A2A — agent to agent

A2A (Agent2Agent, Linux Foundation) is the open standard for one agent to talk to another. Every Ghosty Studio agent publishes its Agent Card and serves A2A messages.

Discovery: the card

curl https://www.ghosty.studio/a2a/AGENT_ID/card

It is public (no credentials, open CORS, 5-minute cache), as the standard requires: discovery can't demand keys.

{  "name": "Ghosty",  "description": "…",  "version": "1.0.0",  "protocolVersion": "1.0",  "url": "https://www.ghosty.studio/a2a/AGENT_ID",  "capabilities": { "streaming": true, "pushNotifications": false },  "defaultInputModes": ["text/plain", "application/json"],  "defaultOutputModes": ["text/plain"],  "skills": [],  "provider": { "organization": "Ghosty Studio" },  "securitySchemes": { "ghostyPartnerHmac": { "type": "apiKey", "in": "header", "name": "x-ghosty-sig" } }}

With a signed request the card is extended: it lists the agent's real skills (chat, web-search, whatsapp if it has an active channel).

Messages

POST /a2a/:id is JSON-RPC 2.0 with the methods SendMessage, SendStreamingMessage (SSE), GetTask and GetExtendedAgentCard. The A2A-Version: 1.0 header selects the version; without it the reply is in 0.3 for older clients. The A2A contextId maps to a Studio conversation.

Scope today. The message endpoint is signed with the ghostyPartnerHmac scheme, used by the house products (Teams ↔ Studio). No keys are issued to third parties yet; when it opens, authentication will be OAuth2 with its own scope and this page will announce it in the Changelog. In the meantime, to invoke an agent from your software use the API.

What it doesn't do

• pushNotifications: false: no outgoing webhooks; streaming is over SSE.
• Cards are not JWS-signed; authenticity comes from the domain.