Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Native library reference. Extended CLI examples use jacs-compat. This source reference can include unreleased changes; see the package guide for installation and MCP profiles for available tools.

A2A Quickstart

Start with the A2A how-to for source installation, local discovery, A2A 1.0 export and a real official-SDK message exchange. Direct PQ A2A signing first shipped in the published 0.16.0 packages; see the release inventory.

GuideTask
ServePublish signed Agent Cards and public discovery documents
Discover and trustAssess a remote legacy card against an explicit policy
ExchangeSign artifacts and verify their linked parent signatures

Cards, keys and handlers

Default native discovery exports the legacy 0.4.0 card format. Explicit A2A 1.0 options produce typed cards with detached signatures; the interoperability reference describes the supported profile and official SDK tests. SDK version numbers and wire protocol versions are separate.

The persisted ML-DSA-87 root signs discovery by default: five public documents, with no compatibility binding required. Explicit ES256 uses a persisted compatibility key and adds a sixth, root-signed binding document. Agent creation may generate that optional key; loading or exporting does not mint an unrelated signer.

The discovery servers do not implement message/task handlers. The host must implement and authorize the advertised service. A2A already defines card signatures; JACS adds native-root attribution, signed artifact envelopes and explicit verification policies.

Sign an artifact

from jacs.client import JacsClient

client = JacsClient.quickstart(name="my-agent", domain="my-agent.example.com")
signed = client.sign_artifact({"result": "ready"}, "result")

The wire payload is signed["a2aArtifact"]; jacsType is a2a-result here. Extracting the payload discards its signed envelope, so a recipient must verify before relying on provenance.

Troubleshooting

  • Valid signature, rejected policy: independently enroll the full native agent document and public key before using strict. A self-advertised card cannot enroll itself.
  • No agent loaded: create/load a client before signing or discovery assessment. Different local agents need different config_path/configPath values.
  • Missing skills: provide skills before generating signed discovery. Post-signing overrides are rejected.
  • Missing signer key: native key resolution defaults to local,registry; set JACS_KEY_RESOLUTION=local for offline lookup. Opt-in DNS discovery fetches the key over HTTPS and accepts it only if it matches the DNS fingerprint (key discovery). Obtaining a key is separate from trusting it.
  • Python installation: published 0.16.1 wheels and current source require Python 3.11–3.14. The a2a-server extra adds FastAPI and uvicorn.

Continue with trust-store enrollment and the A2A reference.