Do not open a public issue for a suspected vulnerability. Use this repository's private Report a vulnerability form under the Security tab and include:

• the affected version or commit;
• a minimal reproduction;
• expected and observed behavior;
• impact and any known mitigations.

Do not include live credentials, personal data, or data from systems you do not own. We will acknowledge a valid report as quickly as practical and coordinate remediation and disclosure with the reporter.

This project validates protocol envelopes and performs optional read-only discovery probes. It does not make an endpoint trustworthy. Implementations must still:

• authenticate clients and authorize every A2A task and MCP capability independently;
• treat Agent Cards, tool descriptions, annotations, URLs, artifacts, and returned content as untrusted input;
• use HTTPS in production and validate certificate identity;
• protect against SSRF, DNS rebinding, redirect-to-private-network attacks, and unbounded response bodies;
• bind credentials to their intended issuer, audience, workspace, agent, and capability;
• require appropriate authority before external communication, publication, payment, deletion, or another irreversible effect;
• prevent cross-tenant task, artifact, and tool access;
• redact secrets from logs and never place credentials in Agent Cards or fixtures.

The included CLI follows redirects only through the platform fetch implementation and applies a response-size limit after download. Production probes should additionally enforce network egress policy and streaming byte limits before connecting to untrusted endpoints.

Until the first stable release, security fixes are applied to the latest release on the default branch.