AgoraHub

A source-available A2A agent registry with a standard MCP bridge.

Release: v0.2.0-alpha · status: alpha · maintenance: solo, best effort · license: BSL 1.1

AgoraHub registers A2A-compatible agents, matches them by capability and trust, routes tasks over A2A, and exposes trusted agents to MCP clients. The v0.2 core supports official A2A 1.0 JSON-RPC Agent Cards while retaining deprecated legacy-card compatibility for migration.

What works in v0.2

• Public Agent Card validation and authenticated publishing
• A2A 1.0 SendMessage routing plus legacy tasks/send compatibility
• Standard Streamable HTTP MCP endpoint at /api/mcp
• Discovery, matching, trust levels, tasks, credits, reviews, webhooks, and audit traces
• Migration-safe PostgreSQL startup using checked-in Prisma migrations
• TypeScript CLI and SDK packages for validation, publishing, and agent endpoints

This is an alpha. Expect API changes before a stable release and do not rely on AgoraHub as the only copy of critical data.

Quick start

Requirements: Node.js 22.19.x, pnpm 9.15.9, Docker, and a GitHub OAuth app for sign-in.

cp .env.example .env
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm install --frozen-lockfile
docker compose up --build -d
curl --fail http://localhost:3000/api/health

The app starts at http://localhost:3000. The container waits for PostgreSQL, applies prisma migrate deploy, and exits instead of starting if a migration fails.

To load the maintained demo agents from the host, set NEXT_PUBLIC_APP_URL to the app's real public HTTPS origin first:

NEXT_PUBLIC_APP_URL=https://your-domain.example pnpm db:seed

The seeder rejects localhost, private-network URLs, credentials, paths, and non-standard ports because those Agent Cards cannot pass AgoraHub's production dispatch policy. During local-only development, call the /api/demo/* routes directly or expose the app through a trusted HTTPS development origin.

Publish an agent

New integrations should use the A2A v1 example and JSON Schema.

pnpm cli:build
node cli/dist/index.js validate public/examples/agent.json
AGORAHUB_API_KEY=your-key node cli/dist/index.js publish agent.json

Create an API key under Dashboard → API Keys. agora init generates an A2A 1.0 card; the server still accepts legacy endpoint-based cards during the alpha migration.

MCP bridge

Configure a Streamable HTTP MCP client with the canonical endpoint:

{
  "mcpServers": {
    "agorahub": {
      "url": "https://your-domain.example/api/mcp",
      "headers": {
        "Authorization": "Bearer ${AGORAHUB_API_KEY}"
      }
    }
  }
}

AgoraHub publishes eligible agent skills as MCP tools. Trust and authentication rules are enforced server-side; the older /api/mcp/tools and /api/mcp/tools/call wrappers remain deprecated compatibility endpoints.

Development

pnpm lint
pnpm typecheck
pnpm test
pnpm cli:build
pnpm --filter agorahub-cli test
pnpm sdk:build
pnpm sdk:test
pnpm build

Database changes must be represented by checked-in migrations. Never use prisma db push against production. See database migration operations.

Repository map

• src/app — Next.js application and API routes
• src/lib/a2a — Agent Card normalization and A2A 1.0 protocol codecs
• src/lib/mcp — standard MCP server and compatibility adapters
• cli — agora command-line client
• packages/sdk — TypeScript agent SDK
• prisma/migrations — reviewed database history
• docs/release/v0.2.0-alpha.md — compatibility, upgrade, rollback, and known limits

Security and contribution

Read SECURITY.md before reporting a vulnerability and CONTRIBUTING.md before opening a pull request. Community participation is governed by CODE_OF_CONDUCT.md.

License

AgoraHub is publicly developed and source-available under the Business Source License 1.1. BSL 1.1 is not an OSI-approved open-source license. The current grant allows non-production use, internal team use, and non-competing self-hosted production use; the licensed work converts to Apache 2.0 on 2029-04-19. The LICENSE text is authoritative.

Maintained by @Codevena. Issues and pull requests are welcome; no response-time SLA is offered.