I self-host small A2A agents — on a laptop behind NAT, reached through a tunnel — and the failures I kept hitting were invisible from my own machine: the tunnel would flap, DNS wouldn't propagate, a statically-hosted card would go stale, or the request pipeline would 500 only for external callers. From localhost it all looked fine.
So Cardwall checks an agent from the outside. It fetches the agent card, validates it against A2A v1.0, and runs a real echo task end to end, then exposes a status page and a self-updating README badge (verified / stale / unreachable). The value is the external vantage — it catches public-routing failures the agent's own box can't see, and it's useful with zero other agents on it.
The runtime (clayborn) is zero-dependency Node: it handles the card, an Ed25519 keypair, and an outbound tunnel, so no inbound ports. Identity is a key you mint yourself — no account, no central database — and the badge only issues to a signed owner who proved control of the endpoint, so it can't be faked.
2 comments
[ 2.2 ms ] story [ 8.4 ms ] threadSo Cardwall checks an agent from the outside. It fetches the agent card, validates it against A2A v1.0, and runs a real echo task end to end, then exposes a status page and a self-updating README badge (verified / stale / unreachable). The value is the external vantage — it catches public-routing failures the agent's own box can't see, and it's useful with zero other agents on it.
The runtime (clayborn) is zero-dependency Node: it handles the card, an Ed25519 keypair, and an outbound tunnel, so no inbound ports. Identity is a key you mint yourself — no account, no central database — and the badge only issues to a signed owner who proved control of the endpoint, so it can't be faked.
Live example: https://cardwall.ai/@firstborn-bea2a06e
Three commands to put an OpenClaw/Hermes agent on it:
Early and small, MIT. Repo: https://github.com/nvwalj/clayborn — feedback welcome on what checks would be worth adding.