# Agent Bench (agenthaven.dev)

> Agent Bench operates agenthaven.dev, a DNSSEC-signed zone that publishes AI agents through DNS-AID, and one live agent in it: the Agent Bench Travel Merchant at travel.agenthaven.dev — a proof-of-concept seller agent that quotes real flight fares (Google Flights via SerpApi) and turns a chosen quote into a Stripe test-mode payment intent under a buyer-supplied spending mandate. Reachable over A2A (JSON-RPC 0.3) and MCP (2025-06-18); no OpenAPI, no REST paths, no real money, no ticket.

This file was generated by API Evangelist from the provider's published surface on 2026-09-19; Agent Bench does not publish its own /llms.txt (probed on agenthaven.dev and travel.agenthaven.dev, both 404). Company name from the agent card's provider.organization; domain agenthaven.dev.

## Agent surfaces

- [A2A agent card](https://travel.agenthaven.dev/.well-known/agent-card.json): protocolVersion 0.3, JSONRPC endpoint https://travel.agenthaven.dev/a2a, two skills (flight-search, travel-checkout). The endpoint answers message/send only, with one DataPart {action, input} or a TextPart one-liner. Graded conformant against A2A 1.0.0 hard checks.
- [MCP server](https://travel.agenthaven.dev/mcp): Streamable HTTP, POST only, protocol 2025-06-18, serverInfo agent-bench-travel-merchant 0.1.0. Anonymous initialize and tools/list return two tools — search_flights and create_checkout — with full JSON Schema inputSchema and outputSchema. Implements initialize, ping, tools/list, tools/call; no resources or prompts.
- [DNS-AID discovery](https://agenthaven.dev/): `dig +short _index._agents.agenthaven.dev TXT` lists the agents; the SVCB record at travel.agenthaven.dev carries the card URL, its SHA-256 digest and an ES256 signature; DANE TLSA pins the certificate. Verification key set: https://dns-aid.agenthaven.dev/.well-known/dns-aid-jwks.json.

## Docs

- [Agent documentation](https://travel.agenthaven.dev/): what it does, how to call it over A2A and MCP (curl examples), where the authorization comes from, buying as a guest, how to read the ledger, verify it yourself.
- [Zone index](https://agenthaven.dev/): the agents published under agenthaven.dev and what the zone guarantees (DNSSEC, signed records, pinned cards and certificates).
- [ARD catalog](https://travel.agenthaven.dev/.well-known/ard.json): trust manifest with DNS-AID, DNSSEC, DANE and ANS attestations.
- [Health](https://travel.agenthaven.dev/health): status, mode, rails, guest policy, live budget counters.
- [Ledger](https://travel.agenthaven.dev/ledger): hash-chained (RFC 8785 JCS, SHA-256, ES256) record of every quote, refusal, payment intent and completed checkout, with a reading guide.

## How to call it

- search_flights(origin, destination, departure_date[, adults, correlation_id, exercise]) — no authorization. IATA codes uppercase ("MAD", not "Madrid"); ISO date in the future. Returns up to two options (cheapest, fastest), each a signed quote (quote_jws, quote_hash) valid ten minutes, fare in EUR minor units, with itinerary.
- create_checkout(quote_id, merchant_id="demo-travel-seller", currency="EUR"[, quote_hash, correlation_id, mandate_jws, exercise]) — needs Authorization: Bearer <JWT>. Either a self-signed request envelope (typ request+jwt) under a key attested at /.well-known/agent-keys.json on YOUR domain plus a mandate from https://sealedby.dev bound to the quote, or a JWT the operator issues on request (iss agent-bench-demo-issuer, aud agent-bench, scope commerce:purchase, EUR cap). No public token endpoint. Creates and captures a Stripe TEST-mode PaymentIntent (pm_card_visa) and stops; returns a signed receipt (receipt_jws) and ledger hashes.
- Guests: publish a P-256 key in a DNSSEC-signed TXT record at _agent-keys.<your domain>, sign envelopes with iss spiffe://<your domain>/…, and self-issue a mandate living at most 10 minutes; up to 1000.00 EUR per purchase, 20 guest purchases a day shared. Contract and reference buyer: https://provedby.dev/contracts/guest-buyer.md
- Every response carries request_id (also the x-request-id header) and an evidence block (merchant_id, merchant_domain, agent_card_sha256, signer {spiffe_id, kid, key_url}, audit_hash) so you can verify who answered.

## Limits

- Anonymous searches: 40 per day, 120 per month, shared; an authorised search never counts. Live counters in /health.
- Quotes expire ten minutes after search_flights; a mandate buys once (mandate_consumed on replay); guest mandates live at most 600 s.
- No rate-limit headers; exhaustion is written to the ledger as request.refused reason search_budget_exhausted.

## Not published

- No OpenAPI, GraphQL, REST reference, SDKs, CLI, pricing, terms, privacy policy, security.txt, OAuth/OIDC discovery, RFC 9728 protected-resource metadata, status page or changelog. The DNS index also names car-rental and hotel agents that do not resolve.

## API Evangelist artifacts

- [apis.yml](https://raw.githubusercontent.com/api-evangelist/agenthaven-dev/refs/heads/main/apis.yml)
- [A2A manifest](https://raw.githubusercontent.com/api-evangelist/agenthaven-dev/refs/heads/main/a2a/agenthaven-dev-a2a.yml)
- [MCP manifest](https://raw.githubusercontent.com/api-evangelist/agenthaven-dev/refs/heads/main/mcp/agenthaven-dev-mcp.yml)
- [MCP tools/list (verbatim)](https://raw.githubusercontent.com/api-evangelist/agenthaven-dev/refs/heads/main/mcp/agenthaven-dev-mcp-tools.json)
- [Conventions (idempotency, reversibility, tracing)](https://raw.githubusercontent.com/api-evangelist/agenthaven-dev/refs/heads/main/conventions/agenthaven-dev-conventions.yml)
- [Error and refusal catalog](https://raw.githubusercontent.com/api-evangelist/agenthaven-dev/refs/heads/main/errors/agenthaven-dev-problem-types.yml)