Travel Supplier bronze

supplier.webmesh.ai

“Issues flight quotes and tickets against verified spending mandates. Verifies mandate signature, scope, amount, audience, and DPoP proof, then submits the traveler's pre-signed EIP-3009 transferWithAuthorization on-chain (Base Sepolia). No ticket without on-chain settlement. Evidence bundle carries tx_hash + SCITT receipt.

a2a https://supplier.webmesh.ai talk to it https://supplier.webmesh.ai/.well-known/agent-card.json its card

🇺🇸 US · GoDaddy.com, LLC Checked 6d ago extendedAgentCard, extensions, pushNotifications, streaming

we checked this the operator says this

Community rating 0 0 up · 0 down — sign in to vote

Verified by agenttru.st

Everything here is a check agenttru.st performed itself. Assurance, protocol, hosting and freshness are in the card above and are not repeated.

Certificate: Issued by Let's Encrypt domain-validated
Valid until 13 Dec 2026.

Control of the hostname was checked; nothing about who operates it.
DANE / TLSA: Not verified (TLSA query returned RCodeNameError)
Discovery: Well-known document
This host also publishes a DNS-AID SVCB record declaring itself an agent speaking a2a, served with a DNSSEC-validated answer. A declaration is not a verification — the fetch above is what proved it — but it is a deliberate statement by whoever controls the zone.

This host also publishes an ARD catalog (/.well-known/ai-catalog.json) declaring 3 resources. The catalog's entries are the publisher's claims, not something agenttru.st verified.
AI-facing documents: Publishes /llms.txt — “Travel Supplier” a curated map of the site's content for language models

Publishes a Web Bot Auth key directory (1 key, Ed25519) — the operator publishes keys so their agent's signed requests can be verified. agenttru.st recorded that the directory exists; it has not verified a signature.

Fetched from this host during verification. Neither document is how this agent was discovered.
First seen: 15 Sep 2026

View verification details

Assurance: bronze Bronze — agent card fetched over HTTPS with a valid certificate
Protocols: A2A verified by handshake or card fetch, not merely advertised
Hosted in: 🇺🇸 US · GoDaddy.com, LLC (AS398101)
Last checked: 6d ago

What this agent says it can do

Declared in the agent's own card. agenttru.st has not tested whether it completes any of these tasks — the operator of supplier.webmesh.ai controls every word below.

Flight Quote

Three deterministic flight options. x402-gated.

travelflightsquotex402

Examples it gives

Quote MAD to SIN 2026-10-14

Book Flight

Book a quoted flight. AP2 mandate + DPoP + EIP-3009 payment_auth required. Submits on-chain settlement before issuing ticket.

travelbookingmandatedpopeip3009payment

Examples it gives

Book quote-abc with mandate {mandate_id}

What its catalog declares

From the ARD catalog this host publishes at /.well-known/ai-catalog.json. The operator controls every entry; agenttru.st verified that the catalog exists and parses, and nothing about what the entries say.

Travel Supplier (A2A)

a2a-agent-cardtrust manifest

Issues flight quotes and tickets against verified spending mandates. Verifies mandate signature, scope, amount, audience, and DPoP proof, then submits the traveler's pre-signed EIP-3009 transferWithAuthorization on-chain (Base Sepolia). No ticket without on-chain settlement. Evidence bundle carries tx_hash + SCITT receipt.

https://supplier.webmesh.ai/.well-known/agent-card.json

Travel Supplier (MCP)

mcp-server-cardtrust manifest

MCP server exposing get_quote (x402-gated) and book_flight (AP2 mandate + DPoP + EIP-3009 payment_auth required) over streamable-HTTP.

https://supplier.webmesh.ai/.well-known/mcp.json

Webmesh Agent (NANDA AgentFacts)

jsontrust manifest

Project NANDA AgentFacts: operational profile, adaptive-resolver policies, and governance metadata.

https://supplier.webmesh.ai/agentfacts.json

Technical agent card

Copied from the agent's card. The operator controls these values; agenttru.st has not verified them.

Provider: Webmesh — what this agent says about itself; other agents claiming the same provider are not thereby related
Protocol: a2a
Version: 1.0.2
Auth schemes: ansIdentityCert httpMessageSignatures noAuth
Extensions: https://modelcontextprotocol.io
MCP server exposing get_quote (x402-gated) and book_flight (AP2 mandate + DPoP + EIP-3009 payment_auth required) over streamable-HTTP.
https://webmesh.ai/ext/ans-trust-stack/v1
Identity and interoperability stack: ANS Trust Card (x5c chain + stapled SCITT receipt), DNS-AID SVCB with DNSSEC and DANE TLSA, DNSid organizational accountability, ARD / AI-Catalog discovery, and Web Bot Auth (RFC 9421 HTTP Message Signatures) outbound r

A2A protocol extensions the card declares. A declared payment extension (AP2, x402) means the operator says the agent can transact, not that agenttru.st has seen it do so.
Card completeness: complete all eight fields required by a2a.proto v1.0

View all card details

Capabilities: extendedAgentCard extensions pushNotifications streaming
Agent card: https://supplier.webmesh.ai/.well-known/agent-card.json

Operate this agent and would rather not be listed? Request removal.