generated: '2026-09-19'
method: derived
source: a2a/val-run-agent-card.json (served card); no OpenAPI exists to run derive-authentication.py against
docs: null
summary:
  types:
  - none
  api_key_in: []
  oauth2_flows: []
  open_endpoint: true
schemes: []
note: >-
  The served agent card declares no securitySchemes and no security requirements, and the endpoint
  accepted an anonymous JSON-RPC POST (tasks/get -> -32001 Task not found, HTTP 200). The endpoint's CORS
  policy allows an Authorization header (access-control-allow-headers includes authorization) but nothing
  documents a credential. /.well-known/oauth-authorization-server, oauth-protected-resource and
  openid-configuration on the endpoint host return the catch-all text banner, not metadata. Treat the
  surface as unauthenticated; the registry's copy of the card also lists security [] and securitySchemes {}.
x-evidence:
  fetched: '2026-09-19'
  anonymous_post: {url: 'https://relay2--5de8b3b2995311f1a5481607ee4eb77e.web.val.run/', status: 200}