---
title: "QWED A2A"
description: "QWED A2A intercepts Agent-to-Agent messages, applies a trust boundary, checks money totals exactly and signs each decided result."
url: https://qwedai.com/platform/a2a
---

QWED A2Av0.3.0

# Zero-trust checks for messages between agents.

Agents don’t trust each other, so QWED A2A checks for them. It intercepts Agent-to-Agent messages, applies a trust boundary, checks money totals exactly and signs every result it can decide.

[Read the documentation](https://docs.qwedai.com/a2a/overview) [Source on GitHub](https://github.com/QWED-AI/qwed-a2a)

At a glance

Version

0.3.0

Status on PyPI

Alpha

Install

pip install qwed-a2a

Protocol

Google’s Agent-to-Agent (A2A)

Attestation

ES256-signed JWT

Model in the check

None

Licence

Apache-2.0

## What it checks

-   TrustBoundary

    ### Who may talk

    Blocklists, allowlists and rate limits for agents.

-   Finance check

    ### Money totals

    Recomputes line-item totals with exact decimal maths. The only check that can return verified.

-   Logic check

    ### Contradictions

    Claims that are both asserted and negated. Returns heuristic\_pass, which is not enough to act on.

-   Code check

    ### Dangerous code

    AST and pattern scan for eval, os.system and similar. Returns heuristic\_pass.

-   Attestation

    ### Signed results

    Every decided outcome carries an ES256 JWT. A FastAPI gateway with per-agent keys is included.

## Mistakes it is built to catch

Nobody checked any of it

### Without QWED A2A

-   **A total that does not add up** An agent claims a total of 999.99 for items that come to 150.00.

-   **A contradiction** “budget\_approved” is asserted and negated in the same message.

Each one checked before it is used

### With QWED A2A

1.  **A total that does not add up** Finance check The items come to 150.00, so the message is held.

    VERIFIED · DENY
2.  **A contradiction** Logic check Flagged as a heuristic signal, not a verdict to act on.

What is proven correct goes through, with a record of why.

QWED returns the decision; your integration acts on it.

## Get started

shell

```
$ pip install qwed-a2a
```

[Documentation](https://docs.qwedai.com/a2a/overview) [Repository](https://github.com/QWED-AI/qwed-a2a) [PyPI](https://pypi.org/project/qwed-a2a/) [Release history](https://qwedai.com/releases)

Good to know

-   Only finance checks can return verified. Logic and code checks return heuristic\_pass, which is not admissible on its own; never execute such a payload without your own sandbox.
-   General and data-query messages are unverifiable.
-   It needs a signing key in QWED\_A2A\_SIGNING\_KEY\_PEM.

[**Use case: AI agents** Runtime verification for agents: before an agent runs a tool, messages another agent or makes a purchase, QWED checks the action.](https://qwedai.com/solutions/ai-agents)

## More agents and protocols

-   [Open Responses](https://qwedai.com/platform/open-responses)
-   [MCP server](https://qwedai.com/platform/mcp)
-   [QWED UCP](https://qwedai.com/platform/ucp)
-   [Every package](https://qwedai.com/ecosystem)