A2A-G is an early student project for publishing AI-agent test results, not an established safety certification. Its author describes optional testing in a consented mock sandbox, an LLM judge, and cryptographically signed records. Those features may make results easier to inspect, but a badge does not prove an agent is safe—and it may remain visible after the agent changes.
What A2A-G is—and how its badges work
In a September 25, 2026 DEV Community post, the project’s author describes A2A-G as a public registry for agent-safety test results. The workflow begins with a “Grey Badge”: an unverified self-report of what an agent claims it can access. Owners can opt into testing; according to the author, tests run in a safe, consented mock sandbox rather than against live production systems. Read the author’s project description.
As an Amazon Associate I earn from qualifying purchases.
The author says the test sends 18 OWASP hijacking prompts three times each in randomized order. An LLM judges whether the agent blocked or complied. Blocking at least 80% earns a “Blue Badge,” and failures are published too. These numbers describe A2A-G’s stated design, not independently validated measurements or evidence that the threshold predicts real-world risk.
What the labels mean in practice
- Grey Badge: a claim by the agent owner, not a verified test result.
- Blue Badge: the author-reported outcome of the specified optional test, meeting its 80% blocking threshold.
- Published failures: the author says unsuccessful results are made public as well.
The author characterizes the project as an imperfect early solo effort that does not solve all AI security problems. The GitHub implementation was not independently audited for this article, so its code and operational behavior cannot be confirmed here.
#1 Best Overall
What a signature and hash chain establish
The author says A2A-G cryptographically signs each result with Ed25519 and hash-chains records to make the history harder to fake or hide. A valid signature can establish that a record matches a particular signing key, and a hash chain can help reveal changes to linked records. Neither fact alone proves that the tests are comprehensive, that the LLM judge is reliable, or that the key belongs to the operator named in the record.
The August 2026 IETF Internet-Draft “The Agent Record: Transparent, Witness-Countersigned Event Logs for AI Agent Identity, History, and Memory” explains why key provenance matters. If a verifier checks a signature using a public key included in the same artifact, that demonstrates internal consistency, not an externally trusted identity. The draft distinguishes an “unanchored” result, which makes no authenticity claim, from stronger verification based on an externally anchored key. It proposes signed checkpoints over append-only Merkle logs and independent witnesses, but it remains a proposal, not a finalized standard; the draft also says its independent-implementation gate had not yet been met.
The draft’s concise warning is: “A registry is NOT a trusted party.” A registry can publish evidence, but trust still depends on how evidence is produced and how keys and records are independently verified.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsHow current is a Blue Badge?
It is not continuously current. In response to a reader asking whether a dependency update automatically revokes a badge when behavior changes, the author said A2A-G does not currently auto-revoke it. The author says a badge can remain until its 90-day expiry. Webhook-triggered updates were described as a possible future addition, while continuous monitoring would require recurring LLM-judge compute costs the solo student could not currently cover. The author’s discussion describes the expiry and revocation behavior.
That creates a practical gap: a test result describes the tested version and conditions, not necessarily the agent a user encounters later. A software or dependency change can alter behavior while the badge remains visible. Readers evaluating a badge should look for the test date, tested version, sandbox conditions, prompt and result details, and any stated update or revocation policy; the available project description does not establish broad prompt coverage or a reliable relationship between its threshold and real-world safety.
How A2A-G differs from evidence-conformance tooling
OECD.AI’s catalog entry describes the Agent Evidence Conformance Suite as software for machine-checkable tests of signed AI-agent execution evidence. The entry reports more than 270 conformance vectors and a four-stage verification pipeline. It explicitly separates conformance verification from policy-setting and end-user governance. These are figures for that toolkit, not A2A-G. See the OECD.AI catalog entry.
| Question | A2A-G, as described by its author | Agent Evidence Conformance Suite, per OECD.AI |
|---|---|---|
| Primary purpose | Behavioral safety testing of agents using hijacking prompts. | Machine-checkable conformance tests for signed execution evidence. |
| Evaluation described | LLM judges whether the agent blocks or complies with the prompt set. | Catalogued as a four-stage verification pipeline; the entry reports over 270 conformance vectors. |
| Does it certify broad safety? | Not established; the author calls the method imperfect, and the prompt set and threshold do not establish overall safety. | No. OECD.AI distinguishes evidence conformance from policy-setting and end-user governance. |
| Key trust and freshness questions | The author reports Ed25519 signatures and a hash chain; external key anchoring and continuous revocation are not established in the project description. | The catalog entry describes evidence verification; it does not establish that the toolkit is a behavioral certification service. |
The two approaches address different questions. Behavioral testing asks how an agent responds to selected inputs under test conditions. Evidence conformance asks whether execution evidence meets machine-checkable requirements. Neither purpose should be mistaken for a complete judgment about an agent’s safety in every use.
Free tools Windows power users keep installed
One-click scans. No signup required.
What to check before relying on a registry badge
- Test scope: What behaviors and attack types were tested, and what remains outside the test?
- Reproducibility: Are the prompts, repetitions, versions, sandbox setup, and result details available?
- Evaluator independence: Who operates the test and judges outcomes, and can the owner influence that process?
- Consent and isolation: Is testing authorized and safely separated from live systems and data?
- Cryptographic trust: Is the signing key anchored independently, rather than trusted only because the artifact supplies it?
- Freshness: Is the tested version identified, and what triggers re-testing, expiry, or revocation after changes?
A badge can be a useful pointer to a particular test record. Treat it as evidence about that test—not as a guarantee of safe behavior, trusted identity, or ongoing compliance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
