One layer. Every agent protocol.

Fetch and normalize a delegate agent's .well-known/agent-card.json before trusting it.

Discover an MCP server's tools and transport from its well-known server card.

Resolve a service's /.well-known/api-catalog linkset and flag off-domain API descriptions.

Audit packaged skills for unsafe instructions before an agent loads them.

Browser-exposed page tools via navigator.modelContext (experimental).

Resolve an agent's OASF record from the AGNTCY (Internet of Agents) directory before trusting it.

Inspect a site's NLWeb natural-language endpoint and the schema it exposes to agents.

Resolve a PKI-anchored agent name-service record before connecting.

Resolve an agent handle to its signed AgentFacts document and verify capabilities, endpoints, and credentialed assertions before trusting it.

Resolve a site's /.well-known/agents.json (OpenAPI-based flows) and flag API sources served off the manifest's own domain.

The community MCP server registry (registry.modelcontextprotocol.io): resolve a server's published entry before connecting.

Deterministic API workflows: sequenced calls with explicit inputs and outputs that agents execute against OpenAPI-described services.

Ed25519 HTTP Message Signatures verify the AI agents that visit your site.

Verify a card's JWS and flag keys not anchored to the issuer's own domain.

Resolve an authorization server's metadata; score PKCE, implicit-flow, and domain-bound endpoints (verifies signed_metadata when present).

Verify an agent's decentralized identifier and control proof, the ANP identity layer.

Verify a standalone W3C VC 2.0 (Data Integrity or JOSE proof), the credential primitive under AP2 mandates and did:wba.

Verify an SD-JWT-based Verifiable Credential (the EU Digital Identity Wallet format): check the issuer JWS, recompute the selective-disclosure digests, and verify the optional key-binding JWT.

Verify the RFC 9421 agent-recognition signature and parse the signed consumer/intent proofs a TAP agent presents at checkout.

Verify a workload's JWT-SVID against its trust-domain bundle and flag federated (cross-trust-domain) identities.

Resolve a did:web identifier to its domain-hosted DID document and verify its Data Integrity control proof.

Resolve a credential issuer's /.well-known/openid-credential-issuer metadata and flag off-domain issuance endpoints.

The presentation side of OpenID4VC, an agent presenting verifiable credentials in response to a structured request.

On-chain agent identity, reputation, and validation registries (Ethereum). Resolving the on-chain agent card needs a chain-RPC adapter.

The open registry format (Cloudflare · Bedrock AgentCore) for discovering the public keys that sign agent HTTP requests.

The IETF WIMSE working group's standards-track workload identity for multi-system environments (workload identifiers, token profiles, HTTP-signature workload-to-workload auth), the successor companion to SPIFFE.

Preflight the transport interfaces an A2A delegate declares. Flag off-domain or non-HTTPS task-message routing before you send.

Check an MCP server's declared transport and endpoint. Flag off-domain or insecure message routing before you connect.

Inspect IBM/BeeAI ACP REST-native agent messages and manifests.

Govern AGNTCY Secure Low-latency Interactive Messaging between agents.

Govern decentralized agent-to-agent networking over ANP.

An agent-coordination layer for multi-agent messaging, orchestration, and payments between specialized agents.

Resolve protected-resource metadata to score a target's auth posture and named authorization servers.

Audit an agent-onboarding/credential-claim manifest and its identity providers.

Verify W3C Verifiable Credentials binding agent intent to user authorization.

Detect Identity-Assertion Authorization Grant (ID-JAG) support in OAuth metadata and assess the cross-app token-exchange posture (MCP authz SEP-990).

Detect sender-constrained (proof-of-possession) token support in OAuth metadata. DPoP makes a stolen agent token useless.

Detect the token-exchange grant in OAuth metadata, the delegation / down-scoping primitive behind on-behalf-of agent access.

Detect structured authorization_details support: fine-grained, per-resource permissions instead of coarse scope strings.

Detect the pushed-authorization-request endpoint (and whether the server requires it), a tamper-resistant request posture.

Detect resource-indicator support in OAuth metadata: per-resource token scoping that stops a stolen agent token from being replayed at another server (required by MCP authorization).

Resolve a Policy Decision Point's /.well-known/authzen-configuration and flag off-domain access-evaluation endpoints.

Grant Negotiation and Authorization Protocol, a next-generation alternative to OAuth designed for richer delegation.

The zero-touch MCP authorization extension: an identity provider mints an ID-JAG grant at sign-in and the client exchanges it for an MCP access token, with no per-user OAuth consent. Built on the Cross-App Access (ID-JAG) grant we already detect.

Detect scraping, enumeration, and probe patterns on inbound agent traffic.

Cache and enforce machine-readable crawl + AI-usage permissions.

Honor standardized train/infer/index content-usage preferences.

Honor publisher RSL licenses governing AI use of content.

Honor the W3C / EU TDM reservation at /.well-known/tdmrep.json, a machine-readable opt-out from text & data mining and AI training.

Honor Spawning's ai.txt, a robots-style declaration of which AI agents may use a site's content.

Honor Cloudflare's Content Signals Policy: a machine-readable Content-Signal line in robots.txt that declares search, ai-input, and ai-train usage permissions.

Tamper-evident content provenance: who/what created or edited media, and whether AI was involved. Verifying the embedded manifest is on the roadmap.

Cloudflare's HTTP 402 crawler-access marketplace: publishers price AI crawls and bots settle centrally. Preflighting the 402 charge bridges content permission and commerce.

Preflight an HTTP 402 payment demand. Verify the charged resource, pay-to address, asset, and network before an agent pays.

Validate a delegated payment allowance: capped amount, merchant binding, expiry, and network-token (not raw PAN) funding.

Validate UCP agent-checkout discovery and lifecycle (Google · Shopify).

Govern in-band machine-to-machine HTTP payments (Stripe · Tempo).

Govern AP2 agent-initiated payments across card, ACH, and crypto rails.

Preflight an L402 payment challenge. Check the Lightning invoice (network, amount) and macaroon before an agent pays.

Validate a Mastercard Agentic Token container: capped spend, merchant scope, expiry, agent binding, and network-token (not raw PAN) funding.

Validate a Skyfire KYA (Know Your Agent) and pay token: capped spend, merchant scope, expiry, agent binding, and Skyfire pay-token funding rather than a raw PAN.

Validate a Nekuda agentic mandate over existing card rails: capped spend, merchant scope, expiry, agent binding, and tokenized (not raw PAN) funding.

Validate a Visa Intelligent Commerce payment credential: capped spend, merchant scope, expiry, agent binding, and Visa token or passkey funding rather than a raw PAN.

Validate an American Express agent payment token: capped spend, merchant scope, expiry, agent binding, and network-token (not raw PAN) funding.

Validate a PayPal agent payment credential: capped spend, merchant scope, expiry, agent binding, and vaulted-instrument (not raw PAN) funding.