Open for Agents

For developers

Login for the agent web, on the business's side: one connection for every agent, in the protocols they already speak.

MCP, A2A, UCP, ACP, and AP2 exist, and PAP is on the way. The fragmentation is the problem: every agent platform wants its own integration with every business. Open for Agents is Auth0, not OAuth. We invent no protocol; we implement them, neutrally, behind one connection per business, with the owner's policy, consent, and audit log on top. Point any client at the live sample tenants.

Get started freeCall the sample agent
Live sample tenant
curl -s https://openforagents.ai/t/sample-travel/a2a/agent-card.json

Auth0, not OAuth

The protocols exist. The fragmentation is the problem.

OAuth did not win login for the web; the companies that implemented every provider behind one integration, with the rules and the audit on top, did. The agent web has the same shape: every assistant wants its own connector, sign-in, and checkout per business. Open for Agents is that layer for the business side.

What we build is the breadth (every protocol, every agent), the neutrality (no assistant is favored, the owner lists the business per platform), and the control layer (policy before execution, consent, audit on every call). The bet is that assistants calling businesses becomes universal. We measure that weekly against written kill criteria, starting with ten businesses live.

  • MCP Live

    How assistants call a business's tools: per business at /t/{slug}/mcp, and one connection at /mcp.

  • A2A 1.0 Live

    How agents from different companies talk: a signed agent card and a hosted agent per business.

  • UCP Live

    Checkout for Shopify and Google surfaces, on the same quotes.

  • ACP Live

    Checkout in ChatGPT, on the same quotes.

  • AP2 Live

    Spending limits a shopper sets in advance, checked before every payment.

  • PAP (Personal Agent Protocol)

    Announced by Sierra with Meta, Shopify, Stripe, and Walmart on 6 October 2026; the v0.1 spec is not published yet. We will speak it when it is.

Any agent

Works with any agent

Every MCP or A2A client connects the same way: https://openforagents.ai/mcp or https://openforagents.ai/t/{slug}/mcp, with an Authorization: Bearer a2h_live_... header or OAuth discovered from /.well-known/oauth-protected-resource. Exact configs per agent are on /connectors.

  • Muse Checked

    Meta

    A custom connector, with a key the business issues or the shopper's own sign-in. How to connect

  • ChatGPT Checked

    OpenAI

    An app added in developer mode, with the shopper's own sign-in. How to connect

  • Grok Checked

    xAI

    Remote tools in the Grok API, with a key the business issues. How to connect

  • Gemini Checked

    Google

    Gemini CLI over MCP; Gemini Enterprise over A2A. How to connect

  • Microsoft Copilot Compatible

    Microsoft

    A tool in Copilot Studio over MCP, or an agent over A2A. How to connect

  • Claude Checked

    Anthropic

    A custom connector in Claude, or one command in Claude Code. How to connect

  • OpenClaw Checked

    open source

    One entry in its config file. How to connect

  • Hermes Checked

    Nous Research, open source

    One entry in its config file. How to connect

Checked: our go-live check calls a business's tools the way that agent does, and a business is listed to that agent only after it passes. Compatible: it speaks the same open standards and connects the same way, but we do not test it yet.

Agentic ready today

Everything an agent reads, generated from one source.

An offers feed, a Shopify store, or an imported OpenAPI description is the source for every file and every tool. Nothing on the business's website has to change.

  • Readiness scan Live

    Up to 25 public pages, robots.txt honored, no cookies or logins. Verified findings with evidence, predicted findings labeled, and an A2A readiness category that validates a site's agent card against 1.0. POST /api/scans.

  • Readiness kit Live

    /t/{slug}/kit for a tenant with a verified domain: llms.txt and llms-full.txt, schema.org JSON-LD from the offers, the agent card for /.well-known/agent-card.json (copy or 302), robots.txt rules per AI agent, an MCP connect guide, a head snippet and an agents sitemap, as files or one zip. A deployment check fetches the domain and reports each file.

  • Shopify sync Live

    Reads the store's UCP catalog (search_catalog only) or products.json every hour, with requests signed by Web Bot Auth. The catalog maps onto the same offers model.

  • Meta Catalog feed Live

    GET /t/{slug}/meta-catalog/{token}.csv: a scheduled feed for Meta Commerce Manager, rebuilt on every import, with an ETag and a sampled price audit against live data. Goods only, off until the owner enables it.

  • Offers feed and OpenAPI import Live

    The a2ahello-offers/1 format in JSON or CSV (a spreadsheet export works), or an OpenAPI 3.x description whose GET operations on verified hosts become draft tools.

Agent native

Hello over A2A

A2A (Agent2Agent) is the open protocol agents from different vendors use to talk to each other, a hosted project of the Agentic AI Foundation alongside MCP. Copilot Studio, Gemini Enterprise, ServiceNow, and SAP Joule can call external A2A agents. Open for Agents is the other side of that call for a business.

  • A2A 1.0 server Live

    POST /t/{slug}/a2a, JSON-RPC binding, A2A-Version: 1.0: SendMessage, SendStreamingMessage (SSE), GetTask, ListTasks, CancelTask, SubscribeToTask, push notification configs, and GetExtendedAgentCard for key holders. A task is visible only to the caller that created it.

  • Signed agent card Live

    GET /t/{slug}/a2a/agent-card.json, signed per A2A 1.0 section 8.4: a detached JWS over the JCS-canonical card, EdDSA (Ed25519), with kid and jku pointing at /.well-known/jwks.json. Cards are re-checked daily.

  • Hosted business agent Live

    Send plain text and the business's agent answers from its published read-only tools, with per-turn and daily spend caps, tool results passed to the model as untrusted data, and links only to the business's verified domains. A data part {skill, arguments} runs a tool directly, with no model in the loop.

  • Outbound and transcripts Live

    The agent can ask peers the owner allowlists: each card is fetched through the egress guard, validated, and its signature verified when present; credentials are sealed with AES-256-GCM; 100 calls per tenant per day. Both directions are stored per contextId with messages, tool calls, states, and outcome, for 30 days.

  • Customer-agent memory Live

    Only for identified callers (API key, hosted agent, Web Bot Auth signature, or a customer handle), never by IP address or user agent. Structured needs and preferences, at most one restock message per 7 days with the owner's offer template, and the verbs status, opt_out, and delete.

  • Directory Live

    Opt-in listing at /agents and /agents.json, plus a directory agent at /.well-known/agent-card.json with one skill, find_agents. Only businesses with a verified domain are listed, marked verified and signed from the card check.

  • Analytics by platform Live

    Calls, quotes, orders, confirmed revenue, and error codes per calling platform, taken from the credential, never from the User-Agent. Tracked /go/ links count handoffs to the business's own pages.

agent-card.json (excerpt, live)
{
  "name": "Cobalt Ridge Expeditions (sample)",
  "supportedInterfaces": [{
    "url": "https://openforagents.ai/t/sample-travel/a2a",
    "protocolBinding": "JSONRPC",
    "protocolVersion": "1.0"
  }],
  "capabilities": {
    "streaming": true,
    "pushNotifications": true,
    "extendedAgentCard": true,
    "extensions": [{
      "uri": "https://modelcontextprotocol.io/specification/2026-07-28",
      "required": false
    }]
  },
  "securitySchemes": {
    "a2ahello_key": { "httpAuthSecurityScheme": { "scheme": "Bearer" } }
  },
  "skills": [
    { "id": "a2ahello-agent", "name": "Cobalt Ridge concierge", "tags": ["agent", "conversation", "public"] },
    { "id": "search_items", "name": "Search items", "tags": ["feed", "public"] },
    ...
  ],
  "signatures": [{
    "protected": "eyJhbGciOiJFZERTQSIsInR5cCI6IkpPU0UiLC...",
    "signature": "..."
  }]
}
SendMessage, deterministic skill call
curl -s https://openforagents.ai/t/sample-travel/a2a \
  -H 'content-type: application/json' -H 'A2A-Version: 1.0' \
  -d '{"jsonrpc":"2.0","id":1,"method":"SendMessage","params":{"message":{
    "role":"ROLE_USER","messageId":"m1","parts":[{"data":{
      "skill":"search_items",
      "arguments":{"query":"Patagonia","from":"2027-03-01","to":"2027-03-31","min_quantity":2}}}]}}}'

Agents that transact

Quote, preview, approve, commit.

The transact tools Live run on the business's offers under a cached-price policy (prices at most 15 minutes old) and are the same as MCP tools and A2A skills. They need an authenticated caller and an agent policy above quote_only.

  • search_items, get_item, get_availability

    Read the offers: text, type, category, location, dates, quantity, and price; variants and availability with tracked links.

  • get_quote

    A binding price for one item, variant, slot, and quantity: line items, taxes, fees, total_minor, currency, cancellation_terms, and expires_at (at most 15 minutes).

  • create_hold

    Reserves the quoted stock and price until held_until.

  • create_order, create_booking

    Commits a quote or a hold. Two names for one tool; the order's kind follows the business's settings.

  • get_order

    Status, items, totals, and what can still be changed.

  • get_cancellation_quote

    fee_minor, refund_minor, and free_until, valid for 15 minutes.

  • cancel_order

    Cancels at the fee of a cancellation quote.

  • modify_order

    Changes the date, quantity, or variant and returns the new quote, amount_due_minor, and refund_minor.

  • Money is integer minor units with an ISO 4217 currency. Timestamps are UTC ISO 8601.
  • Every write takes an idempotency_key (8 to 100 characters), scoped to the caller: the same key and arguments return the stored result, other arguments return idempotency_conflict.
  • dry_run: true runs the real write (locks, pricing, stock) and rolls it back, returning the exact payload the user approves. Live
  • A quote never re-prices silently: price_changed carries the new quote, and quote_expired says why.
  • Every result carries schema_version: "tools/v1". Errors share one envelope, {code, message, details, retryable, request_id}, with codes price_changed, sold_out, quote_expired, requires_approval, policy_blocked, payment_declined, not_found, rate_limited, idempotency_conflict, invalid, and upstream_error.
get_quote on the sample store
curl -s https://openforagents.ai/t/sample-shop/mcp \
  -H 'content-type: application/json' -H "Authorization: Bearer $OPENFORAGENTS_KEY" \
  -H 'MCP-Protocol-Version: 2026-07-28' -H 'Mcp-Method: tools/call' -H 'Mcp-Name: get_quote' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_quote",
    "arguments":{"item_id":"trail-tee","variant_id":"s","quantity":2},
    "_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientCapabilities":{}}}}'
Result (excerpt)
"structuredContent": {
  "schema_version": "tools/v1",
  "quote": {
    "quote_id": "...", "kind": "order",
    "line_items": [{ "item_id": "trail-tee", "variant_id": "s", "quantity": 2,
                     "unit_price_minor": 3900, "total_minor": 7800, ... }],
    "taxes": [], "fees": [], "subtotal_minor": 7800, "total_minor": 7800, "currency": "USD",
    "expires_at": "...", "price_source": "feed_cache",
    "cancellation_terms": { "free_until": "...", "fee_minor": 0, "fee_percent_bp": 0, "currency": "USD", "notes": null }
  }
}
create_order as a dry run
curl -s https://openforagents.ai/t/sample-shop/mcp \
  -H 'content-type: application/json' -H "Authorization: Bearer $OPENFORAGENTS_KEY" \
  -H 'MCP-Protocol-Version: 2026-07-28' -H 'Mcp-Method: tools/call' -H 'Mcp-Name: create_order' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"create_order",
    "arguments":{"quote_id":"<quote_id>","idempotency_key":"6f1c2a9e-0b7d-4e58-9d1a-2f3c4b5a6d7e","dry_run":true},
    "_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientCapabilities":{}}}}'
Result (excerpt)
"structuredContent": {
  "schema_version": "tools/v1",
  "dry_run": true,
  "order": { "order_id": null, "kind": "order", "status": "preview", "quote_id": "...",
             "line_items": [...], "total_minor": 7800, "currency": "USD",
             "cancellation_terms": {...}, "payment": null,
             "servicing": { "can_cancel": true, "can_modify": true } }
}

Commerce in build

  • UCP checkout Live

    A UCP 2026-04-08 merchant profile and checkout sessions per business, created from get_quote so prices cannot diverge. Paths are published when it ships.

  • ACP checkout Live

    ACP 2026-04-17 checkout_sessions endpoints for ChatGPT, mapped onto the same quotes and orders.

  • AP2 mandates Live

    Mandate signature, scope, per-transaction and cumulative limits, currency, and expiry checked before execution; revocation stops the next use; every use audited with the remaining limit. A mandate never overrides the business's policy.

  • Payment routing In build

    Mandates and single-use payment tokens routed to the business's own processor. Open for Agents never holds, pools, or settles funds and never stores primary payment credentials; the business is merchant of record. Today an order records only the payment method kind and an opaque reference.

  • Signed webhooks and event feed Live

    order.confirmed, order.price_changed, availability.changed, order.disrupted, order.completed, and order.cancelled, signed with HMAC and a timestamp (5-minute replay window), retried for at least 24 hours, each with a stable event_id.

  • Disruption handling Live

    The business's remedy (rebook, refund, or credit) as structured options; the chosen one runs through the normal preview and idempotent write.

Identity

Connect once: API keys or OAuth 2.0 with PKCE.

  • API keys Live

    a2h_live_ keys, shown once and stored as hashes, limited with the same scopes as OAuth, and rotated with a grace period (60 minutes by default).

  • OAuth 2.0 with PKCE Live

    Authorization code with PKCE (S256) for every client, dynamic client registration (RFC 7591), metadata at /.well-known/oauth-authorization-server and protected-resource metadata (RFC 9728). Access tokens last an hour; refresh tokens last 30 days and rotate on every use. No password, cookie, or second secret. A new client that asks to place orders can read at once and order after review.

  • One connection Live

    POST /mcp: find_business, then any tool with a tenant_id. A business is included only when its owner opts in, its domain is verified, its card check passes, and the go-live check of the calling platform passed (any check, for a caller with no platform label).

  • Go-live checks Live

    Harnesses for Muse, ChatGPT, Grok, Gemini CLI, Claude, OpenClaw, and Hermes call the published tools the way each client does: sign-in, the 401 challenge, OAuth shape, initialize with the client's own clientInfo name, the tool list, then a quote and a dry-run order (Muse, ChatGPT, Grok) or one read call (the MCP agents). Every write is a dry run, and each pass opens /mcp to that platform only.

Any MCP client (configs per agent on /connectors)
URL     https://openforagents.ai/mcp            one connection, every opted-in business
        https://openforagents.ai/t/<slug>/mcp   one business
Header  Authorization: Bearer a2h_live_...  an API key the business issued
or      OAuth 2.0, discovered from
        https://openforagents.ai/.well-known/oauth-authorization-server
Scopes
catalog.read      search, items, availability, quotes
orders.write      holds, bookings, orders
orders.read       read your orders
orders.service    cancellation quotes, cancel, modify
payments.mandate  payment mandates within limits
profile.link      link an account with a business

Policy and audit

Policy before execution. Audit on every call.

Every tool call, from MCP, A2A, the hosted agent, or the sandbox, runs identify, then policy, then execute, then audit. A call that cannot be audited does not run. Policy versions are immutable and apply to the next call.

  • autonomy_level Live

    answer_only, quote_only (the default), transact_with_approval, or transact_autonomous.

  • max_transaction_minor, currency

    Larger amounts get policy_blocked with reason max_transaction.

  • max_daily_minor

    Per principal per UTC day: max_daily.

  • approval_threshold_minor

    Above it a write answers requires_approval with details.confirmation (the dry-run payload). Repeat the call with approval: {payload_hash}; single use, 15 minutes.

  • blocked_actions, blocked_categories

    Tool names and item categories agents may not use.

  • Audit record Live

    request_id, ts, calling_platform, principal_id, client_id, tenant_id, tool, args_hash, result_code, policy_decision, policy_version, mandate_id, duration_ms, sandbox. Append-only, kept 90 days by default, exported as CSV (up to 50,000 rows). Raw arguments are never stored, only their hash.

Security model

Governed by default.

  • Tenant isolation

    Postgres row-level security on tenant data; API keys stored as hashes and scoped to one tenant; tenant context only from the URL or a verified tenant_id, never from free text.

  • Verified domains

    DNS TXT or a well-known file proves ownership, re-checked daily; a lapsed domain stops serving.

  • Safe egress

    Scans, imports, peer calls, and push deliveries go through one SSRF-guarded client that rejects private, loopback, and metadata addresses and re-checks every redirect.

  • Signed requests

    Requests to a business's store are signed with Web Bot Auth (Ed25519, RFC 9421), key at /.well-known/http-message-signatures-directory. Calls between Open for Agents agents carry a hosted-agent signature.

  • Injection screening and quarantine

    Live Tenant text is screened for instructions, requests for secrets, hidden characters, homoglyphs, encoded blobs, hidden markup, script URLs, and off-domain links. Flagged text is replaced and quarantined until the owner fixes it. Tool results reach models as untrusted data.

  • No fingerprinting

    Callers are identified by credentials and signatures only, never by IP address or user agent. Rate limits apply per key, per IP, and per tenant.

Protocols

Protocols and versions.

  • MCP 2026-07-28 and 2025-11-25 Live

    Stateless Streamable HTTP at /t/{slug}/mcp and /mcp; legacy initialize is served too.

  • A2A 1.0 Live

    JSON-RPC binding. A2A 0.3 requests are refused with a version error.

  • OAuth 2.0 Live

    RFC 6749 with PKCE (RFC 7636), RFC 8414 metadata, RFC 7591 registration, RFC 7009 revocation, RFC 9728 resource metadata.

  • Web Bot Auth

    draft-ietf-webbotauth-httpsig-protocol-00, Ed25519.

  • UCP 2026-04-08 Live

    Checkout on the same quotes.

  • ACP 2026-04-17 Live

    ChatGPT checkout on the same quotes.

  • AP2 Live

    Mandates with limits and revocation.

Pricing

Pricing, in short.

Early access pricing. Changes announced 30 days ahead. During early access we invoice by email.

  • Get found, Free

    Scan and kit, the business on MCP and A2A with the read-only tools (search_items, get_item, get_availability), directory listing, analytics. No card, no time limit.

  • Agent, $99/month

    Hosted business agent over A2A and MCP, calls to partner agents the owner approves, customer-agent memory with restock and retention offers, the Meta Catalog feed, transcripts kept 30 days. 1,000 conversations a month included.

  • Selling, 3% per sale

    Quotes, holds, orders, and bookings behind preview, approval, and owner policy; UCP and ACP checkout; AP2 mandates; signed webhooks; the audit log. Turning selling on or off is free.

  • Talk to us, from $1,500/month

    Several locations or brands, longer retention and export, a named contact, SLAs.

  • Metered: agent conversations only. Past the included 1,000 a month, each costs a few cents, a fixed multiple of our model cost, published in the console.
  • Not metered: read tool calls are included generously. Abuse-level volumes are rate limited, not billed.
  • The 3% outcome fee follows the confirmed order whatever door it came through (MCP, A2A, UCP, or ACP): 50 cent minimum, $25 cap per order, refunds and cancellations credited back, billed monthly from the confirmed orders list the business sees.
  • Payments go to the business's own processor, never through Open for Agents.
  • The Meta Catalog feed is a flat feature in the agent plan: those purchases complete on the merchant's own site, so we cannot attribute them.
  • Billing is not automated yet: during early access we invoice the platform fee and the sales fee by email.

Questions

FAQ

Who sends A2A traffic today?

Mostly enterprise agent platforms (Copilot Studio, Gemini Enterprise, ServiceNow, SAP Joule) calling agents their admins registered. Public A2A on the open web is still rare, and consumer assistants mostly connect over MCP, which is why every Open for Agents business speaks both. We do not promise inbound agent traffic.

What can agents do through Open for Agents?

Read offers and availability, get binding quotes and, when the owner's policy allows it, hold, order, book, change, and cancel. Transact tools need an authenticated caller. The hosted business agent itself uses read-only tools only.

Does money pass through Open for Agents?

No. Today an order records only the payment method kind and an opaque reference. Payment tokens and mandates are routed to the business's own processor (the processor connection is the one piece still in build), and Open for Agents never holds funds.

What does the scanner fetch?

Up to 25 public pages per scan, one request at a time, honoring robots.txt, with no cookies or logins. See the scanner page and the privacy notice.

Ship an agent-ready, agent-native business this week.

Start free with the scan and an MCP and A2A endpoint. Turn on bookings and orders once the policy is set.

Get started freeFor business owners