Opena2a

opena2a-cli

[](./STATUS.md)

**[OpenA2A](https://github.com/opena2a-org/opena2a)**: [CLI](https://github.com/opena2a-org/opena2a) · [HackMyAgent](https://github.com/opena2a-org/hackmyagent) · [Secretless](https://github.com/opena2a-org/secretless-ai) · [AIM](https://github.com/opena2a-org/agent-identity-management) · [Browser Guard](https://github.com/opena2a-org/AI-BrowserGuard) · [DVAA](https://github.com/opena2a-org/damn-vulnerable-ai-agent)

Unified CLI for the OpenA2A security toolchain. One command finds credential leaks, shadow AI, unsigned configs, and ungoverned agents, then fixes them. Apache 2.0.

[](https://www.npmjs.com/package/opena2a-cli) [](LICENSE)

[Website](https://opena2a.org) · [Docs](https://opena2a.org/docs) · [Demos](https://opena2a.org/demos) · [Discord](https://discord.gg/uRZa3KXgEn)

Quick start

npx opena2a-cli init       # 1. read-only assessment: every finding prints Verify and Fix
npx opena2a-cli protect    # 2. apply the fixes
npx opena2a-cli review     # 3. full report. First run downloads the NanoMind
                           #    model files; --no-open skips the browser.

What `init` prints (captured from opena2a-cli 0.10.13 on a small demo project, trimmed):

  OpenA2A Security Assessment  v0.10.13         0.1s

  Project      acme-agent v2.1.0
  Stack        Node.js + MCP server

  Findings
  -----------------------------------------------
  CRITICAL  OpenAI API Key
            OpenAI API key hardcoded in source. Grants full API access
            to anyone with the source code.
            src/agent.js:1
            Verify: sed -n '1p' src/agent.js
            Fix:    opena2a protect
  ...
  Security Score: 62 / 100  (project posture: credentials, config, environment)

![opena2a review](docs/im