The A2A catalog

Enterprise only

Not included in DVARA Open Source.

The A2A Catalog lists agents you can find and register, the way the MCP catalog lists MCP servers. DVARA reads the agents in from places your operator chooses, checks each Agent Card, and keeps one list for the whole install. When you register an agent from it, the agent becomes an ordinary governed agent of your workspace: every call to it goes through the A2A plane, with its policies, approvals and audit.

The catalog only reads. It does not publish your agents anywhere, and an agent cannot add itself to it.

Roles

• Owner — sees where each source was last read and runs Sync now. An owner does not register agents; that is done inside a workspace.
• Admin and developer — search the catalog and Register an agent into their own workspace.
• Viewer — searches and reads entries, cannot register.

Where the agents come from

Your operator turns the catalog on and chooses up to three sources:

• A curated list — a file of agents your operator has vetted, with each Agent Card written in or linked.
• Domains — for each domain, DVARA reads its Agentic Resource Discovery manifest at https://<domain>/.well-known/ard.json, or the older /.well-known/ai-catalog.json when there is none, and keeps the entries that are A2A Agent Cards.
• Agent Card URLs — cards read directly.

DVARA reads the sources every day and whenever an owner presses Sync now. If one source, domain or card cannot be read, the others still refresh and what was already listed stays as it was.

What DVARA checks

Every card is read the way the gateway reads a peer's card on a call, A2A 1.0 or 0.3:

• A card that cannot be read, has no name, or offers no http/https address is not listed.
• A card whose signature does not verify is not listed. A signed card that verifies shows Signed (own key): the signature matches the key in the card. To prove the card comes from who it says, pin the agent's key on its page after you register it. Your operator can also require every listed card to be signed.
• A domain can list only its own agents. An entry whose identifier (urn:air:<publisher>:…) names another domain is refused, so example.com cannot list an agent as google.com.
• DVARA fetches nothing from a private, loopback or cloud-metadata address, and follows no redirects.

An entry the source stops listing is marked Gone from source, and one whose card is now refused is marked Refused now. Neither can be registered. Agents you registered from them earlier keep working; removing them is your decision.

Find an agent

Open Agents → A2A Catalog. Search by Name (also matches the description and publisher), by Skill (a skill's name or id), or by Tag (a skill tag, whole). Open an entry to see its addresses and protocol bindings, its skills, what its signature showed, and which A2A version the card is written for.

Register an agent

On the entry, click Register. DVARA creates the agent in your workspace with:

• an agent ID made from the agent's name,
• the address the card lists,
• the auth scheme the card declares, when it declares one,
• the tags catalog and the source.

Registering runs every check a hand-made agent gets: the ID must be free in your workspace, the address must be public https, and the card's auth scheme and binding are checked. The agent records where it came from, which its page shows under From the A2A catalog, and the audit log's A2A_AGENT_CREATED event carries the same.

To change the ID or add a credential first, use Register with changes…: the agent form opens filled from the entry. Keep the address the catalog lists. If you register an agent your workspace already holds under the same ID, the form opens with A2A_AGENT_DUPLICATE so you can pick another one. The entry's page shows the agents your workspace has already registered from it.

For operators: turn it on

The catalog is off until you turn it on in Flightdeck's configuration:

Setting	Default	What it does
DVARA_A2A_CATALOG_ENABLED	false	Turns the catalog, its page and its daily sync on.
DVARA_A2A_CATALOG_CURATED_PATH	empty	A curated file: {"entries": [{"id": "...", "cardUrl": "https://..."}]}, or "card": {...} in place of cardUrl. Empty uses the bundled file, which lists nothing.
DVARA_A2A_CATALOG_ARD_ENABLED, DVARA_A2A_CATALOG_ARD_DOMAINS	false, none	Domains to read through ARD, comma-separated.
DVARA_A2A_CATALOG_CARDURLS_ENABLED, DVARA_A2A_CATALOG_CARDURLS_URLS	false, none	Agent Card URLs, comma-separated.
DVARA_A2A_CATALOG_REQUIRESIGNEDCARDS	false	Lists only cards with a signature that verifies.
DVARA_A2A_CATALOG_ALLOWPRIVATENETWORKS	false	Lets the sync read from private network addresses. Loopback and cloud metadata stay refused.
DVARA_A2A_CATALOG_SYNCCRON	0 15 6 * * *	When the daily sync runs.

Each sync is recorded in the audit log as A2A_CATALOG_SYNCED, or A2A_CATALOG_SYNC_FAILED when something could not be read, with what was listed, refused and not read.