Calling a self-hosted A2A server
1 min
Loopback / private-range URLs are rejected by default. Opt in explicitly when you need them.
By default the A2A worker refuses to dial AgentCard URLs that resolve to a private network range (127.0.0.0/8, 10/8, 172.16/12, 192.168/16, 169.254/16, ::1, fc/fd, fe80, plus the literal hostname `localhost`). This is standard SSRF defense — without it, a hostile config could point the runtime at a cloud-metadata endpoint or your own NXR daemon. If you're running an A2A server on your laptop or LAN and want to test it from inside Avery, set `NXR_ALLOW_PRIVATE_AGENT_URLS=1` in the service's environment before launching — the guard is disabled for that boot. The error you'll see if you forget is `E_A2A_PRIVATE_URL` with a friendly hint in the Add dialog.
Live recipes need the desktop
This article is a static preview. The in-app Help sidecar inside Avery NXR can fire each step against your live project — install the desktop to use it interactively.