Introducing SuperQode A2A for Harness Recommendation and Evaluation

A2A reached 1.0 in March 2026 and now sits under the Linux Foundation as part of the Agentic AI Foundation. It answers one question: how does a system find an agent it has never met and hand it work? Discovery is an Agent Card at a well-known URL, and operations go to whatever interface that card advertises. Coding agents largely skipped it. This corner of the ecosystem settled on the Agent Client Protocol for connecting an editor to an agent and on MCP for attaching tools to a loop, and neither lets an outside system discover a coding harness and ask it something. We went looking for another harness publishing an Agent Card and did not find one. SuperQode now publishes one at super-agentic.ai/.well-known/agent-card.json, answering requests today, with no account to create and nothing to install.

What the SuperQode A2A agent serves

One skill, harness-shortlist. It searches the Harness Hub for third-party coding agents matching constraints stated in ordinary English and returns catalogue entries with licence and setup detail. Ask it for open-source agents that run offline against local models and the reply leads with Qwen Code, Dirac, Hermes Agent, Kilo, and Kimi Code. Those are other people's products. SuperQode's own harnesses are excluded from the ranking, and the reply discloses that exclusion, because an agent that recommends its owner's product on every request is an advertisement and nobody wires an advertisement into a toolchain.

It also reports where the catalogue is silent instead of filling the gap. A request mentioning local models comes back saying the Hub does not record that field for the entries returned, since each vendor owns its own tool loop, so offline behaviour has to be measured and cannot be looked up. Readiness and capability are reported from catalogue records and never scored into a quality judgment. Establishing that one harness performs better than another on a given repository is what HarnessBench exists for, and the reply states that outright, so nobody mistakes a shortlist for a result.

Safe defaults in the A2A surface

The A2A surface can serve two skills. One runs a harness with a real model, real tools, and a real working directory. The other is the shortlist. A public deployment serves only the second, and the code enforces that independently of how we deployed it: binding outside localhost requires --allow-remote, and a remote bind withholds the harness skill unless the operator also passes --expose-harness with a --spec and a --token. The bound spec decides what an accepted request may do, so serving a harness to strangers without one would grant an undefined capability. The token is required because the harness runs work and spends money, and a shared bearer is still a credential. A request to the public agent therefore never reaches a model holding tools or touching a filesystem. Anyone can lift that restriction on a deployment they own. We have not lifted it on ours.

A2A protocol versions, access, and rate limits

The card advertises JSON-RPC at 1.0, JSON-RPC at 0.3, and HTTP+JSON at 1.0. The 0.3 entry exists because several host platforms still negotiate that version and an agent advertising 1.0 alone is unregistrable on them. What catches integrators out is that 1.0 renamed the methods: 0.3 calls it message/send, 1.0 calls it SendMessage, and the body shape changes with it. The A2A-Version header states which vocabulary is arriving, and a request has to be internally consistent, so a 0.3 method name under a 1.0 header is rejected outright. Read the interface URL out of the card. Assuming operations live at whichever host served it will fail, because the discovery origin and the operational interface are separate addresses.

Open access runs at ten requests per minute and uses a keyword parser to extract constraints, which is cheap enough to leave on the internet and misses indirect phrasing. Keys raise the ceiling and switch to a model reading the request, and that model is never shown the catalogue and never asked to name a harness, so it cannot introduce a claim the Hub does not record. Keys carry their own signature, so verification is a signature check with no database behind it, and it fails closed. Keys are issued by hand at the moment. Email hello@super-agentic.ai with a sentence about what you are building.

Connecting SuperQode A2A from Foundry and Gemini Enterprise

Both major enterprise agent platforms can call an external A2A agent, and the SuperQode card satisfies both as published. Microsoft Foundry exposes an A2A tool that supports protocol versions 1.0 and 0.3, fetches the Agent Card anonymously, and passes text only. Gemini Enterprise registers agents through its Agent Registry, which supports the same two versions and reads supportedInterfaces directly, so registration amounts to pasting the card JSON into the console. Advertising 0.3 alongside 1.0 is what makes an agent registrable on platforms that still negotiate the older version, which is why the card carries both.

Neither platform publishes a third-party agent to other customers by default. A Foundry connection is scoped to the project that creates it, and Gemini Enterprise routes commercial distribution through Google Cloud Marketplace as a separate path. A customer on either platform can connect SuperQode today without anything from us, and the step-by-step walkthrough for Foundry is in the SuperQode A2A documentation.

Running your own A2A agent

Everything described here ships in the open-source package, and the public agent is that package with the harness skill withheld. The full command surface and configuration reference are on the SuperQode A2A page.

Limits worth stating plainly. Recommendations are as current as the Hub and no more, so a harness released this week is absent until we add it. Nothing returned is measured, and turning a shortlist into a defensible ranking means running HarnessBench against your repository with your model. Streaming is advertised and works; push notifications are not implemented, and the card declares that plainly, so nobody wires up a capability that would fail on first use. An Agent Card is a small artifact for the amount it settles, and it has been available to coding harnesses for a while without being used. SuperQode is open source and the A2A server ships with it, so a card of your own is one command away.