Production-grade TypeScript runtime and toolkit for Agent2Agent (A2A): agent cards, JSON-RPC tasks, registry discovery, transports, adapters, MCP bridge, and conformance fixtures.
Ask DeepWiki · Roadmap · Maturity report · OpenSSF evidence · Security assurance case
A2A Mesh is an independent TypeScript runtime and toolkit for the Agent2Agent (A2A) protocol. It is not an official Google, Linux Foundation, or a2aproject package.
A2A Mesh keeps public trust evidence in docs/security/trust-evidence.md and release package verification evidence in docs/release/package-verification.md. The README badges link to workflow-backed signals only: CI, docs, security, OpenSSF Scorecard, OpenSSF readiness, npm package metadata, license, and package-manager constraints.
- A2A server runtime and client SDK for Agent Cards, JSON-RPC messages, tasks, artifacts, and status transitions.
- Registry components for local discovery and health polling.
- Adapters for OpenAI, Anthropic, LangChain, Google ADK, LlamaIndex, and CrewAI HTTP bridge flows when the optional peer dependency is installed.
- CLI commands for validation, discovery, sending messages, registry export/import, monitoring tasks, benchmarking, diagnostics, and scaffolding.
- MCP bridge, WebSocket transport, gRPC transport, and testing helper packages for repository-verified workflows.
- Runnable examples for authenticated servers, streaming, push notifications, registry tenancy, WebSocket, gRPC, MCP bridge, adapter templates, and a multi-agent registry discovery mesh.
pnpm add @a2amesh/runtimePowerShell:
pnpm add @a2amesh/runtimepnpm dlx @a2amesh/create-a2amesh demo
cd demo
pnpm install
pnpm run devPowerShell:
pnpm dlx @a2amesh/create-a2amesh demo
Set-Location demo
pnpm install
pnpm run deva2amesh validate ./agent-card.json
a2amesh discover http://127.0.0.1:3000
a2amesh init demo-agent --adapter custom
a2amesh send http://127.0.0.1:3000 "hello"
a2amesh task status http://127.0.0.1:3000 task-123
a2amesh health http://127.0.0.1:3000 --timeout-ms 1000 --json
a2amesh conformance http://127.0.0.1:3000 --protocol-version 1.0 --json
a2amesh conformance-badge report.json --output badge.svg
a2amesh registry export --url http://127.0.0.1:3099 --output ./registry-export.json
a2amesh registry import --url http://127.0.0.1:3099 --input ./registry-export.json
a2amesh export-card http://127.0.0.1:3000 --output ./agent-card.json
a2amesh monitor http://127.0.0.1:3000 --cycles 3
a2amesh benchmark http://127.0.0.1:3000 --requests 25 --concurrency 5
a2amesh release-check
a2amesh doctor --json
a2amesh replay ./task-123.cassette.jsonl
a2amesh trust sign ./agent-card.json --key ./signing-key.pem --key-id my-key --output ./agent-card.signed.json
a2amesh trust verify ./agent-card.signed.json --trusted-key my-key:./public-key.pemPowerShell:
a2amesh validate .\agent-card.json
a2amesh discover http://127.0.0.1:3000
a2amesh init demo-agent --adapter custom
a2amesh send http://127.0.0.1:3000 "hello"
a2amesh task status http://127.0.0.1:3000 task-123
a2amesh health http://127.0.0.1:3000 --timeout-ms 1000 --json
a2amesh conformance http://127.0.0.1:3000 --protocol-version 1.0 --json
a2amesh conformance-badge report.json --output badge.svg
a2amesh registry export --url http://127.0.0.1:3099 --output .\registry-export.json
a2amesh registry import --url http://127.0.0.1:3099 --input .\registry-export.json
a2amesh export-card http://127.0.0.1:3000 --output .\agent-card.json
a2amesh monitor http://127.0.0.1:3000 --cycles 3
a2amesh benchmark http://127.0.0.1:3000 --requests 25 --concurrency 5
a2amesh release-check
a2amesh doctor --json
a2amesh replay .\task-123.cassette.jsonl
a2amesh trust sign .\agent-card.json --key .\signing-key.pem --key-id my-key --output .\agent-card.signed.json
a2amesh trust verify .\agent-card.signed.json --trusted-key my-key:.\public-key.pem| Package | Purpose |
|---|---|
@a2amesh/protocol |
Protocol types, Agent Card, Task, Message, Artifact, JSON schemas, compatibility fixtures. |
@a2amesh/runtime |
A2A client/server runtime, task lifecycle, streaming, push, auth hooks, storage, telemetry hooks. |
@a2amesh/registry |
Agent discovery, health, trust score, signed cards, registry API. |
@a2amesh/mcp |
Secure, auditable, approval-aware, policy-bound A2A ↔ MCP bridge. |
@a2amesh/cli |
CLI binary a2amesh. |
@a2amesh/create-a2amesh |
Project scaffolder. |
The implementation targets Agent2Agent protocol v1.0.0. See Compatibility for the supported Node.js, package, protocol, transport, optional peer, and deprecation policy matrix.
- Public HTTP server mode must use authentication unless it is bound to loopback.
- A2A server and registry HTTP routes apply a per-client request limit by default.
- Remote fetches and callback URLs pass SSRF policy helpers.
- CORS and WebSocket origin checks fail closed when configured.
- CLI and bridge code avoid printing full auth headers or concrete secret values.
- Release publishing is owner-triggered only and uses npm Trusted Publishing/OIDC.
| Surface | Status | Verification |
|---|---|---|
| OpenAI adapter | Supported | Unit tests with fake provider objects. |
| Anthropic adapter | Supported | Unit tests with fake provider objects. |
| LangChain adapter | Supported | Unit tests with fake runnables. |
| Google ADK adapter | Supported | Unit and streaming tests. |
| LlamaIndex adapter | Supported | Unit tests with fake provider objects. |
| CrewAI HTTP bridge | Supported | Unit tests with local fetch mocks. |
| SSE streaming | Supported | Unit and integration tests. |
| WebSocket transport | Supported | Package tests. |
| gRPC transport | Kept as package surface | Build and package checks; see compatibility notes. |
| MCP bridge | Supported | Mapping tests. |
Docs site: https://oaslananka.github.io/a2amesh/
See CONTRIBUTING.md for setup, validation, and pull request guidance.
Run pnpm run verify before submitting changes.
Apache-2.0. See LICENSE.
This repository is maintained as a professional open-source project. See the maturity and contribution documents for the current operating model: