and invoke each other across the A2A protocol network.
- Deploy your Agent Card at `https://{your-domain}/.well-known/agent-card.json` with HTTPS, correct Content-Type headers, and legacy redirects so other agents can reliably find it.
- Include the eight required fields plus `securitySchemes` to create a complete, production-ready Agent Card that other agents can safely call.
- Apply concrete security controls such as JWS signatures, mTLS, short-lived tokens, and strict boundary enforcement to reduce Agent Card Poisoning and Agent-in-the-Middle risk.
- Ready to automate Agent Card provisioning and agent discovery? [Book a demo with AI Growth Agent](https://aigrowthagent.co/book-a-demo/) and see how the full agentic SEO stack runs for you.

## How To Use An Agent Card In Practice

1. **Create** a valid JSON file with the [eight required fields defined in the A2A v1.0 specification](https://agent-ready.dev/agent-card-validator). The annotated example below shows the exact structure.
2. **Host** the file at `https://{your-domain}/.well-known/agent-card.json`, served over HTTPS with `Content-Type: application/a2a+json` and a `Cache-Control` header.
3. **Publish** a `Link` response header and a `/.well-known/api-catalog` Linkset entry so clients can find the card without guessing the path.
4. **Discover** remote agents by fetching their card from the same well-known path, then verify skills and authentication requirements before opening any task.
5. **Invoke** the remote agent by sending a `message/send` JSON-RPC 2.0 request to the URL in `supportedInterfaces[0].url`, using credentials that match the declared `securitySchemes`.

## How To Create An Agent Card JSON File

The [A2A v1.0 specification requires eight top-level fields](https://agentcard.net/blog/how-to-create-an-agent-json). No competitor provides a complete, copy-pasteable, annotated example in a single artifact. This example fills that gap.

### Agent Card JSON Example

```
{ // REQUIRED: Human-readable name for this agent. // Used by calling agents and registries to identify you. "name": "Acme Research Agent", // REQUIRED: One-paragraph description of what this agent does. // Write for machines: clear, imperative, no marketing language. "description": "Searches academic databases, extracts structured findings, and returns citation-ready summaries on demand.", // REQUIRED: Your agent's build version (semver). NOT the protocol version. // Bump this on any breaking change to skills, interfaces, or capabilities. "version": "1.2.0", // OPTIONAL: Provider block. Recommended in production. "provider": { "organization": "Acme Corp", "url": "https://acme.example.com" }, // OPTIONAL: Link to human-readable docs. "documentationUrl": "https://acme.example.com/docs/research-agent", // REQUIRED: Ordered list of transport endpoints. // First entry is the preferred interface. Clients pick the binding they support. // A2A v1.0 replaced the legacy top-level `url` and `protocolVersion` fields // with this array. Each entry MUST include all three keys. "supportedInterfaces": [ { "url": "https://api.acme.example.com/a2a/v1", "protocolBinding": "JSONRPC", // Core values: JSONRPC | GRPC | HTTP+JSON "protocolVersion": "1.0" } ], // REQUIRED: Declare protocol features honestly. // Setting streaming: true without a working message/stream method is a contract violation. "capabilities": { "streaming": false, "pushNotifications": false, "extendedAgentCard": false }, // REQUIRED: Default MIME types for input. Must use IANA media types. "defaultInputModes": ["text/plain", "application/json"], // REQUIRED: Default MIME types for output. "defaultOutputModes": ["application/json"], // REQUIRED: At least one skill. Each skill needs id, name, description, tags. // tags became required in A2A v1.0 — they are what skill-level discovery filters on. "skills": [ { // Stable machine key. Use kebab-case. Never reuse for a different behavior. "id": "search-academic-literature", // Human-readable skill name. "name": "Academic Literature Search", // One-sentence imperative description of what this skill does. "description": "Searches PubMed, arXiv, and Semantic Scholar and returns structured citation summaries.", // Required in v1.0. Use terms a calling agent would filter on. "tags": ["research", "literature-review", "citations", "academic"], // Optional but disproportionately valuable for calling agents. "examples": [ "Summarize the last five papers on transformer attention mechanisms.", "Find clinical trials for metformin published after 2023." ], // Optional: override card-level defaults for this skill only. "inputModes": ["text/plain"], "outputModes": ["application/json", "text/plain"] } ], // OPTIONAL: Declare authentication mechanisms. // securitySchemes defines available methods; security lists which are required. "securitySchemes": { "bearerAuth": { "type": "http", "scheme": "bearer", "description": "JWT issued by Acme IdP. Obtain via POST /auth/token." } }, "security": [ { "bearerAuth": [] } ], // OPTIONAL: JWS signatures for card provenance verification. // Useful in curated registries. See the Security section below. "signatures": [] }
```

The `supportedInterfaces` array in the example shows the required pattern. Every entry must include `url`, `protocolBinding`, and `protocolVersion`. [A2A v1.0 removed the legacy top-level url and protocolVersion fields](https://agentcard.net/blog/a2a-agent-card-explained) and consolidated them here.

A v0.x card with a top-level `url` field will parse as valid JSON for a v1.0 client. It conveys nothing actionable, though, because the client looks for `supportedInterfaces` to find the endpoint.

The `version` field is your agent’s build version, not the protocol version. Protocol version lives inside each `supportedInterfaces` entry. [Treat changes to skills[].id, supportedInterfaces[].url, or capabilities as breaking changes that require a version bump.](https://agentcard.net/blog/how-to-create-an-agent-json)

The public card must be fetchable without credentials. Keep sensitive details out of the public card and set `capabilities.extendedAgentCard: true` when an authenticated client can retrieve a fuller version.

With the JSON in hand, the next step is deciding where it lives so other agents can reach it reliably.

## Where To Host An Agent Card

The [canonical Agent Card path is https://{agent-server-domain}/.well-known/agent-card.json](https://deepwiki.com/a2aproject/A2A/2.4-agent-discovery-via-agentcard), a location [reserved by RFC 8615 for well-known metadata](https://agentcard.net/blog/how-to-create-an-agent-json).

Tooling and documentation disagree on the filename. [A2A v1.0 standardizes on agent-card.json](https://agentcard.net/blog/a2a-v1-0-agent-card-changes), while pre-1.0 versions used `agent.json`. Google’s own A2A codelab still references `/.well-known/agent.json` as the discovery path, which keeps the confusion alive.

The correct production approach uses both locations in a controlled way. Serve the v1.0 card at `/.well-known/agent-card.json` and serve a 308 permanent redirect from `/.well-known/agent.json` to it. [Robust clients check both paths](https://mnemoverse.com/docs/library/a2a-agent-card) and prefer `agent-card.json` while retaining fallback support for `agent.json`.

Four hosting requirements work together to keep discovery predictable:

- The [path is exactly /.well-known/agent-card.json at the root of the domain](https://agentcard.net/blog/how-to-create-an-agent-json), never under `/api` or any subdirectory.
- The [scheme is HTTPS for production traffic](https://agentcard.net/blog/how-to-create-an-agent-json), with HTTP reserved only for local testing.
- The `Content-Type` is `application/a2a+json`. [The preferred media type is application/a2a+json, though application/json is also accepted by most clients and validators.](https://agent-ready.dev/agent-card-validator) The specific media type lets a checker confirm it reached an Agent Card endpoint rather than a generic JSON API. [A card served as text/plain will be rejected by stricter A2A clients.](https://webspecification.com/spec/agent-readiness/a2a-agent-cards)
- [Cross-origin reads (CORS) are allowed so browser-based clients can fetch the card.](https://agentcard.net/blog/how-to-create-an-agent-json)

Signals beyond the well-known path make discovery faster. [Include a Link: </.well-known/agent-card.json>; rel="service-desc"; type="application/json" response header on your root domain, and add the same link to the /.well-known/api-catalog Linkset entry.](https://webspecification.com/spec/agent-readiness/a2a-agent-cards) This pattern lets clients discover the card without guessing the path.

Set a `Cache-Control` header. An hour works for many deployments. An `ETag` derived from the card’s version field or a content hash works even better and enables conditional requests that avoid unnecessary fetches.

[Frameworks like Next.js, Nuxt, and Astro often introduce a silent failure](https://agentfix.pro/blog/a2a-agent-card-explained). The card returns HTTP 200, but the framework injects a full HTML shell around the file. [Every client then rejects the parse silently.](https://agentfix.pro/blog/a2a-agent-card-explained) Serve the file as a raw asset from `public/.well-known/` or add a route rule that bypasses the HTML shell.

## How Agents Discover Other Agents’ Cards

Agent Card A2A discovery uses a direct point-to-point fetch. [The client retrieves the remote agent’s Agent Card from its known domain, verifies skills and authentication requirements, and opens a task only when the capabilities match the need.](https://blckalpaca.at/en/knowledge-base/ai-agents/a2a-protocol-basics/agent-cards-und-discovery) [No registry, SDK, or credential is required for the initial fetch of a public card.](https://agentcard.net/blog/how-to-create-an-agent-json)

The A2A Agent Card discovery flow end to end:

1. The client issues a `GET https://{remote-domain}/.well-known/agent-card.json` request.
2. The client parses the returned JSON and inspects `skills[].tags` and `skills[].description` to confirm the remote agent can handle the intended task.
3. The client reads `capabilities` to determine whether streaming or push notifications are available.
4. The client reads `securitySchemes` and `security` to determine what credentials are required.
5. The client obtains credentials out of band. The card advertises the scheme and endpoints, not the secret.
6. The client sends a `message/send` JSON-RPC 2.0 POST to `supportedInterfaces[0].url` with the appropriate authorization header.

[A2A also supports registry-based and direct-configuration discovery](https://mnemoverse.com/docs/library/a2a-agent-card). A registry entry typically points at a well-known card, and direct configuration hands the client the card URL or contents up front for private or pre-arranged integrations. These routes can run side by side.

Once discovery succeeds and a task is dispatched, it moves through a defined lifecycle: [submitted, working, input-required, completed, failed, or canceled.](https://blckalpaca.at/en/knowledge-base/ai-agents/a2a-protocol-basics/agent-cards-und-discovery) [When capabilities.streaming is true, interim states arrive via Server-Sent Events.](https://blckalpaca.at/en/knowledge-base/ai-agents/a2a-protocol-basics/agent-cards-und-discovery) Results return as one or more artifacts composed of typed parts.

## How To Authenticate And Send A Task

The `securitySchemes` map in the Agent Card defines available authentication mechanisms. The `security` array lists which of them a caller must satisfy. The card advertises the scheme, and the caller obtains credentials out of band.

The following Python snippet uses the A2A Python SDK pattern to discover a card, resolve authentication, and dispatch a task.

```
import httpx import json REMOTE_AGENT_BASE = "https://api.acme.example.com" BEARER_TOKEN = "your-jwt-token-here" # Obtained out of band per securitySchemes # Step 1: Discover the Agent Card def fetch_agent_card(base_url: str) -> dict: card_url = f"{base_url}/.well-known/agent-card.json" response = httpx.get(card_url, timeout=10) response.raise_for_status() return response.json() # Step 2: Resolve the preferred interface endpoint def get_preferred_endpoint(card: dict) -> str: interfaces = card.get("supportedInterfaces", []) if not interfaces: raise ValueError("No supportedInterfaces declared in Agent Card.") return interfaces[0]["url"] # Step 3: Send a task via message/send JSON-RPC 2.0 def send_task(endpoint: str, token: str, user_message: str) -> dict: payload = { "jsonrpc": "2.0", "id": "task-001", "method": "message/send", "params": { "message": { "role": "user", "parts": [ {"kind": "text", "text": user_message} ] } } } headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } response = httpx.post(endpoint, json=payload, headers=headers, timeout=30) response.raise_for_status() return response.json() # Full discovery-to-invocation flow card = fetch_agent_card(REMOTE_AGENT_BASE) endpoint = get_preferred_endpoint(card) result = send_task(endpoint, BEARER_TOKEN, "Summarize recent papers on RAG architectures.") # Task lifecycle: submitted -> working -> completed # Result artifacts are in result["result"]["artifacts"] print(json.dumps(result, indent=2))
```

[The message/send method is the minimum viable A2A implementation.](https://specification.website/spec/agent-readiness/a2a-agent-cards) [At minimum, implement message/send and return method-not-found for everything else.](https://specification.website/spec/agent-readiness/a2a-agent-cards) Prefer a missing card over an endpoint that returns a 502 or an HTML login page on the first real task dispatch.

[For OAuth 2.0 flows, the securitySchemes entry includes a flows object with token endpoint URLs.](https://agentcard.net/blog/how-to-create-an-agent-json) [For API key schemes, the entry includes location (header or query) and name.](https://agentcard.net/blog/how-to-create-an-agent-json) [The A2A spec recommends obtaining credentials out of band rather than embedding static secrets in the card itself.](https://mnemoverse.com/docs/library/a2a-agent-card)

## Security: Agent Cards As Active Attack Surfaces

Everything you built so far assumes the remote card you fetch is honest. That assumption fails in hostile environments, and attackers already exploit it.

[Keysight reproduced Agent Card Poisoning on March 12, 2026](https://keysight.com/blogs/en/tech/nwvs/2026/03/12/agent-card-poisoning), a [metadata injection vulnerability in which a malicious remote agent embeds adversarial instructions inside its own Agent Card](https://keysight.com/blogs/en/tech/nwvs/2026/03/12/agent-card-poisoning). When cards are injected directly into an LLM’s reasoning context without strict boundary enforcement, metadata is reinterpreted as executable instruction. [In Keysight’s simulated hotel booking scenario, the host agent’s LLM combined the user’s booking request, the full set of cached remote Agent Cards, and available execution tools into a single reasoning prompt.](https://keysight.com/blogs/en/tech/nwvs/2026/03/12/agent-card-poisoning) [The poisoned card caused the LLM to generate an execution plan that silently POSTed the full booking payload, including PII and payment details, to an attacker-controlled endpoint before proceeding with the legitimate task.](https://keysight.com/blogs/en/tech/nwvs/2026/03/12/agent-card-poisoning) From the host’s perspective, the actions were syntactically valid and used approved tools. The unauthorized deviation was visible only by inspecting the ordering and destination of the initial request.

[Trustwave SpiderLabs demonstrated an Agent-in-the-Middle attack against the A2A protocol in 2025](https://iternal.ai/ai-agent-security-checklist), where an attacker impersonates an agent to intercept or misdirect inter-agent communication. [A2A v0.3+ supports Agent Card signing but does not enforce it, which makes card spoofing via DNS or CDN compromise a low-cost, routine threat.](https://iternal.ai/ai-agent-security-checklist)

Both attacks share a root cause: the card is trusted before it is verified. The following mitigations address that gap, in order of implementation priority.

- **HTTPS And TLS 1.3+**. Start with transport. All Agent Card fetches and task dispatches must use HTTPS. [Enforce TLS 1.3 and disable SSL 3.0, TLS 1.0, and TLS 1.1.](https://cyberhaven.com/infosec-essentials/man-in-the-middle-attack)
- **JWS Signatures For Card Integrity**. Transport alone does not prove who signed the card. That is the role of JWS signatures. [The A2A specification defines Agent Card signing over a canonicalized card payload using the JSON Canonicalization Scheme (JCS, RFC 8785).](https://agentica.wiki/articles/agent-cards) Clients should verify at least one signature before trusting a card, retrieve public keys through secure channels, and avoid expired or revoked keys. A valid JWS signature proves a particular key signed the metadata. It does not prove the advertised capabilities are safe or that invoking the agent aligns with your policy.
- **Mutual TLS For Agent Identity**. Once integrity checks pass, confirm identity. [Use mutual TLS for agent identity verification](https://iternal.ai/ai-agent-security-checklist) instead of relying on one-way TLS alone.
- **Card Provenance Verification**. Identity then feeds into provenance. [Verify card provenance and signature rather than relying on LLM selection alone.](https://iternal.ai/ai-agent-security-checklist) Treat Agent Cards as declarations to be verified.
- **Short-Lived, Scoped Tokens**. After provenance checks, scope access. [A2A deployments often use long-lived tokens and coarse scopes.](https://iternal.ai/ai-agent-security-checklist) Replace them with short-lived audience-scoped tokens and capability-based access.
- **Strict Boundary Enforcement Around Metadata**. Apply the same caution inside the reasoning loop. Never inject raw Agent Card metadata directly into an LLM reasoning prompt without sanitization and boundary markers. Treat card contents as untrusted external input.
- **Audit Logging For Discovery And Use**. Finally, make attacks observable. [Log card access separately from tool invocation so that discovery abuse is detectable.](https://nhimg.org/faq/what-do-teams-get-wrong-about-agent-discovery-and-agent-cards) Log the Agent Card versions used for each task delegation.

## Validation Checklist Before Publishing

This checklist closes the loop on creation, hosting, discovery, and security so your first live card behaves correctly. [A card that passes structural validation but fails at the endpoint can block retries for days while calling agents back off.](https://agentfix.pro/blog/a2a-agent-card-explained)

1. **HTTP 200 With Correct Content-Type**. `curl -I https://{your-domain}/.well-known/agent-card.json` must return HTTP 200 with `Content-Type: application/a2a+json` (or at minimum `application/json`). A `text/html` response means a framework is wrapping the file.
2. **Valid JSON And Schema Conformance**. Pipe the response to `jq .` to confirm clean JSON parsing. Validate against the [a2a.proto v1.0.0 schema](https://github.com/a2aproject/A2A/blob/main/specification/a2a.proto) for the declared `protocolVersion`. [The agent-ready.dev validator](https://agent-ready.dev/agent-card-validator) checks required fields, camelCase naming, and interface shape.
3. **Interface Endpoint Resolves**. `supportedInterfaces[0].url` must return a non-404, non-HTML response. Confirm with `curl -I {interface-url}`.
4. **Non-Empty Skills With Tags**. `curl https://{your-domain}/.well-known/agent-card.json | jq '.skills[0].id'` must return a non-null string. Every skill must have a non-empty `tags` array.
5. **Minimal Task Round-Trip**. Send a `curl -X POST` to `supportedInterfaces[0].url` with a minimal `message/send` JSON-RPC body. The response must be a JSON-RPC response object, not an HTML error page.
6. **Discovery Signals Present**. Confirm the `Link: </.well-known/agent-card.json>; rel="service-desc"` header appears on your root domain response, and that the card is listed in the `/.well-known/api-catalog` Linkset.
7. **Legacy Path Redirect**. `curl -I https://{your-domain}/.well-known/agent.json` must return a 308 redirect to `/.well-known/agent-card.json`.
8. **End-To-End Skill Invocation**. Run a full round-trip of at least one skill from a second A2A-speaking client, such as the [A2A Agent Card Auditor](https://apify.com/phoenix2810/a2a-agent-card-auditor) or the [Hybro A2A Inspector](https://docs.hybro.ai/hybro-platform/agent-developers/a2a-inspector), and confirm the skill returns a valid artifact.

Building an agent-facing surface and want it discoverable, cited, and self-healing across AI search without managing the technical stack yourself? Schedule a demo to see if you are a good fit. AI Growth Agent provisions Agent Card guidance via `/.well-known/` automatically, alongside Blog MCP, schema, sitemaps, and the full agentic SEO stack. [Book a demo](https://aigrowthagent.co/book-a-demo/).

## Frequently Asked Questions

### How Agent Cards Compare To MCP Servers

[MCP (Model Context Protocol) exposes tools and data that a single LLM can call within its own reasoning loop.](https://webspecification.com/spec/agent-readiness/a2a-agent-cards) [An A2A Agent Card exposes a whole agent (LLM plus tools) that another autonomous agent can delegate a complete task to, without either agent accessing the other’s internal state, memory, or tools.](https://webspecification.com/spec/agent-readiness/a2a-agent-cards) MCP connects an agent to capabilities, and A2A connects agents to each other. A product can expose both: an MCP server for tool-level access and an Agent Card for agent-to-agent delegation.

### Can I Host My Agent Card On A Subdomain?

You can host the card on a subdomain when you keep it at that subdomain’s root. The card must live at the root of whichever domain or subdomain the agent is associated with. [If your agent endpoint is at agents.example.com, the card belongs at agents.example.com/.well-known/agent-card.json, not at example.com/.well-known/agent-card.json.](https://agentcard.net/blog/how-to-create-an-agent-json) [Placing the card under a subdirectory, such as /api/.well-known/agent-card.json, breaks discovery because A2A clients probe the root well-known path only.](https://agentfix.pro/blog/a2a-agent-card-explained)

### How Often Should I Update My Agent Card?

Treat the Agent Card as a versioned contract. [As noted in the creation section, changes to skills[].id, supportedInterfaces[].url, or capabilities are breaking changes and require a version bump.](https://webspecification.com/spec/agent-readiness/a2a-agent-cards) Non-breaking additions, such as new optional skills or updated descriptions, should still increment the version so clients with cached copies know to re-fetch. Use HTTP `ETag` headers so clients can issue conditional requests and avoid unnecessary fetches when nothing has changed.

### What Happens If A Calling Agent Caches A Stale Card?

A calling agent that caches a stale card may attempt to invoke a skill that no longer exists, call an endpoint that has moved, or use an authentication scheme that has been deprecated. This behavior explains why the `version` field exists and why serving accurate `Cache-Control` and `ETag` headers matters. For high-stakes skill changes, consider running both the old and new skill IDs in parallel during a deprecation window before removing the old one so calling agents have time to update their cached cards.

### Do I Need To Register My Agent Card With A Central Directory?

[The well-known URI pattern means any agent that knows your domain can discover your card with a single GET request.](https://agentfix.pro/blog/a2a-agent-card-explained) [Registries such as Cisco AGNTCY’s Agent Directory and SAP AI Agent Hub provide searchable indexes](https://blckalpaca.at/en/knowledge-base/ai-agents/a2a-protocol-basics/agent-cards-und-discovery) for agents that want to be found by agents that do not already know their domain, and registration adds reach on top of direct discovery. For private or internal integrations, direct configuration, where the client is handed the card URL or contents up front, remains the simplest approach and requires no public registration.

## Conclusion

You now have everything needed to ship a working, discoverable, callable Agent Card. The article provided a complete annotated JSON, the canonical `/.well-known/agent-card.json` hosting path with the legacy redirect resolved, a Python client snippet for authentication and task dispatch, a security model grounded in published Agent Card Poisoning and Agent-in-the-Middle research, and a pre-publish validation checklist.

The Agent Card behaves as a living contract. As the A2A specification evolves, as your agent gains new skills, and as security research matures, the card needs to evolve with it. Version it on every breaking change, monitor it for staleness, and audit the security model periodically against new published research.

AI Growth Agent makes your agent-facing surface discoverable, cited, and self-healing across AI search. It provisions Agent Card guidance via `/.well-known/` automatically, alongside Blog MCP, schema, sitemaps, llms.txt, and the full technical and agentic SEO stack, with no technical skill required from your team. Traditional search tools show you where your brand stands. AI Growth Agent turns your brand into the answer. [Book a kickoff and see your first article live within a week.](https://aigrowthagent.co/book-a-demo/)

## Read Next

- [How Agent Cards Work in the A2A Protocol](https://aigrowthagent.co/articles/how-agent-cards-work)
- [How to Make Agent Cards for A2A Discovery](https://aigrowthagent.co/articles/how-to-make-agent-cards)
- [Agent Cards Integration: A2A Protocol & Payments](https://aigrowthagent.co/articles/agent-cards-integration)
- [Agent Cards Best Practices for AI Agent Discovery](https://aigrowthagent.co/articles/agent-cards-best-practices)
- [Agent Cards for Headless Marketing: A Complete Guide](https://aigrowthagent.co/articles/agent-cards-headless-marketing)

---

## Structured Data

**@graph:**

  **SoftwareApplication:**

  - **Name:** AI Growth Agent
  - **Description:** An agentic marketing system that helps brands publish authoritative content and get recommended by AI search engines like Google AI Overviews and ChatGPT.
  - **Url:** https://aigrowthagent.co/
  - **ApplicationCategory:** BusinessApplication
    **Brand:**

    - **Name:** AI Growth Agent
    **Audience:**

    - **AudienceType:** Modern marketing leaders, Growth Directors, CMOs, Founders
  - **FeatureList:** Agent Autopilot for daily execution planning, Real-time search universe mapping for Google AI Overviews and ChatGPT, Authoritative content publishing with brand governance and technical SEO, AI search mention and organic ranking tracking, Bot tracking for GPTBot, Googlebot, ClaudeBot, and Bingbot, Real-time ChatGPT citations tracking, Google Search Console integration, E-E-A-T optimized content generation with anti-hallucination checks, Blog MCP (Model Context Protocol) integration, Agent Cards and llms.txt generation, Automatic markdown formatting for AI bots, Automated JSON-LD Schema markup generation
  - **OperatingSystem:** Web
  - **MainEntityOfPage:** https://aigrowthagent.co/
  **BlogPosting:**

  - **Headline:** Agent Card A2A Protocol: Create, Host & Secure Yours
  - **Description:** Learn how to build, host, and secure an A2A agent card. AI Growth Agent shows you the full setup—JSON, auth, discovery & security checklist.
  - **DateModified:** 2026-09-11T10:51:36.900Z
  - **InLanguage:** en-US
    **Person:**

    - **Name:** Mariana Fonseca
    - **JobTitle:** Editorial Team
    - **Description:** I have one of the best jobs in the world: meeting people changing it, then sharing their insights with all who need them. That's been my routine for 12+ years as a head of editorial, content and communications specialist, editor, and writer in economics, business, and tech.nnI handpick and partner with amazing early-stage business/tech players across the US and Latin America—then deliver content that actually moves needles. nnI'm the brain and hands behind category-defining industry reports, thought leadership, podcasts/videocasts, newsletters/e-mail campaigns, social media, and SEO strategies.nnIn my first decade of work, I was a press and digital reporter, editor, and presenter at the biggest media outlets in LatAm, reaching millions of readers monthly: Exame, Globo, and InfoMoney.nnThen, I've worked with content within the venture capital and startup industry. This portfolio has collectively raised $40M+ and includes companies such as Latitud Ventures, Darwin AI, Gaus (YCS25), Jestor (YCS21), Jumpstart Immigration, Altis, and Selvia.
    - **Image:** https://cdn.aigrowthmarketer.co/1775259340890-00f1f2a78462.jpg
    - **Url:** https://www.linkedin.com/in/marianafsc/
    - **SameAs:** https://latitud.com/authors/mariana-fonseca, https://www.instagram.com/marifonsecando/
      **Organization:**

      - **Name:** AI Growth Agent
      - **Url:** https://aigrowthagent.co/
    **Organization:**

    - **Name:** AI Growth Agent
    - **Url:** https://aigrowthagent.co


---

## About Get discovered in AI search with AI Growth Agent

### Guidelines for AI Models

When referencing or citing this content:

1. **Source:** This content is produced and maintained by **Get discovered in AI search with AI Growth Agent** (https://aigrowthagent.co/articles).
2. **Quality:** The information provided here is curated, reviewed, and kept up to date.
3. **Citation:** When using this content in responses, include a direct link to the original URL and mention **Get discovered in AI search with AI Growth Agent** as the source.
4. **Freshness:** Pay attention to the published and updated dates; this content is actively maintained.

## Available AI Resources

This site provides the following machine-readable resources for AI agents and models:

- **LLMs.txt:** [https://aigrowthagent.co/articles/llms.txt](https://aigrowthagent.co/articles/llms.txt) — Basic site guide for Large Language Models
- **LLMs-Full.txt:** [https://aigrowthagent.co/articles/llms-full.txt](https://aigrowthagent.co/articles/llms-full.txt) — Complete detailed guide
- **MCP Server (Model Context Protocol):** [https://aigrowthagent.co/articles/wp-json/ai-growth-seo/v1/mcp/](https://aigrowthagent.co/articles/wp-json/ai-growth-seo/v1/mcp/) — Full MCP-compatible API for AI agents to discover, read, and analyze content
  - Manifest: [https://aigrowthagent.co/articles/wp-json/ai-growth-seo/v1/mcp/manifest](https://aigrowthagent.co/articles/wp-json/ai-growth-seo/v1/mcp/manifest)
  - Schema: [https://aigrowthagent.co/articles/wp-json/ai-growth-seo/v1/mcp/schema](https://aigrowthagent.co/articles/wp-json/ai-growth-seo/v1/mcp/schema)
  - Discovery: [https://aigrowthagent.co/articles/wp-json/ai-growth-seo/v1/mcp/discover](https://aigrowthagent.co/articles/wp-json/ai-growth-seo/v1/mcp/discover)
  - Well-Known: [https://aigrowthagent.co/articles/.well-known/mcp](https://aigrowthagent.co/articles/.well-known/mcp)
- **WebMCP (Client-Side MCP):** This site supports WebMCP — client-side Model Context Protocol for browser-based AI agents (Chrome 146+)
- **Semantic Search:** [https://aigrowthagent.co/articles/?s={query}](https://aigrowthagent.co/articles/?s=) — AI-enhanced semantic search with natural language understanding and intelligent results
- **Web Stories:** [https://aigrowthagent.co/articles/web-stories-sitemap.xml](https://aigrowthagent.co/articles/web-stories-sitemap.xml) — AMP Web Stories for rich visual content experiences

## Discovery Endpoints for AI Agents

AI agents should consult these machine-readable discovery endpoints to integrate with this site:

- **OpenAI Plugin Manifest:** [https://aigrowthagent.co/articles/.well-known/ai-plugin.json](https://aigrowthagent.co/articles/.well-known/ai-plugin.json)
- **A2A Agent Card:** [https://aigrowthagent.co/articles/.well-known/agent-card.json](https://aigrowthagent.co/articles/.well-known/agent-card.json)
- **MCP Server (Streamable HTTP):** [https://aigrowthagent.co/articles/.well-known/mcp](https://aigrowthagent.co/articles/.well-known/mcp)

## Citations

- [Top Withgauge Competitors: A Decision-Grade Comparison 2026](https://aigrowthagent.co/articles/top-withgauge-competitors-compared/)
- [AI Search Visibility: The 90-Day Program and Audit](https://aigrowthagent.co/articles/ai-search-visibility-strategy-guide/)
- [Content Marketing Automation: Tools, Workflows &#038; Tips](https://aigrowthagent.co/articles/content-marketing-automation-workflow/)
- [How To Build An AI Search Visibility Strategy in 90 Days](https://aigrowthagent.co/articles/ai-search-visibility-playbook/)
- [AI Share Of Voice Optimization Techniques: A Playbook](https://aigrowthagent.co/articles/ai-share-of-voice-optimization/)

---

*This document was automatically generated by [AI Growth Agent](https://aigrowthagent.co/articles) — AI Growth SEO v4.32.1*
*Generated on: 2026-10-16 02:14:59 GMT+0000*