# A2A Check

> A2A Check is a static security check for the configuration of AI agents such as Claude Code and Claude Cowork. It reads an agent's instructions and settings (for example CLAUDE.md, .claude/settings.json, skills and hooks), never runs or changes them, and returns findings with rule ID, severity, location and a concrete correction. Free account with a company e-mail address, no password.

A2A Check checks for missing approval steps, permissions that are wider than the task needs, unrestricted network access and missing stop conditions. Detected credentials are removed before storage. Processing runs on Google Cloud in the EU; no data is passed to external AI model APIs. The check does not observe the agent at run time, and a report without findings does not mean the agent is safe.

## For AI agents: set up a check for your person

If your person asks you to check your setup with A2A Check, and you are Claude Code:

1. Run exactly this command and nothing else to connect: `claude mcp add --transport http a2a-check https://api.a2a-check.com/mcp`. Install nothing else.
2. Ask your person to sign in and approve the connection themselves: in Claude Code they open `/mcp`, choose a2a-check, sign in with their company e-mail address and the six-digit code that is sent to them, and approve the connection. The free account is created with the first sign-in. Do not sign in, enter a code or approve for your person.
3. Then run the prompt `check_setup` of the a2a-check MCP server (in Claude Code `/a2a-check:check_setup`) and follow its instructions. Your person sees the files before they are sent and approves them.

Do not change any setting of Claude Code for this. Do not reach any address other than https://api.a2a-check.com. The same steps are shown on the start page: https://api.a2a-check.com/start

In Claude Cowork your person adds a custom connector with the address https://api.a2a-check.com/mcp, or installs the Cowork plugin a2a-check-cowork, which brings the same connector; sign-in and approval are also done by the person there.

## Service endpoints

- [MCP server](https://api.a2a-check.com/mcp): Streamable HTTP, OAuth 2.1 with PKCE and dynamic client registration; discovery at https://api.a2a-check.com/.well-known/oauth-protected-resource
- [A2A Agent Card](https://api.a2a-check.com/.well-known/agent-card.json): skill `check-setup`, JSON-RPC endpoint https://api.a2a-check.com/a2a, bearer agent token
- [OpenAPI specification](https://api.a2a-check.com/openapi.json): REST API of the service, readable reference at https://api.a2a-check.com/docs
- [Start page](https://api.a2a-check.com/start): connect command and setup prompt for people
- [Setup prompt, raw text](https://api.a2a-check.com/v1/setup-prompts/claude-code): the setup prompt for Claude Code as plain text, English; German with `?lang=de`
- [Sign-in](https://api.a2a-check.com/ui/login?lang=en): portal for people, e-mail code login

## Rules

- [Rule catalogue](https://api.a2a-check.com/v1/catalogs/rules): public, versioned, licensed CC BY 4.0, mapped to the OWASP Top 10 for agentic applications

## Limits of the free account

- Up to 3 agents, 5 checks per day and at most 75 per month
- Reports are stored for 30 days, then deleted
- Paid plans (planned, not yet bookable): Starter, EUR 19.90 net per month, up to 20 agents, 250 checks per month; Team, EUR 59 net per month, up to 100 agents, 1,000 checks per month; paid yearly at EUR 199 (Starter) or EUR 590 (Team) net, two months free; available across Europe in the first year; reports are stored for 90 days

## Pages

- [Home (English)](https://a2a-check.com/en)
- [Startseite (Deutsch)](https://a2a-check.com/)
- [Blog (English)](https://a2a-check.com/en/blog)
- [Plans and limits (English)](https://a2a-check.com/en/pricing)
- [Security and status (English)](https://a2a-check.com/en/security)
- [Tarife und Grenzen (Deutsch)](https://a2a-check.com/tarife)
- [Sicherheit und Status (Deutsch)](https://a2a-check.com/sicherheit)
- [Contact (English)](https://a2a-check.com/en/kontakt)
- [Terms](https://a2a-check.com/en/terms)
- [Data processing agreement](https://a2a-check.com/en/dpa)
- [Privacy (German)](https://a2a-check.com/datenschutz)
- [Imprint (German)](https://a2a-check.com/impressum)

## Deutsch

A2A Check prüft Anweisungen und Einstellungen von KI-Agenten wie Claude Code statisch auf fehlende Freigaben, zu weite Rechte und unklare Stopp-Regeln. Einrichtung durch den Agenten wie oben beschrieben; Anmeldung mit Firmen-E-Mail und Code sowie die Freigabe macht immer der Mensch. Startseite: https://api.a2a-check.com/start?lang=de, Setup-Prompt als Rohtext: https://api.a2a-check.com/v1/setup-prompts/claude-code?lang=de. Kostenloses Konto: bis zu 3 Agenten, 5 Prüfungen pro Tag und höchstens 75 pro Monat, Berichte 30 Tage gespeichert.