opena2a self-register

Register OpenA2A tools with metadata and security scan results in the public registry.

Usage

opena2a self-register [options]

Description

Registers up to 13 OpenA2A tools in the public registry with their metadata, version information, and capabilities. When HackMyAgent is available, each tool is scanned before registration and the security findings are published alongside the metadata. Use --skip-scan to register without scanning, or --only to register a subset of tools.

Use --dry-run to preview what would be registered without making any network requests to the registry.

Flags

FlagDescription
--registry-url <url>Override the default registry endpoint.
--skip-scanRegister without running HMA security scans.
--only <tools>Comma-separated list of tools to register (e.g., "aim,secretless,hma").
--dry-runPreview registrations without submitting to the registry.
--format <text|json>Output format.
--ciCI mode with deterministic output.
--verboseShow detailed registration progress per tool.

Examples

# Register all tools with security scans
opena2a self-register
# Register specific tools only
opena2a self-register --only aim,secretless,hackmyagent
# Dry run to preview registrations
opena2a self-register --dry-run --verbose
# Register without scanning, custom registry
opena2a self-register --skip-scan --registry-url https://registry.example.com

When to Use It

The self-register command is primarily used by the OpenA2A project maintainers to publish tool metadata and security scan results to the public registry. This data powers the verify command and the Trust Registry lookup. Typical use cases include:

  • Publishing updated tool metadata after a new release
  • Refreshing security scan results in the registry
  • Registering new tools that join the OpenA2A ecosystem
  • Validating registry submissions with --dry-run before publishing

Registration Flow

For each tool being registered, the command follows this sequence:

  1. Resolve the tool package and read its package.json for name, version, and description.
  2. Compute the SHA-256 hash of the installed package contents.
  3. If HackMyAgent is available (and --skip-scan is not set), run a security scan and collect findings.
  4. Submit the metadata, hash, and scan results to the registry API.
  5. The registry returns a scan token that can be used for subsequent verification.

Expected Output

$ opena2a self-register --only hackmyagent,secretless-ai

Tool Registration
==================
Registry: https://api.oa2a.org

hackmyagent@0.10.5
  Hash:     a3f8c1...d92e4b
  Scan:     147 checks, 0 critical, 2 warnings
  Status:   Registered
  Token:    reg_abc123...

secretless-ai@0.11.4
  Hash:     b7d2e9...f14a8c
  Scan:     147 checks, 0 critical, 0 warnings
  Status:   Registered
  Token:    reg_def456...

Result: 2/2 tools registered successfully

Error Handling

If the registry is unreachable, the command reports a connectivity error for each tool and exits with code 1. Tools that are not installed locally are skipped with a warning. When using --only with an unrecognized tool name, the command lists the 13 registerable tools and exits. The --dry-run flag is recommended before actual registration to confirm what will be submitted.

Related Commands

identityscanbaselinesverify