Skip to main content

Ecosystem

Tools and projects built on the OpenA2A platform.

How the Ecosystem Fits Together

OpenA2A tools share data through the @opena2a/shared package, which defines common types, constants, and utilities used across the CLI, HMA, Secretless, and ai-trust. When you run opena2a scan-soul, the CLI delegates to HMA for security scanning, uses aim-core for identity verification, and checks Secretless configuration for credential exposure, all coordinated through shared interfaces.

Contributing to the Ecosystem

All OpenA2A tools are open source under Apache-2.0. To contribute:

  1. 1. Fork the relevant repository from github.com/opena2a-org
  2. 2. Create a feature branch and implement your changes
  3. 3. Submit a pull request; automated CI runs security scans and tests
  4. 4. A maintainer reviews the pull request before it merges
HackMyAgentv0.33.2

Security scanner, red-team toolkit, OASB benchmarking, and runtime protection (ARP). All in one package. 318 static checks across 73 categories, 29 NanoMind semantic checks across 7 analyzers, 164 adversarial payloads across 16 categories, auto-fix with rollback.

npx hackmyagent securenpx hackmyagent attack --local # payload set only, contacts no agentnpx hackmyagent fix-all
Secretless AICredential Protection

Stores API keys outside project files and sets up AI coding tools not to read credential files. In Claude Code a PreToolUse hook blocks credential file reads. For Cursor, Copilot, and Devin Desktop (formerly Windsurf) it writes an instruction file that nothing enforces.

npx secretless-ai init
Browser GuardChrome Extension

Chrome MV3 extension for detecting and monitoring browser-based AI agents. 4-layer detection, delegation engine, a kill switch that closes agent tabs, and session timeline.

DVAASecurity Training

Damn Vulnerable AI Agent. 21 intentionally vulnerable agents, 12 vulnerability categories, and 22 CTF challenges for learning and red-teaming.

docker pull opena2a/dvaa
Plugin SDKhackmyagent/plugins

Build security plugins for AI agents. Three built-in plugins (CredVault, SignCrypt, SkillGuard) plus an authoring guide for creating your own.

npm i hackmyagent
@opena2a/aim-coreLightweight

Agent identity in a single npm package. Ed25519 keypair generation, capability-based access policy, trust scoring, and local audit log. No server or database required.

npm i @opena2a/aim-core
AIM ServerSelf-hosted

Optional centralized server for fleet visibility. Dashboard, cross-agent analytics, and governance policies. Deploy with Docker or run standalone.

docker compose up
ai-trustTrust Scoring

Trust lookup CLI for AI packages. Queries the OpenA2A Registry for scan results, publisher signals and advisories before you install an MCP server or agent package.

npx ai-trust check <package>npx ai-trust audit package.json

Shared Infrastructure

All ecosystem tools share common infrastructure through npm packages maintained in the OpenA2A organization.

@opena2a/shared

Common types, constants, and utilities. Defines the interfaces that tools use to exchange data (agent identities, trust scores, scan results).

opena2a-cli

Umbrella CLI that bundles hackmyagent, secretless-ai, and ai-trust as dependencies. Install once with npm i -g opena2a-cli to access all ecosystem tools.