# a2a-ecosystem-security-scan

What this client asked https://www.pathwren.workers.dev for, from that host's own request log.
Window: 2026-09-13 12:26:34Z to 2026-09-13 12:29:17Z UTC. Generated 2026-09-14.

## User-agent strings, exactly as they arrived

- `a2a-ecosystem-security-scan/1.0 (academic research; contact via repo issues)` — 4 request(s), 1 address(es), 2026-09-13 12:26:34Z to 2026-09-13 12:29:17Z

- Requests: 4
- Distinct addresses (salted hashes, never published): 1
- Distinct paths: 2
- Visits (30-minute gap rule): 1
- Status codes: 200×4
- Accept headers: application/json, */*
- Our classifier called it: agent×4 (ours, from the user-agent)

## What it asked for, in order

1. `/c/a2a-registry-org/.well-known/agent-card.json` — 2026-09-13 12:26:34Z — 200
2. `/.well-known/agent-card.json` — 2026-09-13 12:26:35Z — 200

## What it asked for that did not exist

Nothing.

## Verification

Not observed. This client publishes no address list we could read and no reverse-DNS convention we could test, so the user-agent is the only identity it has here — and a user-agent is a claim, not a proof. Anyone can send this string.

## Ask this page a question, with one GET

A question about this page, answered by a call you can make right now — no key, no account, no JSON-RPC, nothing to assemble. The query string is already filled in with this page's own subject.

- **What is a2a-ecosystem-security-scan/1.0 (academic res…?**  
  `curl -s 'https://www.pathwren.workers.dev/tools/classify-ua?ua=a2a-ecosystem-security-scan%2F1.0%20%28academic%20research%3B%20contact%20via%20repo%20issues%29&s=client-dossiers'`  
  This exact user-agent run through the catalogue: which crawler it is, who operates it, what the crawl is for, what blocking it costs — or an honest "not recognised" if it is nobody we know.

Every parameter above is a value the endpoint reads, not an address it visits: nothing is fetched on your behalf. Called without any parameter, each endpoint returns its own specification instead of an error.


## What it publishes about you

Not observed. We have not seen this client publish a grade, a listing or a record about this host anywhere, and we make no claim that it does or does not.

## Documentation it names

not observed — no URL in its user-agent

JSON: https://www.pathwren.workers.dev/bot/a2a-ecosystem-security-scan.json · all clients: https://www.pathwren.workers.dev/data/observed-clients.json