Thanks for flagging this! You're absolutely right about network security.
The spec does require TLS - from Section 4.1:
> "All HTTP endpoints MUST use TLS 1.2 or higher"
> "Clients MUST verify TLS certificates"
The `http://localhost:8080` example is just for local development/demo purposes.
In production, all discovery endpoints and AgentCard fetches must use HTTPS.
The spec does require TLS - from Section 4.1: > "All HTTP endpoints MUST use TLS 1.2 or higher" > "Clients MUST verify TLS certificates"
The `http://localhost:8080` example is just for local development/demo purposes. In production, all discovery endpoints and AgentCard fetches must use HTTPS.