Scan for vulnerabilities, detect leaked credentials, pentest AI agents, and harden your security posture. One command. Open source.
$ npx opena2a-cli init8 security PRs accepted by OpenClaw · 205K+ ★
7 merged, 1 open — credential redaction, path traversal, supply chain hardening, and more
From the founders of CyberSecurity NonProfit (12,000+ security professionals)
Three commands to go from vulnerable to verified.
Keys provisioned for Google Maps or Places can silently invoke Gemini LLM endpoints. AWS keys intended for S3 may reach Bedrock AI. OpenA2A detects these cross-service privilege escalations and creates deny-all broker policies.
Google API key can access Gemini AI
Maps/Places key invokes Gemini LLM endpoints
AWS key can invoke Bedrock LLMs
S3/EC2 key has Bedrock AI permissions
Six categories of findings across credential, configuration, runtime, and supply chain security.
Anthropic, OpenAI, Google, AWS, GitHub, and generic API key patterns across all source files.
API keys provisioned for one service that silently grant access to AI models. Google Maps to Gemini, AWS S3 to Bedrock.
SHA-256 signing for config files. Detect unauthorized modifications to package.json, mcp.json, Dockerfile.
Process, network, and filesystem activity monitoring. Protocol-aware scanning for MCP, A2A, and OpenAI endpoints.
Binary integrity checks against the OpenA2A Trust Registry. Detect tampering in installed packages.
.gitignore coverage, .env protection, lock file presence, MCP config detection, security config assessment.
The CLI orchestrates purpose-built security tools through adapter commands. Each tool installs on first use and works standalone or through the unified interface.
opena2a initScan your project in one command. Trust score, scope drift detection, credential scan, and guided remediation.
opena2a scan150+ security checks across 10 categories. Attack simulation, auto-fix with rollback, CIS-style reports.
opena2a secretsKeeps credentials out of AI context windows. PreToolUse hooks block credential access across Claude Code, Cursor, Copilot.
Credential replacements match your language's env var idiom.
process.env.API_KEYos.environ.get('API_KEY')os.Getenv("API_KEY")ENV['API_KEY']System.getenv("API_KEY")std::env::var("API_KEY")All commands support --format json and --ci flags.
# GitHub Actions
- name: Security assessment
run: npx opena2a-cli init --ci --format json
- name: Credential check
run: |
npx opena2a-cli protect --dry-run --ci
# Fail if credentials found
- name: Config integrity
run: npx opena2a-cli guard verify --ciOne command scans your project for hardcoded secrets, scope drift, and misconfigurations. No signup required.
$ npx opena2a-cli initSubscribe to our newsletter for weekly insights, vulnerability alerts, and best practices