EmissarRequest early access
Menu

Changelog

What has actually shipped, with dates. Plans live on the product pages; this page is only for things you can use.

Front Door speaks PACT

  • Personal agents that use PACT, the Personal Agent Consent & Trust Protocol published on October 6, can now talk with any business on Front Door at frontdoor.emissar.ai. The agent proves which platform it is with a token it signs; Front Door checks it against the keys the platform publishes, then holds the conversation in plain words.
  • Front Door picks the service the agent asks for, asks for the details it needs, and sends the request through the same checks, limits, reviews and records as every other request. The demo answers at frontdoor.emissar.ai/a2a/demo. This covers PACT's identity profile; customer sign-in and scopes (its delegated profile) come next.
  • New guide: what the Personal Agent Protocol and PACT define, and how they use A2A, MCP and OAuth.

Resolve: public lookups of domains

  • resolve.emissar.ai answers which A2A Agent Card speaks for a domain, for the websites EmissarBot found publishing one. Lookups are free, anonymous and read-only, and they aren't logged. Each answer says how the record was verified and when it expires.
  • Records come from EmissarBot's crawls and are updated daily. Phone numbers, brand names and claims by businesses come later; the methods are in the Resolve specification, published for comment.

Front Door: signed receipts and mandates

  • Front Door now implements two of the published specifications. An agent can ask for a signed receipt of a finished task (Emissar Receipt): the business's signature over digests of what was asked and answered, which the agent can countersign and either side can retrieve. The demo's Agent Card declares it.
  • A business can require a mandate for chosen requests (Emissar Mandate), and Front Door checks its signature, scope, limits, expiry and revocation before the request reaches the business. The demo doesn't require one.

Three specifications published for comment

  • Emissar Mandate v0.1 defines a credential that says what an agent may do for one person or company, and how the agent presents it in an A2A task. Emissar Receipt v0.1 defines a signed record of what two agents asked, answered and agreed to. Emissar Resolve v0.1 defines a registry that maps a phone number, domain or brand name to the Agent Card that answers for it.
  • Each comes with a JSON Schema, runnable examples and a validator, and the Receipt and Resolve APIs with OpenAPI documents. Their A2A extension URIs now lead to the specifications. All three are drafts and may change; the Specifications page, linked at the foot of every page, lists them.

The agent directory follows AI Catalogs

  • When a site has no Agent Card at the two well-known paths but its AI Catalog lists one at another address on the same site, EmissarBot now reads that card, and the agent directory lists the site. It makes at most one such request per site, and robots.txt still applies.
  • These cards are kept apart from the adoption counts in our reports, which stay limited to the well-known paths. A directory entry found this way says so, and links to the site's catalog.

The Agent Card validator checks AI Catalogs

  • Enter a site's /.well-known/ai-catalog.json URL, or paste a catalog, and the validator checks it against the AI Catalog specification: required fields as failures, recommendations as warnings, and the conformance level it meets. Results can be shared for 24 hours, like card results.
  • Catalog signatures and trust manifests, the basis of the specification's Level 3, are reported but not verified. The readiness scanner's catalog report notes them too.

Front Door: push notifications for A2A agents

  • An agent that calls a business through Front Door over A2A can ask to be sent each change of its task instead of checking back. Front Door posts the task to the address the agent gives, with the token or credentials the agent chose, under A2A versions 1.0 and 0.3.
  • Those tokens and credentials are stored encrypted and never shown back, and updates to any one server are capped so nobody can turn them into a flood. The demo's Agent Card now declares push notifications.

Front Door for personal assistants

  • Every business on Front Door now has an MCP endpoint next to its A2A endpoint, so the AI assistants people use can send it requests. Each of the business's services is a tool, and requests go through the same checks, limits and review as agent-to-agent requests.
  • An assistant can ask to be told when a request changes. Front Door sends a signed update to the address the assistant gives, once that address confirms it wants them (MCP Events), so nobody has to keep checking.
  • A request can say who it is for, as the assistant was told it, and the business verifies the person before acting. Requests from ChatGPT are recognized by the addresses OpenAI publishes, and each one stays with the ChatGPT user who made it.
  • The demo at demo.frontdoor.emissar.ai takes a refund request the way a person's assistant would send one: who it is for, a one-time code, and a person's review over 200 USD. Demo data only.

AI Catalog: published and checked

  • Emissar publishes an AI Catalog at /.well-known/ai-catalog.json, the draft format from the Agent Card Working Group that lists a site's agents and MCP servers in one file. A2A has an open proposal to make it the preferred way to discover agents.
  • The agent-readiness scanner now reads a site's AI Catalog and reports whether it meets the specification's required fields and conformance level, and how many agents and MCP servers it lists. It isn't scored until A2A adopts the format.
  • EmissarBot now also requests /.well-known/ai-catalog.json on each site it checks, so adoption reports can count catalogs as well as Agent Cards. /bot lists the four paths it requests.
  • Every business behind Front Door publishes a catalog listing its agent. The Agent Card generator has an AI Catalog tab, and a new guide, AI Catalog explained, covers the format, where adoption stands and how to publish one.

AI agent signature check

  • A free tool that shows whether an AI agent signs its requests: create a test link, give it to the agent, and see each request it sent, verified, unsigned or invalid, with the host that publishes the signing key, the key and the parts of the request it covered.
  • It runs the same Web Bot Auth checks as Front Door, and names ChatGPT's cloud browser, Google-Agent, Cloudflare Browser Run, Browserbase and EmissarBot when their keys sign. Links and what they record are deleted after 24 hours, and no IP addresses are kept.

October crawl and a refreshed agent directory

  • EmissarBot's monthly crawl of the Tranco top one million (list Y83YG) checked 996,150 domains and found 276 A2A Agent Cards: 205 in the v1.0 shape and 71 in the v0.3 shape. None is signed, and none is on one of the 1,000 highest-ranked domains.
  • The agent directory now lists the 272 sites from the October crawl. 31 domains that had no card in September's crawl now serve one.

Signed requests and a signed Agent Card

  • EmissarBot signs every request it sends (Web Bot Auth: HTTP Message Signatures, RFC 9421). The public key is at /.well-known/http-message-signatures-directory, and /bot explains how to check a signature.
  • The free tools signed their requests too for a few hours on September 28. They no longer do: anyone can point a public tool at any site, so its signature would prove nothing about who asked.
  • Emissar's Agent Card is signed (JSON Web Signature, A2A v1.0 section 8.4), with its public key at /.well-known/jwks.json. The Agent Card validator reports the signature as verified.

State of Agent-to-Agent report and a Front Door demo

  • Published State of Agent-to-Agent, 2026 Q3: A2A Agent Card adoption across 999,550 of the Tranco top one million websites, with methodology and an aggregate CSV.
  • A Front Door demo for a made-up freight company answers A2A requests at demo.frontdoor.emissar.ai: quote requests, order status and delivery exceptions, with missing-detail prompts and review holds.
  • The Front Door demo checks HTTP Message Signatures (RFC 9421, Web Bot Auth) on incoming requests and reports the result on each task.

Learn, compare, glossary, use cases, industries, tools and the agent directory

  • 20 Learn guides, 23 comparisons, 148 glossary terms, 40 use cases and 12 industry pages, each with sources.
  • Free tools: Agent Card generator, .well-known generator, cost calculator, A2A endpoint tester and agent-readiness scanner with a published rubric.
  • The agent directory at /directory lists sites that publish an Agent Card, from EmissarBot's crawl.
  • EmissarBot started its first full crawl of the Tranco top one million.

Agent Card validator, first guides and a contact form

  • The Agent Card validator checks cards against A2A v1.0, including JWS signatures, and shares results for 24 hours.
  • The first five Learn guides and 30 glossary terms.
  • A contact form replaced published email addresses.

emissar.ai and Emissar's public agent go live

  • Launched emissar.ai with public status for all seven product modules.
  • Emissar agent 0.1.0 is live on A2A 1.0 over JSON-RPC, with an Agent Card at /.well-known/agent-card.json.
  • A2A 0.3 JSON-RPC method names and shapes are also accepted, and a v0.3-shaped Agent Card is served at /.well-known/agent.json.
  • Early access can be requested through the website or over A2A.