Know what every agent did. Revoke access when something goes wrong. Open source. Self-hosted or AIM Cloud.
$ npx opena2a-cli identity create --name my-agentCryptographic identity with an audit log. No account required.
Agent Identity Management
Every agent gets a cryptographic identity, a trust score, and an append-only audit log. Capability policies keep them inside their lane.
Ed25519 keypairs for every agent. Issued locally, verified by signature. No passwords to leak, no tokens to rotate.
Every action the agent takes is recorded. Query the log from the dashboard or stream it via API.
Verification, compliance, uptime, action success, alerts, age, drift, and feedback. Updated continuously.
Declare what an agent is allowed to do. Enforce at runtime via @perform_action (Python) or @SecureAction (Java).
Discover and attest MCP servers. Sign configurations, detect drift, block tampered servers automatically.
Run locally with Docker Compose or use the managed AIM Cloud. Same API. Same SDKs. Your choice of deployment.
Your developers are running AI agents you don't know about. Find, fix, and harden them.
Keys provisioned for Google Maps or Places can silently invoke Gemini LLM endpoints. AWS keys intended for S3 may reach Bedrock AI. OpenA2A detects these cross-service privilege escalations and creates deny-all broker policies.
Google API key can access Gemini AI
Maps/Places key invokes Gemini LLM endpoints
AWS key can invoke Bedrock LLMs
S3/EC2 key has Bedrock AI permissions
Six categories of findings across credential, configuration, runtime, and supply chain security.
Anthropic, OpenAI, Google, AWS, GitHub, and generic API key patterns across all source files.
API keys provisioned for one service that silently grant access to AI models. Google Maps to Gemini, AWS S3 to Bedrock.
SHA-256 signing for config files. Detect unauthorized modifications to package.json, mcp.json, Dockerfile.
Process, network, and filesystem activity monitoring. Protocol-aware scanning for MCP, A2A, and OpenAI endpoints.
Binary integrity checks for AI packages. Detect tampering in installed packages.
.gitignore coverage, .env protection, lock file presence, MCP config detection, security config assessment.
Manage identity, scan for vulnerabilities, and protect credentials.
opena2a identity createCryptographic identity, audit logs, trust scoring, and capability policies for every agent. Self-hosted or AIM Cloud.
npx hackmyagent238 security checks across 44 categories. Finds credential leaks, injection vulnerabilities, and MCP misconfigurations.
npx secretless-aiKeeps API keys and secrets out of AI tool context. Supports Claude Code, Cursor, Copilot, Windsurf.
One command scans for shadow AI agents, MCP servers, credentials, and misconfigurations. No signup required.
$ npx opena2a-cli reviewSubscribe to our newsletter for weekly insights, vulnerability alerts, and best practices