Documentation

Interfaces and endpoints.

The Trust Plane exposes the same governed dispatcher through four interfaces: official A2A 1.0 JSON-RPC and REST, MCP Streamable HTTP, and a direct operator REST API. An agent credential is scoped to one tenant and one set of skills regardless of which interface it calls through.

Discover the agent

The public Agent Card is served without authentication and describes the service's declared skills and security schemes.

GET /.well-known/agent-card.json

Interfaces

A2A 1.0

JSON-RPC at /a2a/jsonrpc and HTTP+JSON at /a2a/rest. Both require an authenticated principal and share the same registry, policy, and evidence path as every other interface.

MCP

Authenticated MCP clients connect to /mcp. Exposed tools include operations_assess_package, discovery_scan_candidates, demo_counselorai_continuity, demo_breadcrumbs_memory, trial_assess, plan_status, billing_status, and billing_create_checkout.

Direct execute

POST /v1/execute runs one dispatcher skill for the authenticated principal. GET /v1/skills lists what your credential can call.

Audit

GET /v1/audit/verify independently checks that the append-only, digest-chained event log has not been altered.

Local quick start

Requires Node.js 20 or newer. This starts a local instance with a fixed, non-production development key, it is never valid outside localhost.

npm ci
$env:A2A_TRUST_INSECURE_DEV = "1"
npm start

Invoke-RestMethod `
  -Uri http://127.0.0.1:8787/v1/skills `
  -Headers @{ 'X-A2A-Trust-Key' = 'local-dev-key' }

Production deployments configure A2A_TRUST_API_KEYS with hashed, tenant-scoped credentials instead, see Security for the full production boundary.

Assessing your own agent

The bounded assessment checks a public A2A Agent Card and the operating controls you declare. It does not ingest repositories, message bodies, credentials, or customer records. Run it from the assessment page with a trial token, or from your signed-in account at /customer.

Support

Email jovan@the825.co for integration questions, plan changes, or a founding continuity proof engagement. See How It Works for the full request-to-receipt workflow and the account onboarding journey.