AGENTFORCE-AF-10: A2A Agent Card Without Security Scheme
🟡 Medium · MuleSoft Agent Fabric
Detects A2A agent cards (Agent Network registry agents, broker interfaces, Mule A2A server cards) with no securitySchemes or security requirements. Medium; high when the agent can write; low when the agent is authenticated elsewhere (connection auth, inbound policy, task authorizer) and only the card is missing the scheme.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-AF-10 |
| Severity | Medium |
| Category | MuleSoft Agent Fabric |
Remediation
Declare how to authenticate in the card: add securitySchemes (oauth2, openIdConnect, apiKey, http bearer or mutualTLS) and a matching security requirement, and enforce the same scheme on the agent (connection authentication, broker inbound policy, A2A task authorizer or API Manager policy).