A2A endpoint

Every published business speaks the Agent2Agent protocol (A2A) v1.0, so other agents can discover and converse with it directly:

coreloop.so/api/a2a/{slug}                          # the endpoint (ProtoJSON wire format)
coreloop.so/{slug}/.well-known/agent-card.json       # the agent card

Support surface

• SendMessage and SendStreamingMessage (SSE) for request/response and streaming.
• supportedInterfaces advertised on the agent card.
• Standard TASK_STATE_* task states; tasks are stateless, each exchange stands alone.
• Field-presence Parts semantics per the v1.0 spec.
• Version negotiation, so clients on adjacent minor versions interoperate cleanly.

Behind the protocol, answers come from the same canonical profile as every other surface, with the same gates: published-only, owner switch, rate limiting, interaction logging (see the overview).

The agent card and languages

The card is a single, statically cacheable document, not generated per locale. It advertises the languages the business speaks as metadata; the conversation itself then happens in whichever supported language the calling agent chooses through the A2A messages.

There is also a network card. Alongside the per-business cards, the root path coreloop.so/.well-known/agent-card.json serves CoreLoop's own card, describing the network endpoint at coreloop.so/api/a2a/coreloop-directory. That endpoint answers for the whole network rather than one business, through three skills: Find a business (search the directory by category, city, keyword, rating or capability), Compare one business's services (rank what a single business offers within a service type), and Ask a business (its profile, services, opening hours, its own endpoint addresses, or an inquiry to its owner). The card is generated from those skills, so it can never describe something the endpoint does not do, and coreloop.so/api/a2a/coreloop-directory serves the identical document. It names no business and enumerates none: what it carries is CoreLoop's own identity and network address, the three skills with an example of each, a link to these docs, and the CoreLoop icon.

When a business runs a custom domain, its card is also served at that domain’s root; the canonical coreloop.so address keeps working alongside it.

Free-text questions reach ask

A2A messages are prose, so a message that matches none of the business’s other skills is routed to ask — the retrieval tool that answers with quoted passages from the business’s own material: its website text, anything the owner wrote or listed themselves, and its public documents, each with its source. Nothing is generated: the message becomes a search query, whitespace-collapsed and, if it is longer than the tool’s 200-character bound, cut at the last whole word where there is one — and at the bound itself where there is not — so a long message is still answered rather than refused. A message shorter than three characters is not treated as a question at all.

Routing happens only when the business is actually serving ask — a published profile and a corpus with at least one passage the plan still entitles. A website on file is needed only for the text read automatically from the site, not for the owner’s own text, its public documents or its listed links (the eligibility rules in full). When it is not, the message falls through to the ordinary “no matching skill” answer, which is the same reply an agent gets on a business that never had a corpus.

What a calling agent can expect

Business information, in the caller’s chosen supported language, current as of the owner’s latest approved profile. No PII, no write access, and inquiries only through the same rate-limited path as MCP’s send_inquiry. If the business is unpublished or has switched the channel off, the endpoint declines, immediately and uniformly.