A2A Agent Board: Publish · Find · Use with itinai.com
SaferSkills independently audited itinai (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
itinai is a registry-as-code directory for AI agents. The repository is the single source of truth for static agent manifests stored in agents/*.yaml.
Dynamic data, pricing, availability, catalogues, and negotiation state stay with the agent owner and are linked from the manifest.
agents/ Agent manifests
schemas/agent-manifest.schema.json JSON Schema for manifests
.github/workflows/validate.yml Pull request validation
.github/workflows/health-check.yml Scheduled availability checks
scripts/validate.py Local manifest validation
scripts/health-check.py Agent availability checks
docs/agent-card-spec.md Agent Card requirementsagents/<agent-id>.yaml.agent_id that matches the filename.a2a_config.agent_card_url to a public HTTPS Agent Card URL.id, name, and tags.contact.email.Example:
agent_id: "retinol-supplier-v1"
name: "Retinol Wholesale Agent"
description: "B2B supplier of retinol and cosmetic ingredients"
version: "1.0.0"
a2a_config:
agent_card_url: "https://api.retinol-supplier.com/.well-known/agent-card.json"
protocol_version: "1.0.0"
skills:
- id: "supply-retinol"
name: "Supply Retinol"
tags: ["retinol", "wholesale", "cosmetics", "B2B"]
dynamic_data:
catalogue_feed_url: "https://api.retinol-supplier.com/catalogue.jsonld"
negotiation_protocol: "ANP"
negotiation_endpoint: "https://api.retinol-supplier.com/anp"
health_check:
url: "https://api.retinol-supplier.com/.well-known/agent-card.json"
contact:
email: "[email protected]"
url: "https://retinol-supplier.com"Install the validation dependencies:
python -m pip install -r requirements.txtValidate all manifests:
python scripts/validate.pyRun health checks:
python scripts/health-check.py --output health-results.jsonImport live seed agents from configured external sources:
python scripts/import-from-registry.py --limit 10The importer currently scans these sources and only writes manifests for agents whose HTTPS Agent Card is reachable and contains A2A-required fields:
agora-protocol/agora)microsoft/autogen)AI-Engineer-Foundation/agent-index)Use --source <source-slug> to test a single source, for example:
python scripts/import-from-registry.py --source agora-registry --dry-run--limit is applied per source so one large registry does not starve smaller sources during scheduled synchronization.
External registry synchronization also runs in GitHub Actions via Sync External Agents. That workflow can be started manually or by schedule; it imports live agents, validates manifests, runs health checks, uploads sync-health-results, and opens or updates a pull request when manifests change. When the WP_KEY GitHub secret is configured, the workflow also syncs healthy manifests to the WordPress Agents app at itinai.com. Sync WordPress Agents runs on pushes to main that change agents/*.yaml and uses WP_USER, WP_KEY, WP_APP, and WP_SYNC_ENDPOINT GitHub secrets to publish changed manifests to the WordPress REST endpoint. WP_USER is the WordPress username, WP_KEY is the Application Password, and WP_APP is the Application Password label/name.
Scheduled health checks upload health-results.json as a GitHub Actions artifact. On scheduled runs, the workflow also tracks consecutive failures per agent and opens a health-check issue after three failed checks in a row.
The registry does not proxy communication between agents.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.