opena2a-org/opena2a

opena2a-cli

opena2a is the command-line front door to the OpenA2A security tools. It assesses an AI agent project for hardcoded credentials and unsafe configuration, applies the fixes, and hands scanning, credential storage and package trust lookups to HackMyAgent, Secretless and ai-trust.

Quick start

npx opena2a-cli init my-agent

What npx opena2a-cli init my-agent prints, trimmed (full output):

  Findings
  -----------------------------------------------
  CRITICAL  OpenAI Project Key
            OpenAI Project Key hardcoded in source. Anyone who can
            read this file can use it to access the associated
            account.
            src/agent.js:1
            Verify: sed -n '1p' src/agent.js
            Fix:    opena2a protect
  ...
  Security Score: 65 / 100  (project posture: credentials, config, environment)

my-agent is the path to your project; run the command from the directory that contains it. init reads the project and changes nothing. It needs Node.js 20.19 or later and no account, and it exits 1 while a critical finding is open, 0 otherwise.

Then apply the fixes and build the full report:

npx opena2a-cli protect my-agent
npx opena2a-cli review my-agent

protect moves each hardcoded credential out of the source files into Secretless, which stores it outside the project (a local vault or the OS keychain), and rewrites the source to read environment variables. review downloads the NanoMind model files on its first run and opens an HTML report in the browser; --no-open skips the browser.

What you can do

Each line links to the section for that job.

• Assess a project: `opena2a i