opena2a review

Unified security review dashboard. Runs six analysis phases and generates an interactive HTML report.

Usage

Description

Executes six analysis phases in sequence: project scan, credential scan, guard verification, shield analysis, HMA scan (optional), and shadow AI detection. Results are combined into a composite score using the weights in the scoring table below. The report shows a recovery path indicating how the score improves when specific issues are resolved (for example, "27 -> 71 by fixing credentials").

By default, the generated HTML report opens automatically in the default browser. Use --no-open to suppress this behavior.

Flags

Scoring weights

The second weight column applies when the HMA scan produced no result, either because --skip-hma was passed or because HackMyAgent could not run. The review then prints a provisional-verdict notice saying HMA-only threats are not reflected, and the JSON output carries provisional: true. When a phase finds a critical problem in the project itself, the composite is capped at that phase's score, so one severe result is not averaged away by the others.

Examples

The six phases

The review command executes each phase sequentially. If a phase encounters an error, it records a zero score for that phase and continues to the next. This ensures you always get results even if one subsystem is not configured.

1. Project Scan (trust): Runs the same assessment as opena2a init. Checks project structure, governance files, identity presence, and tool configuration.
2. Credential Scan: Scans for hardcoded credentials, exposed API keys, and .env files that should be gitignored. Uses the same engine as opena2a protect.
3. Guard Verification: Checks ConfigGuard status: how many config files are signed, whether any show tampering (hash mismatch), and the enforcement policy mode.
4. Shield Analysis: Evaluates the Shield orchestration layer: initialization state, active protections, session tracking, event logging, and LLM analysis status.
5. HMA Scan: Runs HackMyAgent security checks if available. Skippable with --skip-hma when HackMyAgent is not installed.
6. Shadow AI Detection: Uses the same detection as opena2a detect to find AI agent processes on the machine, MCP servers and AI tool configuration files in the project, and identity and governance files such as SOUL.md. A missing identity or governance file is listed as a recovery step and does not change the composite; a critical MCP server or AI configuration in the project does.

Progress output

The command prints one line per phase as it runs. Each line ends with the time the phase took; the HMA line ends with the reason instead when HackMyAgent produced no result, such as skipped or not installed.

  OpenA2A Security Review

  [1/6] Scanning project...
  [2/6] Checking credentials...
  [3/6] Verifying config integrity...
  [4/6] Analyzing shield events...
  [5/6] Running HMA security scan...
  [6/6] Detecting shadow AI...

After the sixth line it prints the composite score out of 100, the points the top fixes would recover, and the number of findings by severity. The HTML report holds the detail.

HTML Report

The generated HTML report is a self-contained, interactive file that includes expandable sections for each phase, detailed findings with severity levels, and a visual recovery path chart. The report does not require a web server; it can be opened directly from the filesystem. Use --reportto specify a custom output path, or --no-open to prevent automatic browser launch (useful in CI environments or SSH sessions).

Error Handling

In CI mode (--ci), the command exits with code 1 if the composite score falls below 50. Individual phase failures do not cause a non-zero exit; only the aggregate score matters. When the HMA scan produces no result, including under --skip-hma, the composite uses the without-HMA column of the scoring table.

Related Commands