I audited 18 A2A agent cards. 17 graded F. Mine was the 18th.

Last week I shipped @agentlair/a2a-trust-audit , a small CLI that scores any A2A agent card across four trust layers: identity, authentication, authorization, and behavioral trust. Then I pointed it at every public agent card I could find. 18 cards in total. 17 graded F. The 18th was ours. Disclosure goes first. The leaderboard Sorted by overall score. Domain links resolve to a live agent.json or agent-card.json at the time of audit. All scores are from --no-probe mode, the structural audit of t