I Probed 50 Named A2A Supporters for an Agent Card. Exactly One Has One.

TL;DR: Of the 50 organizations publicly named as A2A supporters, exactly one serves a fetchable agent card: Atlassian, at a2a.atlassian.com/.well-known/agent.json. Zero serve one at /.well-known/agent-card.json, the path the current spec defines, so a client built to A2A 1.0 discovers none of them. I ran 180 requests against 90 hosts on August 15, 2026. Forty of the 50 primary corporate domains returned a conclusive answer and all forty were empty; the other ten were blocked by a WAF or gateway, so 40 is the honest denominator.

A2A is the agent interoperability protocol Google announced in April 2025 and handed to the Linux Foundation in June of that year. The pitch is that your agent finds my agent, reads what it can do, and calls it. The finding step is the interesting one, because A2A does not use a registry or a directory. It uses a file at a guessable path. That makes the adoption question unusually cheap to answer: you do not need access, a survey, or a vendor's word. You need curl. This is the same trick I ran on the sites that were supposed to be serving llms.txt, and it works for the same reason.

How is A2A discovery supposed to work?

The specification is not ambiguous. The canonical discovery method is a JSON document at https://{agent-server-domain}/.well-known/agent-card.json, following the principles of RFC 8615, the same convention behind /.well-known/security.txt. The card declares identity, a service endpoint, capabilities, skills, and an authentication block naming required schemes such as Bearer or OAuth2. Before version 0.3 the file lived at /.well-known/agent.json, and a lot of deployed code still looks there.

Two consequences matter. Discovery is public by construction: the entire point of a well-known path is that a stranger can guess it. And there is no fallback, because the spec states that "the current A2A specification does not prescribe a standard API for curated registries." If the well-known path is empty, a client that has not been handed your endpoint out of band has nothing to work with.

Who endorsed this, and who did I check?

The Linux Foundation's April 9, 2026 release says A2A has "more than 150 organizations supporting the standard" with "active production deployments across multiple industries." It names eight: AWS, Cisco, Google, IBM, Microsoft, Salesforce, SAP, and ServiceNow. It does not publish the other 142, and no roster is linked anywhere in the announcement. For a foundation whose product is public membership, that absence is itself a data point.

So I built the sample from what is actually on the record: those eight, plus every company named in Google's original launch post, which claimed "more than 50 technology partners" and listed them, including Accenture, Atlassian, Box, C3 AI, Cohere, Confluent, Datadog, Deloitte, Elastic, Intuit, JetBrains, LangChain, MongoDB, Neo4j, PayPal, PwC, TCS, UiPath, Weights & Biases, and Wipro. Deduplicated, that is 50 organizations that put their logo on this protocol in public.

For each, I fetched the primary corporate domain at both paths. Then I checked DNS for agent., agents., and a2a. subdomains and probed both paths on every one that resolved.

What did the count find?

Measure	Result
Organizations in sample	50
Primary domains giving a conclusive answer	40
Blocked or inconclusive (403, 400, 301, no route)	10
Agent cards at the spec path agent-card.json	0
Agent cards at the legacy path agent.json	1
Cards found that declare an auth scheme	1 of 1

The ten I could not resolve were blocked, not missing: ServiceNow, Intuit, Neo4j, New Relic, UKG, EPAM, and TCS returned 403 from a CDN or bot filter, BCG's gateway answered "Api Key not provided.", and PwC and HCLTech never terminated their redirects. I cannot prove a negative for those ten and I am not going to pretend otherwise.

Two domains would have inflated the number if I had trusted status codes. Both datastax.com and wandb.ai returned HTTP 200 at both paths. Neither is a card: DataStax now redirects to an IBM product page (IBM acquired the company), serving 181 KB of text/html, and wandb.ai returns its React shell for any unmatched path. A crawler counting 200s would have reported two agent cards that do not exist.

The subdomain sweep needed the same skepticism. Twenty-two agent-flavored subdomains resolved, but Box, Datadog, Incorta, JFrog, and MongoDB answer any label you invent, which I confirmed by resolving zzq7nonexistent. on each. Strip the wildcards and only seven agent subdomains across six companies were genuinely provisioned.

Doesn't this just mean the deployments are internal?

Largely, yes, and that concession belongs next to the number rather than buried under it.

A company running A2A between its own agents behind its own firewall has no reason to publish a card to the open internet, and several of the named eight ship A2A inside someone else's platform rather than on their own domain. Microsoft integrated it into Azure AI Foundry and Copilot Studio. AWS added support through Bedrock AgentCore Runtime. Those deployments can be entirely real and entirely invisible to curl, by design. Nothing in my probe shows that any company "does not support A2A," and I am not claiming it does.

What the probe measures is narrower: whether the organizations that publicly endorsed a public discovery standard participate in that discovery. That still matters, because public discoverability is the specific thing A2A is sold on. An internal deployment where both agents already know each other's endpoints does not need A2A's discovery layer at all, and mostly does not need a cross-vendor protocol either. The interoperability story requires strangers finding strangers. Sixteen months in, on the corporate domains of its own named backers, that layer is empty.

What does the one real card look like?

Atlassian's is the entire yield, and it is a genuinely good card. It describes Atlassian Rovo, points at a JSON-RPC endpoint, and declares two skills: work-in-jira and work-in-confluence. It has a securitySchemes block specifying an OAuth2 authorization-code flow against auth.atlassian.com with named scopes, so every card in my sample declares an authentication scheme. It is real production plumbing, not a demo, which is rarer than the agent demo circuit suggests.

It also declares "protocolVersion": "0.3.0". That is why it sits at agent.json: it is a correctly served 0.3 card, four months after 1.0 shipped and was announced as production-ready. Request a2a.atlassian.com/.well-known/agent-card.json and you get a 404. The one agent card published by a named A2A supporter is invisible to a client written against the current specification. That is not Atlassian failing. It is the cost of a spec that moved its own discovery path, leaving every client to probe two locations forever.

Hasn't someone already counted this?

Yes, differently, and the earlier count is the better one for measuring the whole internet. On July 29, 2026, Kin Lane probed every host in the APIs.io catalog: 22,341 hosts, 20,185 reachable, 65 serving an agent card, and only 10 passing every structural check in the A2A 1.0.0 AgentCard object. Fifteen of the 65 were still on the legacy path.

His sample and mine answer different questions. He asked how many API providers in general publish a card, and found the population tiny and mostly malformed. I asked whether the specific companies who lent their names to the protocol publish one, on the assumption that endorsers would be the best case. They are not the best case. They are worse: 65 cards across a general catalog, against one across the roster of people who announced they were doing this.

So is A2A failing?

That is more than this number can support. Public well-known adoption is the wrong single metric for a protocol whose center of gravity has moved inside three cloud platforms. A2A can succeed as a wire format shipped in Bedrock, Foundry, and Vertex while /.well-known/agent-card.json stays empty forever. It would just be a different product than the open discovery layer in the announcement, and closer to the pattern that keeps agentic projects on the cancellation list.

What would change my mind is cheap to specify. Publish the roster of 150. Serve cards at the spec path on domains you already control. Either is an afternoon of work for organizations that spent a year issuing press releases about interoperability, and either would move this number off 1.