Agentic Resource Discovery: Federated Pre-Invocation Search¶

Agentic Resource Discovery describes resources as searchable entries so clients can find capabilities through registries before invoking their underlying protocols.

The Agentic Resource Discovery specification (ARD) is a proposal for discovering MCP servers, A2A agents, and skills across registries. Version 0.91, dated August 26, 2026, describes entries as JSON-LD nodes. It preserves existing entries while adding namespace extensions through @context (ARD specification, overview).

What discovery supplies¶

ARD moves resource selection into a search service instead of putting every description in the model's context. A registry must expose an HTTP REST search interface. Authentication for invoking a resource remains the responsibility of its artifact protocol (ARD specification, sections 3.2–3.6).

Each entry requires identifier, displayName, type, and exactly one of url or data. The identifier uses the domain-anchored form urn:air:<publisher>:[<namespace>:]<agent-name>. A URL references the artifact; data carries it inline (ARD specification, sections 4.2–4.3).

The specification recommends two to five representativeQueries as search examples. Missing examples produce conformance warnings rather than schema rejection. Optional capabilities tokens support filtering without fetching the artifact. Consumers expand entries using ARD's base JSON-LD context; publishers can add namespaces through an entry's own @context (ARD specification, sections 4.1–4.2).

POST /search is required. Browsing through POST /explore and listing through GET /agents are optional. Discovery can run during integration or while an agent works, over an approved collection or a broader index (How ARD works).

Trust remains a separate decision¶

The optional trustManifest can carry identity, attestations, provenance, and signatures. Its identity must align with the publisher domain in the discovery identifier. ARD delegates signing and verification procedures to the manifest's declared trust framework. Federated registries should verify the manifest and can use the result for admission, ranking, or filtering (ARD specification, section 4.5).

A search score measures relevance only. The specification explicitly forbids treating it as a trust, compliance, or safety judgment. An organizational compliance attestation also says nothing by itself about a particular artifact's safety. Artifact attestations should identify the evaluated artifact by digest (ARD specification, sections 4.5.2 and 5.3.2).

When this backfires¶

You treat discovery as authorization. Keep permission checks on the invocation path; ARD delegates authentication to the artifact protocol.
You accept an unverified trust manifest. The declared framework and publisher binding still need checking.
You search the open web when the task needs an approved collection. ARD also supports restricted collections, which its guide identifies as the likely enterprise case (How ARD works).
You require registered media types before accepting entries. Section 3.3 says registration is pending and directs intermediaries to omit strict verification of those types (ARD specification).

Governance context¶

The AAIF launch announcement names MCP, AGENTS.md, and Block's goose as contributions (Block announcement). Anthropic announced the Agent Skills donation on October 22, 2026. It describes this as "donating the standard to the Agentic AI Foundation (AAIF) under the Linux Foundation" (Anthropic announcement). These examples are not an exhaustive project roster, and neither announcement establishes ARD membership.

Example¶

This weather-server entry comes from section 4.4. It names the artifact type and supplies the queries a registry can index (ARD specification):

{
  "identifier": "urn:air:acme.com:server:weather",
  "displayName": "Weather Data Node",
  "type": "application/mcp-server-card+json",
  "url": "https://api.acme.com/mcp/weather.json",
  "capabilities": ["WeatherTool", "ForecastTool"],
  "description": "Enterprise weather MCP server for live telemetry.",
  "representativeQueries": [
    "what is the current wind speed in Chicago",
    "get the 5-day forecast for Seattle"
  ]
}

The entry describes the server. Its search relevance does not authorize a connection or verify the server's safety.

Key Takeaways¶

Validate discovery entries separately from the artifacts they describe.
Supply representative queries even though their absence is only a conformance warning.
Check publisher binding and the declared trust framework before relying on attestations.
Keep search relevance separate from permission and safety decisions.