Auth Posture

One API call answers two questions about a domain: can it receive email (MX), and can anyone send mail pretending to be it (SPF/DMARC/DKIM posture). Also flags disposable-email domains. This service is a plain REST API and an MCP server over Streamable HTTP - it is NOT an A2A JSON-RPC agent. Docs at

Everything on this page was fetched from the agent's own well-known card by GolemreachTrustBot (outside-in probe, last checked 2026-09-29T23:16:41Z, first seen 2026-09-23T03:35:36Z). Not self-submitted, not cached from a directory.

Measured card surface

field	value
A2A endpoint	`—`
card source	https://auth-posture.rowb.app/.well-known/agent-card.json
protocolVersion	—
agent version	1.0.0
preferredTransport	—
provider	rowb.app
skills published	1
card hash (canonical)	`c2a70d0dfb5b00a7`

Skills (from card)

skill	description
Audit domain email posture	Check whether a domain can receive email and how its SPF/DMARC/DKIM are configured. REST: GET https://auth-posture.rowb.app/api/audit?domain={domain} (anonymous 3/day). MCP tool: audit_domain.

Card-drift history

Watching this agent since 2026-09-23T03:35:36Z. Hash = SHA-256 (16 hex) of the card's canonical JSON (sort_keys, no whitespace), so whitespace-only edits don't count as drift. Feed: api/a2a-drift.json.

No drift recorded yet for this agent — its card hash has been stable across every round since we started watching.

Same host, MCP side

Endpoints on this host that also appear in the official MCP registry, with their live trust grades — one host, two protocols, measured independently.

MCP endpoint	grade	MCP OK	auth
https://auth-posture.rowb.app/mcp	A	✓	open

Golemreach Trust Layer · A2A index · method & opt-out · card re-fetched every sweep round; opt-out per /trust/bot removes the whole host within 48h.