RemoteA2aAgent caches an invalid Agent Card after RPC URL validation failure

[jinnymoon1124]

🔴 Required Information

Please ensure all items in this section are completed to allow for efficient
triaging. Requests without complete information may be rejected / deprioritized.
If an item is not applicable to you - please mark it as N/A

Describe the Bug:
After upgrading google-adk from 1.27.4 to 2.7.1, a RemoteA2aAgent fails during the first invocation when the remote Agent Card contains an HTTP RPC URL on a non-loopback internal hostname.

The first invocation fails with the expected HTTPS validation error.
However, invoking the sameRemoteA2aAgent instance again succeeds without changing the Agent Card or configuration.

This appears to indicate that the Agent Card is cached before validation completes, and the cached card is reused after validation failure.

Steps to Reproduce:

1. Install google-adk==2.7.1.
2. Configure a RemoteA2aAgent using a remote Agent Card URL.
3. Make the remote Agent Card return an RPC URL similar to:

     http://internal-gateway.example.invalid:8080/agents/remote

4. Invoke the same RemoteA2aAgent instance for the first time.
5. Observe the following error:

     Failed to initialize remote A2A agent:
     Agent card RPC URL must use https, or http on a loopback host:
     http://internal-gateway.example.invalid:8080/agents/remote

6. Invoke the same RemoteA2aAgent instance again without restarting the process. (I used same question)
7. Observe that the second invocation proceeds successfully.

Expected Behavior:
If Agent Card validation fails, I think the invalid Agent Card should not remain cached.

The next invocation should either:

• Resolve and validate the Agent Card again and return the same validation error; or
• Return a stable initialization error without creating an A2A client from an invalid card.

If the Agent Card is valid and reachable through a private service mesh, all invocations should succeed consistently.

Observed Behavior:
The first invocation fails with:

Agent card RPC URL must use https, or http on a loopback host:
http://internal-gateway.example.invalid:8080/agents/remote

The second invocation using the same RemoteA2aAgent instance succeeds.

The suspected flow is:

# google/adk/agents/remote_a2a_agent.py

  self._agent_card = await self._resolve_agent_card(ctx)
  await self._validate_agent_card(self._agent_card)

If validation fails, _agent_card has already been assigned.
On the next invocation, this condition becomes false:

if not self._agent_card:

As a result, Agent Card resolution and validation are skipped, and an A2A client is created using the previously cached card.

The current upstream implementation appears to follow this same ordering in the shared resolution path:
https://github.com/google/adk-python/blob/main/src/google/adk/agents/remote_a2a_agent.py

Environment Details:

• ADK Library Version (pip show google-adk): 2.7.1
• Desktop OS: N/A - running in a Linux container
• Python Version (python -V): Python 3.14.x

Model Information:

• Are you using LiteLLM: Yes
• Which model is being used: Gemini Flash-family model through an internal LiteLLM proxy (gemini 3 flash)

[sanketpatil06]

Hi @jinnymoon1124 , Thanks for reporting this. We were able to reproduce and confirm the issue on our end.
A community member has opened PR #6903 to address this by only caching self._agent_card after validation succeeds. In the meantime, as a temporary stopgap, you can reset self._agent_card = None in an exception handler or monkey-patch _ensure_resolved on your end:

from google.adk.agents import remote_a2a_agent

_orig_ensure_resolved = remote_a2a_agent.RemoteA2aAgent._ensure_resolved

async def _safe_ensure_resolved(self, ctx=None):
    try:
        return await _orig_ensure_resolved(self, ctx)
    except Exception:
        self._agent_card = None
        raise

remote_a2a_agent.RemoteA2aAgent._ensure_resolved = _safe_ensure_resolved

Worth trying that workaround on your end while PR is under review. Feel free to check out the PR as well and let us know if that fix resolves it for you.