Conformance
a2ally Certified
Before an agent trusts a deployment with real decisions, it should check that the deployment is what it claims to be. The conformance checklist does that from the outside: public documents, the MCP handshake, KYA and issuer keys, honest pricing, the ledger head, published rate limits, and one live rights question. A deployment that passes every check is a2ally Certified.
The checklist (version 2026-10-12)
| Check | Name | What it proves |
|---|---|---|
| discovery-documents | Discovery documents | The manifest, the OpenAPI description and the agent entry point (llms.txt) are all served, so an agent that has never heard of a2ally can bootstrap from a bare URL. |
| agent-card | Agent card | The well-known agent card names the platform and its endpoints, so crawlers and agent frameworks can identify the deployment. |
| mcp-initialize | MCP initialize | The MCP endpoint answers a protocol initialize and identifies itself as the a2ally server with a supported protocol version. |
| mcp-core-tools | MCP core tools | tools/list exposes the core rights, identity and ledger tools an agent integration depends on (ask_a2ally, check_license, kya_lookup, verify_rights_manifest, ledger_verify). |
| kya-configuration | KYA configuration | The open RS-KYA standard's levels (L0–L2) are published at the well-known configuration and at /v1/kya, so relying parties can read the level definitions from the deployment itself. |
| issuer-keys | Issuer keys published | The keys that sign registration certificates and ledger blocks are published with their status, so signatures can be verified without trusting the deployment. |
| jwks | JWKS published | The JSON Web Key Set behind kya+jwt tokens is served, so tokens can be verified offline. |
| pricing-honest | Honest pricing document | The machine-readable pricing lists every line with its planned price, states that nothing is charged during the preview, and names placement, grades and verdicts as never for sale. |
| ledger-head | Ledger head served | The public append-only ledger answers with its signed head block, so history is inspectable from the outside. |
| rate-limit-transparency | Published rate limits | The limits are published at /v1/limits and every API response carries its remaining budget, so agents can pace themselves instead of guessing. |
| ask-answers | Ask answers deterministically | A plain-English rights question gets a deterministic license verdict (permitted, prohibited, needs_review or not_documented) — the decision agents actually rely on. |
| a2a-endpoint | A2A endpoint | The A2A (Agent2Agent) endpoint the agent card names as its url answers message/send with a completed task carrying the structured result, and tasks/get returns the same task — so A2A-native agents can work with the deployment, not just read its card. |
Run it
curl -s https://www.a2ally.com/v1/conformance | head -60Or call the check_conformance tool on the MCP endpoint (https://www.a2ally.com/mcp) — with an optional target_url to check any deployment. The result is machine-readable JSON: per-check pass/fail with the exact request each check made.
Verify the verifier
The checklist above grades a deployment. The ledger's verification rules are graded too. a2ally publishes verifier conformance vectors at /v1/conformance/vectors: a small reference chain that is built and signed correctly, published with its key set and the exact outcomes a correct verifier must reproduce — head height and hash, entry and Merkle hashes — plus copies with one thing altered: an entry changed after sealing, a Merkle root its entries do not produce, a corrupted block signature, a chain with its head missing, a manifest whose body hash disagrees with its signed statement. Each altered copy is labeled with the checks that must fail.
The published second verifier — a standalone Python implementation of the same rules, separate from this service — runs them directly:
curl -fsSLO https://www.a2ally.com/cli/verify-ledger.py
python3 verify-ledger.py --conformanceAny other implementation of the ledger's rules can be held to the same vectors. A verifier that accepts an altered chain, or rejects the good one, is not implementing the rules — whatever it reports about a deployment should be read with that in mind.
An honest label
The check runs against the deployment's own public surface, and the result is self-reported by the deployment. It is a strong compatibility signal, not an independent audit: every check names its method, so re-run any check yourself before relying on a deployment for anything important. A deployment is certified only while every check passes; the moment one fails, the label drops.
Show the badge
Deployments that pass can link the live checklist:
<a href="https://www.a2ally.com/conformance"><img src="https://www.a2ally.com/conformance/badge.svg" alt="a2ally Certified"></a>