A2A protocol

Extend an agent card with a verifiable Vorim identity, and check the trust score of an agent that presents one to you before you act on what it says.

A2A Protocol Integration

The @vorim/a2a package adds identity and trust verification to Google's A2A (Agent-to-Agent) Protocol. Extend A2A Agent Cards with cryptographic identity and verify incoming agents before interacting.

npm · PyPI · Blog Post

Installation

# TypeScript
npm install @vorim/a2a

# Python (included in vorim >= 3.1.0)
pip install vorim

bash

Extend Your Agent Card

Add a vorimIdentity extension to your A2A Agent Card containing Ed25519 fingerprint, trust score, permission scopes, and a public verification URL.

import { createVorimA2A } from '@vorim/a2a';

const a2a = createVorimA2A({ apiKey: 'agid_sk_...' });

// Extend an existing Agent Card with Vorim identity
const card = await a2a.extendAgentCard(baseCard, 'agid_abc123');

// card.vorimIdentity = {
//   agentId: "agid_abc123",
//   publicKeyFingerprint: "a3f2...e91c",
//   trustScore: 82,
//   status: "active",
//   scopes: ["agent:read", "agent:execute"],
//   verifyUrl: "https://vorim.ai/v1/trust/verify/agid_abc123",
//   badgeUrl: "https://vorim.ai/v1/trust/badge/agid_abc123.svg",
//   verifiedAt: "2026-04-15T12:00:00Z"
// }

typescript

Verify Incoming Agents

Before interacting with another agent, verify their trust score via Vorim's public API. The live score is checked independently, not from the self-reported value on the card.

// Verify an incoming agent's identity and trust
const result = await a2a.verifyAgent(incomingAgentCard);

if (result.trusted) {
  console.log(`Verified: score ${result.score}, status ${result.status}`);
} else {
  console.log(`Rejected: ${result.reason}`);
  // "Trust score 32 is below minimum 50"
  // "Agent is suspended"
  // "Peer is missing required scope(s): agent:write"
}

// Verify with custom requirements
const strict = await a2a.verifyAgent(card, {
  minTrustScore: 70,
  requiredScopes: ['agent:read', 'agent:execute'],
});

typescript

Middleware

Wrap your A2A request handlers with automatic verification. Agents below your trust threshold are rejected before your code runs. By default the middleware fails closed on identity: it proves the caller controls the agent id (holder-of-key) via an extractProof / resolvePublicKey hook. Pass allowUnverifiedIdentity: true only if a trusted upstream already authenticated the caller.

// Auto-verify incoming A2A requests
const handler = a2a.middleware({
  minTrustScore: 70,
  requiredScopes: ['agent:read'],
  auditLog: true,      // log interactions as audit events
})(async (req) => {
  // Only reached if sender agent passes all checks
  const { vorimVerification } = req;
  console.log(`Trusted agent: score ${vorimVerification.score}`);
  return { status: 'ok' };
});

typescript

Create Agent Card from Scratch

const card = await a2a.createAgentCard({
  name: 'research-agent',
  url: 'https://my-agent.example.com',
  provider: { organization: 'Acme Corp' },
  skills: [{ id: 'research', name: 'Web Research', tags: ['search'] }],
  scopes: ['agent:read', 'agent:execute'],
});
// Returns a full A2A Agent Card with vorimIdentity extension

typescript

Python

from vorim.a2a import VorimA2A

a2a = VorimA2A(api_key="agid_sk_...")

# Extend an Agent Card
card = a2a.extend_agent_card(base_card, agent_id="agid_abc123")

# Verify an incoming agent
result = a2a.verify_agent(incoming_card, min_trust_score=60)
if result.trusted:
    print(f"Verified with score {result.score}")

# Create a new agent with A2A card
card = a2a.create_agent_card(
    name="research-agent",
    url="https://my-agent.example.com",
    scopes=["agent:read", "agent:execute"],
)

# Decorator middleware
@a2a.middleware(min_trust_score=70, required_scopes=["agent:read"])
def handle_task(request):
    return {"status": "ok"}

typescript

Discovery Endpoint

Serve your Vorim-extended Agent Card at /.well-known/agent.json for A2A discovery:

// Express example
app.get('/.well-known/agent.json', async (req, res) => {
  const card = await a2a.discoveryEndpoint('agid_abc123', {
    name: 'my-agent',
    url: 'https://my-agent.example.com',
    skills: [{ id: 'research', name: 'Web Research' }],
  });
  res.json(card);
});

typescript

Need Help?

Book a demo for a walkthrough, or contact us for support. For enterprise needs, reach out at sales@vorim.ai.