Uptime probe
These pages describe checker version VeronikAI/0.1+attestations.1 (signing.py). A2A card checks use suite veronikai-a2a-get-card version 1. MCP checks use suite veronikai-mcp-conformance version 2. If the code changes, the version string on a signed result should change too.
What is checked
We ask a simple question: when we send one polite GET to the public address the listing gave us, does a server answer?
Think of knocking on a shop door. If someone opens it — even to say "we're closed" or "please pay first" — the shop is there. If the street does not exist, or nobody opens after we wait, we record that instead.
We check this for:
- A2A agents, by asking for their public agent card (a JSON file that introduces them).
- MCP servers, by sending one GET to the published remote URL with Accept: text/event-stream.
Agents that are not A2A or MCP, or MCP listings with no https endpoint, are not probed.
How it works
Code: probe.py. Shared GET helper: common.http_get. User-Agent: VeronikAI/0.1 (read-only directory crawler).
- Before any knock, we read that host's robots.txt (see Robots handling). If we may not visit the URL, the result is skipped, not down.
- We wait our turn for that host and site, so we do not crowd anyone.
- A2A. We try, in order, the card URL from the listing, then /.well-known/agent-card.json, then the older /.well-known/agent.json (at most three addresses). We stop if we get a real answer, or if the host gives no answer at all (the other paths on the same host will not help).
- MCP. We send one GET to the endpoint. If the server says 401 or 403, we may also GET its public OAuth protected-resource metadata (RFC 9728) — still a GET.
- Timeouts are not retried. A dropped connection (EOF or reset), which is often our tunnel glitching, is tried once more. After two network failures in a row, that host is skipped for the rest of the run.
- A canary checks whether our internet is working. If we are the ones who are offline, we wait and we do not blame the agent.
- If a hostname does not exist, we confirm that with a public DNS-over-HTTPS GET (dns.google) because this machine's own DNS is not trustworthy.
- Each saved result can be signed (see Signing).
What the results mean
| Status | Everyday meaning | Typical causes |
|---|---|---|
| up | Something answered at the public address. | A2A: HTTP 200, 401, 403, or 402. MCP: 200, 202, 204, 3xx, 400, 401, 402, 403, 405, 406, 409, 415, 421. |
| down | We reached a firm "this is not here" or a broken name/certificate. | Most other HTTP codes (including 404 and 5xx). DNS name does not exist, connection refused, bad TLS certificate. |
| unknown | We could not fairly decide. | HTTP 429, timeouts and resets we could not confirm, our own outage, the probe hitting its time cap after it had already sent a request. |
| skipped | We chose not to knock. | robots.txt said no, or we could not read an honest robots file this run. This is not down. |
Special cases:
- HTTP 402 (payment required) is up. A paid server answered. We do not pay to look inside.
- A2A HTTP 401/403 is up (the host is there) but the card is not public, so conformance fails.
- If the probe only waited in line and never sent a GET before time ran out, we record nothing. The agent stays due for next time. Waiting is not a measurement.
Limits
- GET only. No POST, no login, no payment, no tool call, no initialize.
- 10 second timeout; about 20 seconds max per job; 512 KB card cap; 2 KB MCP stream peek.
- A daily run does not visit every agent. Oldest-not-seen agents go first so nobody waits more than about 7 days if the budget is large enough.
- "Up" does not mean "safe", "honest", or "does the job in its description". It only means a public address answered.
Checker version
VeronikAI/0.1+attestations.1. The uptime fields stored on a signed check are status, http_code, latency_ms, target, checked_at, and any error text.