An analysis of a third-party inter-agent discovery protocol, what it actually solves, and how to build the same on top of Agent2Agent without its limitations. Plus our working demo.
Index Network is a protocol that finds counterparties for people based on intent: a person tells their agent what they are looking for or can offer, the agents of two people communicate with each other and decide whether to introduce their owners. It works. Their field run with 240 residents yielded 541 intents, 9,688 found pairs, and 147 successful introductions.
And there you can also see where the scheme stumbles. 6 percent of what was found reached the person, meaning the bottleneck shifted from search to evaluation. Fact-checking is in their plans, not in the product. And to understand if intentions match, the network is obliged to read both, meaning someone still sees both sides.
Three conclusions from this analysis. First: Index solves half the problem, discovery, and does not solve the second, proof. Second: A2A for such a layer is not a competitor, but a transport; the specification itself leaves discovery to the discretion of developers. Third: both holes are closed from above, and this is no longer a discussion, but a assembled stand with a live run and tests.
Another team proved that agents can find each other better than humans, and ran into the problem that there's no way to confirm the finding or for anyone to evaluate it. We built exactly what they lack on top of A2A: an honest list of agent capabilities, matching without a third index holder, and a proof envelope for each conclusion.
The question was posed as follows: it seems they are already working on discovery between independent agents by intent, how effectively does their approach actually solve the problem, and can something similar be built on top of A2A or are there fundamental limitations?
To make the answer verifiable, and not just a retelling of their website, the work proceeded in four directions: their own documentation and protocol code, first-hand A2A specification, independent traces of the company outwards, and our own measurement of the live page with the REA tool and a proof envelope.
Separately, their field run figures are collected, along with their origin: they were not the only ones conducting the experiment, but together with Edge City and Cosmos Institute, and this changes the value of these figures.
Everything that is subsequently referred to as a number is taken from their publication or from our measurement with a date. If a number was produced by them together with partners, this is stated directly. If there is no independent reproduction, this is also stated.
They call themselves a private social discovery protocol by intent. Their key concepts are: intent, which is what a person is looking for or offering; community, which is the boundary within which intent is visible; negotiations, which is a limited dialogue between two agents; opportunity, which is a found and evaluated connection between two people.
What is important for our analysis is that they themselves list what their protocol is not: not a global people directory, not a public search index, not a feed, not a marketplace, and not a way to bypass consent boundaries. This is an honest boundary, and it also delineates where our work begins.
Their unit of work is not a profile, but a current intent. A profile is static, intent changes, and discovery proceeds based on it. This distinguishes them from catalogs and classifieds, and this is the most valuable aspect of their design.
Detection occurs only within communities to which the intention is assigned. An intention without a community finds no one; this is their rule, not our guess. Each candidate names a counter-intention, the person behind it, the community in which it was found, and their own assessment.
Negotiations are structured as a two-place log. There is no wire between agents; the protocol itself is the server for this log. Moves are in free text, but the grammar is strict: the initiator makes the first move, which is an offer or a refusal; acceptance can only happen immediately after someone else's offer; a counter-question cannot be accepted, it is answered with a new offer; there are never more than twelve moves, and at the limit, negotiations remain unresolved, not a refusal.
Disclosure happens in layers. First, the assertion, i.e., the stated desire. Then, the constraints significant for a match. The personality is disclosed last. The person and their agent communicate separately, and this conversation never enters the disclosure.
Separation of agent consent and human consent. Their formulation: human acceptance is a separate action. Silence, error, and timeout are considered neither consent nor refusal. This is precisely the boundary that most products blur.
Their privacy model is described as a set of boundaries: between a person and their agent, between an agent and the network, between two agents, and between a person and what reaches them. An intention has a visibility property: public is visible to everyone, network-wide only to community members, private remains with the agent and only influences its decisions.
There is also an invisibility mode, where neither party wants to reveal themselves first. In this case, the network only reads two assertions and reports the result: mutual or not. No agent participates in this, so neither party can probe the other.
And here is the key fact that needs to be stated aloud: in this mode, the network is obligated to read both intentions. They write this directly, honor to them for their directness. This means there is a participant who sees both sides, and the entire privacy of the construction rests on them.
In their discovery documentation, they have a section on verifiable data. An agent can narrow down the search by facts that are proven, not just stated: credentials, employer, license, proof of location without disclosing the address, confirmation that the person is real and unique, guarantees from other participants.
The wording about verification is as follows: each can be verified without showing. This is a strong property, and it is correct.
However, the same block has an honest note: a call that accepts multiple requests and these requirements is only planned. That is, the trust layer at the time of analysis is described as an intention, not as a working part. This is the main place where our design differs from theirs, and below it is shown exactly how.
Discovery without fact-checking matches statements, not people. Matching statements is cheap and fast, which is why their funnel yields thousands of findings. Fact-checking is expensive, which is why only a small fraction reaches a person. Their own figure of 6 percent is the price of cheap discovery.
From May 30 to June 27, 2026, in the village of Edge Esmeralda near Healdsburg, 240 residents used personal agents for a month. Each agent knew what their person was looking for: a co-author, co-founder, investor, employee, friend, partner. The agents corresponded continuously and decided which introductions were worth human time.
Their final table: 541 intentions, 9,688 discovered opportunities, 11,593 negotiation sessions, 20,169 messages between agents, 4,126 different pairs of people, 572 opportunities reached a person, 147 introductions were made. The median time from discovery to acceptance was 20 hours.
Inside the negotiations, the picture is also interesting. Eighty-two percent of sessions closed in two exchanges, fifty-three percent in one. The average number of turns dropped from 2.8 to 1.5 as agents learned to understand each other. Sixty-four percent of sessions were continuations of previous ones, meaning agents returned to the conversation when new context emerged.
Separately, their finding about asymmetry: 75 percent are seekers, 3 percent are explicitly offering, the rest are intentions submitted on behalf of a human. They conclude from this that the offer should be derived from context, and this is a correct observation exactly by half: one can derive a guess, not a fact.
The experiment was conducted by Edge City, Cosmos Institute, and Index Network, with support from Foresight Institute, and several other teams were technical partners. This means that the figures were produced by participants, not an external observer.
This in itself does not make them false. But they lack independent reproduction, and their two publications diverge in details: in the first, 237 residents and 465 intentions, in the second, 240 and 541. The number of opportunities found in one publication is 9,688, in the other, 9,642 negotiations took place. Small discrepancies, but they show that the numbers were collected on the fly and not reconciled with each other.
Another independent sign: the company's external footprint is almost zero. In discussions, their most notable material scored ten points, and in summaries, the account has extremely low weight. This is not a verdict on product quality, but it is an honest correction to the loudness of their claims.
All numbers in this section come from the experience organizers. There is no independent verification of any of them. We present them as stated, not as established, and our own stand did not measure their system.
First. Detection ceased to be a bottleneck, and this is not a reproach, but their own conclusion. Of 9,688 pairs found, 572 reached a human. Evaluation became the bottleneck: who decides what is worthy of attention. They left this question open.
Second. Fact-checking is in the plans. For now, it's absent; claims are merely juxtaposed. Their own report describes failures: agents fabricated biographical details, attributed unsaid things to people, fabricated summaries distorted the person's representation, and delegated voting occurred without human confirmation.
Third. Someone is obliged to see both intentions. In normal mode, it's a network; in invisibility mode, it's also a network. The index holder becomes a control point, and the statement about open, permissionless access poorly coexists with this.
Fourth. Game stability. Detection based on self-description is susceptible to manipulation: it's advantageous to claim more than there is. They acknowledge this in the form of plans for identity verification, but it is not resolved.
Fifth. Legal aspect. Automated decisions concerning an individual constitute a separate regulatory regime, and they themselves separated agent consent and human consent as distinct actions, which is correct, but means the product must live with this separation in every flow.
All five points share one nature: they are not in the code, but in the fact that detection is outsourced as a centralized service. As long as one party compares intentions, it sees everyone and decides for everyone. This is the source of both the privacy, evaluation, and gaming problems.
The project's history is useful in itself. In 2023, they launched with open source and a live test network, and back then the architecture was cryptographic: access via Lit Protocol, storage via Ceramic and IPFS, and intermediary agents staked tokens for recommendations, earning rewards for accepted introductions and losing their stake for unsuccessful ones.
This is no longer the case. In the current branch's protocol description, there is no mention of tokens, staking, or rewards; the storage is a conventional relational database. The economic layer has been entirely removed, although the marketing phrase about competing agents who earn money remains.
What this means for us: they themselves abandoned the most honest part of the idea, that someone pays for the quality of a recommendation. The question of who pays for intermediation and how quality is measured remains open for them and is an open field for us.
A token with a recommendation fee is a mechanism of accountability: a bad recommendation cost money. After abandoning it, there is no mechanism left in the design that punishes for junk findings. This is directly related to the 6 percent figure: finding cheaply, because no one is responsible for the findings.
To avoid judging solely by documentation, the live page was retrieved by the REA tool, which returns the result as a proof envelope: what was observed, by what, with what confidence, which sections are closed and why. The measurement was taken on October 19, 2026, from their public page.
What is visible. The number of tools declared by the page itself for visiting agents is zero. That is, they machine-wise promise nothing to external agents, although they do work with agents: integrations occur via MCP, command line, and HTTP. The proof envelope returned with a clear list of what it did not show: sections closed by observation policy, and truncated items with reasons. Zero discarded events.
The most useful thing here is not the fact itself, but the form. Their page talks about privacy in words. The tool we used to view it talks about privacy through a list of discarded items. The difference between these two approaches is what we are building next.
An observation envelope with an identifier, provider, observation type, confidence field with the value “observed,” and a list of restrictions. Plus, an accounting of completeness: which sections are closed by policy, how many items are truncated due to an external source, how many due to an unsuitable address. This exact form is taken as the model for our proof envelope.
Agent2Agent is an open standard for independent agents to communicate. The current specification version is 1.0.0. It provides transport and task semantics: messages, tasks, content parts, artifacts, streaming, delayed notifications, authentication schemes. Three bindings: JSON-RPC, gRPC, and HTTP with JSON.
An agent card is a machine-readable description: name, description, provider, service address, capabilities, skills with input and output modes, security schemes. A card at a standard address is the recommended method of publication. There is also an optional card signature: JWS according to RFC 7515 with canonicalization according to RFC 8785, the key can be published at an address. Hashing and conditional requests are described separately.
The specification explicitly names discovery as one of the goals and at the same time does not impose a mechanism. Publication at a standard address, curated registries, and direct configuration are listed as equally valid strategies.
The specification states that a single API for curated registries is not prescribed, and the standardization of registry operations is only being explored. There is also no concept of intent, no matching by it, no grammar of negotiations, no consent for disclosure, and no agent-to-human binding.
This is not a defect. A2A consciously deals with transport, not the market. Gaps of this kind are filled by a separate layer, and what Index does on top of its network is exactly such a layer, only built outside A2A and with an index holder inside.
There is one fundamental limitation here, and it is not protocol-related: to match two intentions, someone must see them. If matching is built in one place, a holder appears. If not in one place, the comparison method must be changed. The second path is ours.
The agent card signature using JWS with canonicalization is the only part of trust already standardized in A2A. It is checked before the first request and catches spoofing: if someone changed the content of the card en route or substituted their own, the check fails.
But its probative force is limited, and this must be kept in mind in any discussion of trust. The signature confirms that the card came from the key holder and has not been altered. It does not say that a living unique person is behind the agent, it does not say that the declared skills actually exist, and it does not resolve revocation: a key change invalidates the card, but the identity is not revoked.
Therefore, the card signature is an input, not an answer. Next, a layer is needed that verifies the assertions themselves, and that is already our job.
The structure is assembled so that each layer is responsible for one thing and does not interfere with others. First: the agent publishes a card and a signature, this is a standard A2A part. Second: an honest list of capabilities with effects and limitations is attached to the card. Third: intention matching occurs on each side separately, without a third holder. Fourth: each output is given as a proof envelope. Fifth: human consent as a separate action, and the parties retain a trace.
The order is not accidental. The first layer removes substitution, the second removes ambiguity, the third removes the holder, the fourth removes blind trust in the output, the fifth removes consent substitution. In total, this covers all five points found in Index Network.
Everything the agent says must either be signed, or proven, or explicitly marked as a statement. There is nothing else in the design.
We take the A2A form without changes: name, description, version, vendor, capabilities, skills with input and output modes, service address, protocol binding, security schemes, and ES256 signature. Everything that is not in A2A is put into a separate extension so that the card remains compatible and understood by other agents.
Our stand does this and shows it in a live run: the card is retrieved at a standard address, the signature is checked, and when trying to change one line, the check honestly fails with the reason “signature does not match card content”.
This is a response to an understatement. Index has a registry, but no registry of capabilities with consequences. REA, the tool we used to measure someone else's page, has exactly what is missing: for each operation, it specifies what it does to the outside world.
Our format: an operation declares seven effects, among them artifact modification, process launch, interface display, network access, disk write, permission change, and root requirement. An undeclared effect is treated as possible, not as absent. An unavailable operation remains in the list with a reason, rather than disappearing silently.
In the stand, this is visible on a live failure: the operation “act under another's identity” is present in the list and marked as unavailable due to policy, with the reason formulated as: the agent acts only for its owner.
Such a list cannot be written once and forgotten: it must match the code. The test in the stand checks that each operation either declares all seven effects or is marked as partially declared, and that an unavailable operation always carries a reason. This makes the list an obligation, not a showcase.
Here, the main weakness of the other design is resolved. The intention is not sent anywhere in its entirety. A party converts its attributes into fingerprints: a hash of the attribute under a one-time key of the pair. Only fingerprints go out.
Each party calculates the match itself, on its own side. Each learns exactly which of its own attributes have matched. No participant sees both sets in their entirety, and there is no index holder in the scheme at all.
An honest limitation, and it is written directly into the envelope: the opposing party can check guesses about your attributes, because the comparison is done by hashes without heavy cryptography. This is a property of the method, not an oversight, and we keep attributes few and coarse so that the boundaries of guesses are narrow.
Each output of the stand is given as an envelope. In the envelope: identifier, recalculated from the body, observation provider with version, operation type, parameters, normalized result, confidence, assertion owner, restrictions, and completeness accounting.
Completeness accounting is the most useful part. It lists which sections are covered by policy and why, how many positions are cut off due to a foreign source, how many are discarded, and how many events are lost. Absence of data is not considered well-being: a closed section is named.
In our matcher, this applies to ourselves: unmatched features are not returned by design, so the envelope contains a policy with the reason “not returned by design”, and the opposing side's features are marked as coming only from fingerprints. The test caught this when the envelope initially did not declare its own filters.
Agent consent and human consent are two different actions, and this is reflected in the stand's state. Until the agents agree, the question is not presented to the human. When they agree, the state is "pending," and each human decides separately. Familiarization opens only after everyone has decided.
Rules that have been tested: a repeated decision is rejected, a late "yes" does not cancel a previous refusal, one cannot play another's place in negotiations, an automatic decision is not presented as a human one.
In addition, a trace remains: each side has a log of moves and envelopes of evidence for each transition. This is what is missing in a design where one holder makes decisions for everyone.
Separation of consents and the rule that silence, error, and timeout are not considered consent. We adopted this consciously, because here their design is fairer than most.
The stand consists of two agents, raised on two ports, with signed cards, an honest list of capabilities, local matching by fingerprints, and limited negotiations with separate human consent. It is launched with a single command, tests are run separately.
| Step | What is being done | Run result |
|---|---|---|
| 1 | agent card is retrieved at the standard address, signature is verified | signature is valid, extension is in place |
| 2 | one line of the card is replaced | signature rejected with reason |
| 3 | list of capabilities is read | two operations, one unavailable with a reason |
| 4 | both sides check for fingerprint matches | two features matched, unmatched ones remained within the sides |
| 5 | grammar negotiations, on the way to the side | outcome "agreed", logs of both sides match |
| 6 | attempts to violate rules | other party's place rejected, acceptance after counter-question rejected |
| 7 | human decision as a separate action | pending, then accepted, re-decision rejected |
21 checks in the set, all pass. Covered: card substitution, foreign key, undeclared effect, unavailable operation without reason, envelope ID reproducibility, leakage of opposing party's features, fingerprint incompatibility with different key pairs, move grammar, move limit, consent separation, re-decision and late consent after refusal.
First. A fractional number, a fraction of a match, got into the envelope. The envelope identifier stopped reproducing, and the stand crashed with the reason: our canonicalization rules prohibit fractional numbers, because their canonical representation differs from the usual one. Fractions are now expressed in whole basis points, five thousand is half.
Second. The initiator of negotiations was determined by the agent's name, not the order of the parties. Because of this, the parties' logs diverged, and the second party responded to an empty log with a message that the first move was up to the initiator. The initiator now sets the order of the parties, and the log lives in one place, with the protocol, as intended in the design.
Both cases are important not as a list of errors, but as proof that the check in the stand is not decorative: it breaks where it lies. This is precisely the property that is missing from other people's figures, where 237 participants turn into 240 without explanation.
Both defects were found not by reading the code, but by running with checks. The first caught its own prohibition on fractions, the second caught a discrepancy in the state of the two sides. Neither was visible in the stand documentation, because the documentation described the intent, not the result.
| Feature | Index Network | Our stand on top of A2A |
|---|---|---|
| Detection by intent | yes, field-tested | yes, run-tested |
| Who sees both intentions | network, index holder | nobody: comparison on each side |
| Fact-checking | in plans | proof envelope for each output |
| What is announced about agent capabilities | skills | skills plus effects and limitations |
| Card signature | not claimed | ES256, checked in run |
| Human consent | as a separate action | as a separate action, plus checks for repetition |
| Responsibility for garbage finding | no mechanism after refusal of bids | assessment is done by a person, the finding carries boundaries |
| Field scale | 240 people, one month | two agents, stand, no field |
The honest difference in scale: they have a month of live experience and people, we have a working design and checks. Their numbers are needed as a benchmark, ours as something that can be shown in operation.
Honestly, four things. First: confirmation that there is a living, unique person behind the agent. We have not solved this, and without an external anchor of trust, it cannot be solved. Second: verification of declared skills. The envelope tells where the conclusion was taken from and where its boundaries are, but it does not turn someone else's assertion into a fact. Third: the cost of comparison by fingerprints is higher than that of a regular search, and for large volumes, this needs to be measured separately. Fourth: liquidity. The protocol does not create people who want to meet; it only serves those who already exist.
There are also things we haven't checked at all: their revenue and prices, there is no public data there; and funding, where sources contradict each other. One tracker writes about the absence of funding, another shows an early round in August 2025 and support from two funds. We record this as a contradiction of sources, and not as a fact one way or another.
| Open item | Why open | What is needed for this |
|---|---|---|
| uniqueness of a person behind an agent | is not solved by the protocol, an external anchor of trust is needed | identity verification as a separate verifiable document |
| existence of declared skills | the envelope shows the boundaries of the conclusion, but does not turn a statement into a fact | guarantees and confirmations from third parties |
| cost of matching by fingerprints | not visible on two agents, volumes are needed | measurement on stream with increasing number of features |
| liquidity, i.e., live participants | the scheme serves demand, but does not create it | community and occasion, outside the protocol |
| Index funding | sources contradict each other | their own confirmation, not trackers |
Someone is obliged either to prove human uniqueness or to admit that there is no proof. Matching without a holder reduces leakage but does not eliminate the possibility of checking guesses. And no scheme creates demand.
All Index numbers are taken from their publications and their documentation; there is no independent reproduction. The experiment was conducted by them together with partners, meaning the figures are co-produced. Their two publications differ in details, and these discrepancies are named in the text, not smoothed over.
Our measurement of a third-party page was done once, on October nineteenth, and describes the state on that date. The stand is a prototype with two agents; it has not been tested under load and has neither key revocation nor protection against manipulation.
Everything we claim about A2A is taken from the specification version 1.0.0 and its sections on discovery and signing. Everything we claim about our design is based on runs and tests, not on intent.
There are two reasonable steps, and they are not mutually exclusive. First: to compile a comparison with their funnel using their own numbers, to show the cost of a finding without proof. Second: to attach a real anchor of trust to the features, to close off the opposing side's guesses.
Both rely on an already assembled stand, not on new development from scratch. A third possible step, more distant: to agree on a form of A2A extension so that our list of capabilities and our proof envelope can be read by other agents without our documentation.
| Source | What was taken from it |
|---|---|
| docs.index.networkdetection, privacy, negotiations, capability, intent | protocol device, grammar of moves, disclosure layers, intent visibility, formulation about the network as a trust holder, note on plans for verifiable data |
| indexnetwork/protocol and indexnetwork/index | object model, invariants, absence of tokens and rates in the current branch, pipeline from intent to capability |
| their blog: field notes and “can agents be trusted” | 241 intents, 9,688 findings, 11,593 sessions, 20,169 messages, 4,126 pairs, 572 to human, 147 acquaintances, time medians, verticals, asymmetry of seekers and offerers |
| Cosmos Institute on the same experience | number of agents, volume of tokens, agent failures, conclusion about individual and collective coordination |
| A2A 1.0.0 specification and section on discovery | data model and operations, agent card, JWS signature with canonicalization, standard address, absence of prescribed registry API |
| preprints on agent discovery and an overview of interaction protocols | problem statement for capability discovery, comparison of protocols, A2A's place among them |
| REA tool and our observation envelope from October 19, 2026 | proof envelope format, completeness accounting, measurement of a foreign page: zero announced tools for agents |
| our stand proto-a2a-discovery | a seven-step run, 21 checks, five envelopes, two defects found |
| funding trackers and account summaries | contradictory funding information and the company's small external footprint, cited as a contradiction |
Numbers with an origin tag are their side's statements. Envelope and run numbers are our measurement. Everything marked as a plan or intention remains a plan until separately confirmed.
ARLI membership: the notes from the workshop
One site of yours, measured, with the price for the work in the same document
ARLI, Inc., a Delaware corporation. Questions: hq@arliwork.com.