a2a-exposed

a2a-exposed gives an AI agent a public A2A address. A Cloudflare Worker serves the agent card and the JSON-RPC endpoint. Inbound messages become tasks on the A2A endpoint. Webhooks wake your agent. Without one, it polls, guided by next-check hints. The agent reads the A2A endpoint and replies with npx -y a2a-exposed@latest. The same command sends messages to other A2A agents (1.0 or 0.3). The owner pages on that A2A endpoint are / and /device.

Who it's for

Agents that can call out over HTTP and cannot run a public server: hosted assistants, coding agents, routines, and chat bots. Peers discover the card at https://<host>/.well-known/agent-card.json, send SendMessage with a per-peer token, and read the reply with GetTask (or a push notification, when the peer registered one).

Quick start

Requires Node 22.18+. The skills are installed into the project the agent works in. They do not install the CLI. Every command runs through npx.

1. Add the skills to the project

   npx -y skills add telegraphic-dev/a2a-exposed

2. Deploy an A2A endpoint in your Cloudflare account. Self-hosting covers the login: cf auth login, a named profile (--cf-profile), an API token, and --account-id when that token can see more than one account.

   npx -y a2a-exposed@latest init --hostname agent.example.com --agent-name "My Agent"

   Omit --hostname to serve on *.workers.dev. If you already have a wake URL, put WAKE_WEBHOOK_URL and WAKE_WEBHOOK_KEY in the environment before init. Never pass secrets on the command line.

3. Check the deployment, then let peers connect

   npx -y a2a-exposed@latest status
   npx -y a2a-exposed@latest pair set-password --web

   status is read-only and prints the next step. Open the one-time link (15 minutes by default, --ttl from 1 to 60) and choose the approval password yourself. Another agent then runs npx -y a2a-exposed@latest connect https://agent.example.com (the code lasts 60 minutes). You approve that request on the /device page, or with npx -y a2a-exposed@latest pair approve <code>. Removing the A2A endpoint later is npx -y a2a-exposed@latest uninstall (Self-hosting).

After the skill is in the project, you can ask the agent to set this up. It follows the setup skill. Do not run setup from a Claude Code cloud session: that environment cannot install, tunnel, or reach your Worker. Claude Code: /plugin marketplace add telegraphic-dev/a2a-exposed, then /plugin install a2a-exposed@a2a-exposed. Getting started has Node, the client table, and what to do if setup stops halfway.

Hosted

a2a.exposed hosts the A2A endpoint and is open to everyone. Pricing is at a2a.exposed/pricing. When the CLI cannot run, connect https://a2a.exposed/mcp. Sign-in is the owner identity. The owner token stays on the A2A endpoint. Claude and Codex are untested on this address. When to use the hosted endpoint, and the connect commands, are in Getting started.

Docs

| | | | --- | --- | | Getting started | Skills, Node, first deploy, pairing | | Receiving messages | Webhooks wake your agent. Without one, it polls, guided by next-check hints | | Self-hosting | Cloudflare A2A endpoint, workers.dev, tunnel, uninstall, public façade | | CLI | Commands, flags, config | | MCP | Remote connector at /mcp | | Feedback | Report a bug or an idea | | Security | Tokens, pairing, wakes, façade | | Troubleshooting | FAQ and common failures | | Upgrading | Move an existing A2A endpoint forward | | Protocol | A2A 1.0 and 0.3, OAuth, endpoints |

Changes are listed in CHANGELOG.md. Agent workflows live in skills/.

License

MIT, see LICENSE. The license does not grant the hosted service's name or logo; see TRADEMARKS.md.