Only 250 of the Top 1 Million Websites Publish an A2A Agent Card, While 63,244 Return an Empty Page at the Same Address

Summary

Picture a travel agency with an AI agent that can check availability and hold a booking. Other AI assistants could use it, if they knew it existed and what it could do. The A2A protocol's answer is an agent card: a JSON file at a fixed address describing the agent.

A2A, short for Agent2Agent, is an open protocol for AI agents to talk to each other. Its agent card sits at /.well-known/agent-card.json and lists the agent's name, description, endpoint URL and supported features. HTTP Archive first recorded this path in its October 2026 crawl. The same crawl also checks two catalog files, ai-catalog.json and ard.json.

Real agent cards are rare: 250 of the top 1 million homepages. The bigger number is the 63,244 sites that return an empty success page at the same address, which can fool simple checkers into thinking a card exists.

What we measured

We used the HTTP Archive October 2026 mobile crawl (httparchive.crawl.pages) for top-1M homepages. HTTP Archive requests /.well-known/agent-card.json and records the card's name, description, URL, protocol version and preferred transport. We counted a card only when at least one of those fields had a value.

We also counted ai-catalog.json and ard.json files with real entries, and joined all three with llms.txt adoption from the same crawl. Platform comes from HTTP Archive's technology detection.

Real cards are rare, empty answers are common

What servers return at the agent card address.

A server that answers every address with a page makes automated discovery unreliable. Agents and audit tools need to read the content as well as the status code.

Cards are thin and versions vary

Protocol versions and transports declared in the 250 cards.

167 cards (66.8%) include a name, description and URL. Transports are mostly unstated (182); JSONRPC (30) and HTTP+JSON (27) lead among cards that say. Ten cards declare MCP-style transports, a sign that agent and tool protocols are still blurred together in practice.

Agent files come from AI-minded builders on common platforms

Any of the three agent discovery files, by rank. Platform counts for agent cards are named for adoption only.

Agent cards by detected platform: WordPress 81, Other or none detected 75, Next.js 60, Magento 10, Astro 8, Shopify 3. WordPress and Next.js sites lead, which may point to plugins and developer starter kits adding the file.

What this means

If your business does not run its own AI agent, you do not need an agent card. If you do, publish a complete card with a name, description, endpoint URL and protocol version, and make sure missing files on your site return a real 404 so tools are not misled.

The bigger opportunity for most owners is being recommended by the AI assistants people already use. Being recommended by those assistants is where answer engine optimization services should focus before agent files, and a free AI visibility audit shows whether they can find and quote your business today.

Limits

HTTP Archive added the agent card path in the October 2026 crawl, so there is no trend yet.

Our 'real card' test requires at least one recorded field; malformed cards may be missed.

Only homepage origins are checked.

We report declared fields, not whether the agent behind a card works.

Frequently asked questions

Related studies

• Machine-readable doors for AI agents0.3% of Top Sites Publish AI Catalog or ARD Files
• Machine-readable doors for AI agentsOpenSearch Files: 1.6% of Top Sites Still Publish One
• Machine-readable doors for AI agents0.12% of Top Sites Offer Markdown Page Versions for AI