Step 1: Get your endpoint ready

No SDK required. Any HTTP client works — curl, fetch, requests, you name it.

# Base URL
export A2A_BASE="https://a2ainfrastructure.com"

# Optional: set your API key for Gate 2 + OCSF audit
export A2A_API_KEY="a2a_your_key_here"

Step 2: Add the safety layer

POST a command to /v1/evaluate before executing it. The response tells you whether to proceed.

# Evaluate a command before running it
curl -X POST "$A2A_BASE/v1/evaluate" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $A2A_API_KEY" \
  -d '{
    "command": "ls -la /tmp",
    "context": { "agent": "my-agent", "session": "abc123" }
  }'

Allowed response:

// HTTP 200
{
  "allowed": true,
  "gate1": { "allowed": true, "reason": null },
  "gate2": { "allowed": true, "reason": "Read-only directory listing, no risk" }
}

Blocked response:

// HTTP 200
{
  "allowed": false,
  "gate1": { "allowed": false, "reason": "matched denylist: recursive force delete" },
  "gate2": null
}

Step 3: Verify

Test with a known-dangerous command to confirm it's blocked:

curl -s -X POST "$A2A_BASE/v1/evaluate" \
  -H "Content-Type: application/json" \
  -d '{"command": "rm -rf /"}' | jq .allowed

# Output: false