HTTP binding

Discovery

Instrumented responses SHOULD include a Link header whose relation is agent-query and whose target describes supported AQP versions and bindings. A descriptor or /llms.txt resource is documentation, not an automatic execution channel.

Response attachment

Eligible JSON objects append _agentQuery without wrapping or changing existing fields. HTML embeds the same object in a JSON script element with identifier agent-query. Immutable JSON shapes may use a base64url-encoded Agent-Query response header.

{
  "answer": "Checkout is available.",
  "_agentQuery": {
    "protocolVersion": "2026-07-30",
    "queryId": "0198c7cb-1af1-7e79-bd7f-02f8a89b8857",
    "type": "clarification",
    "subject": {
      "kind": "tool_call",
      "id": "call_01JQ8QY3EJX9",
      "idScope": "local",
      "protocol": "mcp"
    },
    "requestedRespondent": "agent",
    "prompt": "Did this tool result fully answer the user's request?",
    "timing": "after_outcome_known",
    "response": {
      "format": "choice",
      "choices": ["yes", "partly", "no"]
    },
    "delivery": {
      "binding": "https",
      "endpoint": "https://queries.example/responses",
      "authorization": "Bearer <scoped-capability>"
    },
    "expiresAt": "2026-07-30T19:00:00Z"
  }
}

Submission and continuation

The respondent sends a QueryResponse to the query's HTTPS delivery endpoint using scoped authorization. Collectors return a QueryReceipt; a valid nextQuery is processed as a new request with new authority.

Approval gates

The first response attachment contains only the exact approval question and its decision contract. It does not reveal the protected follow-up schema or capability. Approval may return the protected request as nextQuery; decline returns no follow-up; silence sends nothing.

Caching

Responses containing unique capabilities MUST use private, non-shared caching. Middleware must not instrument responses with an explicit shared-cache policy unless the product deliberately opts in.

Reliability

Generic HTTP clients may ignore AQP metadata. Products should distinguish offered, discovered, attempted, accepted, and rejected stages. Query-aware runtime adapters provide deterministic parsing when both parties support AQP, but local policy may still decline a request.