Interface ResolveAgentCardOptions

Options controlling how a fetched agent card's RPC URL(s) are validated against the location the card was fetched from. See validateCardRpcTargets for what each check defends against and why both default to failing closed.

interface ResolveAgentCardOptions {
allowCrossOriginRpc?: boolean;
allowInsecureRpc?: boolean;
}

Properties

`Optional`allowCrossOriginRpc

allowCrossOriginRpc?: boolean

Explicit escape hatch to accept an RPC URL whose origin differs from the location the card was fetched from.

This is intentionally permissive: it is what lets a compromised or misconfigured card-hosting endpoint redirect all subsequent A2A traffic for this agent, including whatever credential material the request-forwarding path carries, to a different origin than the one that was actually configured and fetched. The A2A spec allows a card to point RPC at a different origin than where the card itself is served from (e.g. static card hosting separate from the API backend), which is the legitimate case this exists for -- only set this when that's a shape you actually expect. When set to true, a loud warning is logged for each RPC URL this affects.

Defaults to false: every RPC URL must share the origin the card was fetched from.

`Optional`allowInsecureRpc

allowInsecureRpc?: boolean

Explicit escape hatch to accept a plaintext http:// RPC URL on a non-loopback host.

This is intentionally insecure: an RPC URL that isn't https and isn't on this machine can be intercepted or altered by anything on the network path, even when its origin matches the card's own. Only set this for a card source you know serves plain http on a host you trust (e.g. a private, internal service reached over a channel that's secured some other way). When set to true, a loud warning is logged for each RPC URL this affects.

Defaults to false: RPC URLs must be https, or http on a loopback host (localhost, 127.0.0.0/8, ::1, 0.0.0.0, or ::).