In April 2026, the Agent-to-Agent (A2A) protocol celebrated 150 supporting organizations — Microsoft, AWS, Salesforce, SAP, ServiceNow among them. By July, a review of 65 documented adopters found that 41 had published something AI agents cannot reliably consume. Not because the concept is flawed, but because the implementation details are easy to get wrong and most businesses are publishing Agent Cards as a checkbox item without verifying that actual agents can discover and use them.
If you are planning to publish an Agent Card, or you already have, this is the technical reality you need to understand before assuming you are visible to AI agents in agentic workflows.
The Stakes: Agentic Commerce Is Already at $60 Billion
Amazon Business reached $60 billion in annualized gross sales in mid-2026, driven largely by agentic AI reshaping B2B procurement. Adobe Analytics measured a 4,700% year-over-year jump in generative AI-driven traffic to US retail sites between July 2024 and July 2025. Coinbase’s x402 payment protocol processed approximately 165 million agent-to-merchant transactions in its first months of operation.
Agentic commerce — where AI agents research vendors, compare options, and complete purchases autonomously — is not a 2027 problem. It is the procurement reality for a growing segment of B2B buyers right now. The practical consequence: if an AI agent cannot discover and interpret your business’s capabilities, you do not exist in that buying process.
This is why Agent Cards matter. And it is why getting them wrong has a direct revenue cost, not just a technical one.
What Agent Cards Are Supposed to Do
An Agent Card is a JSON file that describes what a business or AI service can do — its capabilities, APIs, authentication methods, and how to invoke it. When an AI agent needs to find a vendor or service to complete a task, Agent Cards are the mechanism it uses to identify which businesses can be interacted with programmatically rather than just browsed.
The standard implementation is a file at /.well-known/agent.json that follows the A2A specification. A minimal valid Agent Card includes:
- A
nameanddescriptionthat clearly identify the business and its primary capability - A
urlpointing to the agent endpoint - A
versionfield - A
capabilitiesobject describing what the agent can do (streaming, push notifications, state management) - A
skillsarray describing the specific tasks the agent can perform, with IDs, names, and descriptions - An
authenticationblock specifying supported auth schemes
An agent scanning for capable vendors reads this file, parses the skills, and determines whether your service can fulfill the task it is trying to complete. If the file is missing, malformed, or incomplete, the agent moves to the next option.
Why Most Implementations Fail
The A2A review that found 41 of 65 adopters publishing non-functional cards identified three recurring failure modes.
Wrong file path. More than 15 organizations were still publishing at the original /.well-known/agent.json path from early draft versions of the spec, rather than the current spec-compliant path that A2A-compatible agents now check. The paths are similar enough that implementers often assume they match; they do not, and agents following the current spec will not find files at the legacy location.
Missing skills array. Many published Agent Cards contain a correct organizational description but omit or underpopulate the skills array. This is the field that tells an agent what your business can actually do. An Agent Card with no skills is like a business card with no job title — the agent knows you exist but has no basis to route a task to you. These cards pass basic JSON validation but fail agent discovery in practice.
Authentication blocks that do not match actual endpoints. A2A agents attempt to authenticate before invoking an endpoint. When the authentication scheme described in the card (OAuth2, API key, etc.) does not match what the endpoint actually accepts, the invocation fails silently from the agent’s perspective. The agent logs a failed connection and selects an alternative vendor. You never see the error.
The Discoverability Problem Beyond the Card
Even a correctly published Agent Card does not guarantee discovery if the business is not present in the channels agents use to find cards. A benchmark of 100 leading B2B software vendors found that AI agents encountered access errors in 30% of research sessions — often because pricing, feature data, or capability descriptions were hidden behind JavaScript rendering or login gates that agents cannot navigate.
Two additional problems undercut discovery before the Agent Card is even checked:
Bot blocking. A business that blocks AI crawlers in robots.txt is invisible to the indexing pass that populates agent memory about available vendors. An agent that has never learned a business exists will not query its Agent Card. Between 30% and 40% of websites block at least one major AI crawler, according to 2025 crawl analysis data.
JavaScript-gated content. Pricing, inventory levels, and feature comparisons are the data agents need to make vendor selections. When this data is rendered client-side and inaccessible to non-browser agents, the business cannot be evaluated. Agents select vendors they can fully assess over vendors they can only partially read.
MCP Servers: The Layer That Makes Agent Cards Actionable
An Agent Card describes capabilities. A Model Context Protocol (MCP) server fulfills them. The distinction matters because A2A agent discovery is increasingly two-phase: find the card, then verify the endpoint is reachable and returns expected data.
The MCP server ecosystem has grown to over 10,000 active public servers as of 2026, with directories listing verified implementations. Businesses that appear in these directories have a second discovery surface beyond the Agent Card — agents querying directories for specific capabilities (inventory lookup, pricing API, documentation search) will find listed MCP servers even if they never check the business’s website directly.
For most businesses, the minimal MCP implementation that justifies the build cost is exposing three endpoints: product or service catalog, pricing (real-time or current), and availability. These cover the data agents need for the vendor selection phase of agentic procurement. A complete Agent Card pointing to a working MCP server is the combination that actually gets invoked.
How to Verify Your Agent Card Works
Validating an Agent Card is not the same as validating that an agent can use it. JSON validation confirms the file is syntactically correct. Agent discovery validation confirms the file is at the right path, contains a populated skills array, and has authentication blocks that match live endpoints.
A minimal verification checklist:
- Confirm
/.well-known/agent.jsonreturns a 200 withContent-Type: application/jsonand no redirects - Parse the skills array — it should contain at least one skill with
id,name, anddescriptionpopulated - Attempt the authentication flow described in the card’s authentication block against the actual agent endpoint
- Send a test task matching one of the declared skills and verify the endpoint returns a valid A2A task response
- Confirm your robots.txt does not block ClaudeBot, GPTBot, or PerplexityBot
Most published Agent Cards pass the first check and fail the third and fourth. The file exists; the endpoint does not behave as described.
Implementation Priority for 2026
If you are allocating implementation time across the agent-ready protocol stack, the research-backed priority order is: structured data first (highest confirmed citation signal), MCP server second (makes your business callable by agents), Agent Card third (positions you for agent commerce flows), and llms.txt fourth (low effort, uncertain current impact).
For Agent Cards specifically, the competitive window is real. The majority of businesses that have published one have not verified it works. The majority of businesses have not published one at all. A correct implementation that passes the verification checklist above puts you ahead of both groups in agent-driven discovery.
The Gartner projection that 40% of enterprise applications will include task-specific AI agents by end of 2026 represents the demand side of this infrastructure. The supply side — businesses actually reachable by those agents — is a much smaller number today. That gap is the opportunity, and it closes as tooling matures and implementation guides become more accessible.
The Practical Starting Point
Before building an MCP server or publishing an Agent Card, audit your current crawlability. If AI crawlers cannot index your content, your Agent Card will not be discovered even when it is correctly implemented. Check your robots.txt, verify your core pages are not JavaScript-gated, and confirm your structured data correctly describes your organization.
Once crawlability is confirmed, an Agent Card is a one-day implementation for most development teams. The spec is well-documented, the file structure is simple, and the verification steps above will identify whether your implementation is functional before you assume you are visible.
If you want to see where your site stands on crawlability, structured data, and agent-ready signals across ChatGPT, Perplexity, Google AI Overviews, and Claude — run a free audit at ai-visibility.llmagnet.com.