SW-A2A-016: Agent card fetched through a redirect to another host
Last updated 7 November 2026
| Fact | Value |
|---|---|
| Severity | Medium |
| Checks | A2A agent card |
| Malicious indicator | No |
| OWASP Agentic Top 10 | ASI07 |
| OWASP MCP Top 10 | None mapped |
| NIST SP 800-53 | SC-8 (provisional mapping to SP 800-53 base controls) |
| First shipped in | Scanner 1.3.0 |
What it detects
This rule applies only to a remote agent: an address listed under a2a.agents in the settings file, fetched when the scanner runs with --probe. The fetch is a single GET with no credentials. The scanner records the address it asked for and the address it finally got the card from, and when the redirect leads to another origin it reports the card once. The evidence names both hosts.
The rule never looks at a card in the repository, so a scan without probing, and a run on a pull request from a fork where nothing is fetched, cannot report it. Findings on a remote agent's card do not fail a pull or merge request, because that card belongs to someone else; they are reported, uploaded and counted on every other run.
Why it matters
A card's address names the party that is supposed to speak for the agent. If that address answers by sending the client to another host, the card the client reads is controlled by whoever runs the other host: a content delivery service, a hosting provider, or someone who has taken over an old address. The client then trusts the endpoints, the security schemes and the signature keys in that card as if the first host had published them. The scanner maps this rule to OWASP ASI07, Insecure Inter-Agent Communication, and to NIST SP 800-53 control SC-8, Transmission Confidentiality and Integrity.
Example
There is no repository file to show for this rule, because it depends on the answer of a live server. The settings below list a remote agent by address. When the scanner runs with --probe and that address redirects to a different host, the finding appears:
This example is an illustration. It cannot be checked offline with spellwarden scan, for the reason given below it.
The rule judges how a card was fetched, so it runs only for a remote agent listed under a2a.agents when the scanner is started with --probe and can reach a public host. A scan of files has nothing to fetch, and the example host here does not exist.
.spellwarden/config.yml
version: 1
a2a:
agents:
- https://agent.example.invalid/The evidence of the finding reads like redirected agent.example.invalid to cards.example.invalid, and it has no line number, because a remote card has no file.
How to fix
Fix it where the redirect starts. If the address is yours, remove the redirect, or change the entry in a2a.agents to the final address so the repository records where the card really lives. If the other host is a service you run, publish and sign the card on your own host and list its key in a2a.keys, so a client can tell that the card is yours.
If it is a false positive
A redirect you set up on purpose, for example from your own domain to a hosting provider that serves the card, is real but expected. Accept the finding with a note that names the provider, and list the final address when you can. A finding on someone else's card is not yours to fix; decide whether you still want to call that agent.
If the finding is not a problem in your case, accept it with a note: in the dashboard a manager or owner can accept a finding and the note is kept with it; with the scanner on its own, add it to the baseline file with a reason and an expiry date.