Skip to main content

opena2a self-register

Register OpenA2A tools with metadata and security scan results in the public registry.

Usage

opena2a self-register [options]

Description

Registers the OpenA2A tools in its built-in manifest with their metadata, version information, and capabilities. When HackMyAgent is available, each tool is scanned before registration and the security findings are published alongside the metadata. Use --skip-scan to register without scanning, or --only to register a subset of tools.

The command takes no package argument and registers only the tools in that manifest. It cannot add a package you publish: opena2a self-register <package> fails with "too many arguments".

Because it writes to a public registry, the command asks for confirmation before it publishes. Pass --yes to skip the prompt; without it, a non-interactive run refuses to publish and exits with code 2. Use --dry-run to preview what would be registered without making any HTTP requests.

Flags

FlagDescription
--registry-url <url>Override the default registry endpoint.
--skip-scanSkip HMA scanning and register metadata only.
--only <tools>Comma-separated tool names from the manifest. An unknown name prints the accepted names.
--dry-runShow what would be registered without making HTTP requests.
-y, --yesSkip the confirmation prompt. Required when running non-interactively.

The global flags --format json, --ci and --verbose also apply.

Examples

# Register all tools with security scans
opena2a self-register
# Register specific tools only
opena2a self-register --only aim,secretless-ai,hackmyagent
# Publish without the prompt (CI and other non-interactive runs)
opena2a self-register --yes
# Dry run to preview registrations
opena2a self-register --dry-run --verbose
# Register without scanning, custom registry
opena2a self-register --skip-scan --registry-url https://registry.example.com

When to Use It

The self-register command is primarily used by the OpenA2A project maintainers to publish tool metadata and security scan results to the public registry. This data powers the verify command and trust data lookup. Typical use cases include:

  • Publishing updated tool metadata after a new release
  • Refreshing security scan results in the registry
  • Registering new tools that join the OpenA2A ecosystem
  • Validating registry submissions with --dry-run before publishing

Registration Flow

Unless --dry-run or --yes is set, the command first asks for confirmation. It then follows this sequence for each tool being registered:

  1. Look up whether the registry already has a record for the tool (the Status column shows new or exists).
  2. Unless --skip-scan is set, run a HackMyAgent hardening scan of a tool the manifest marks scannable and count its findings by severity.
  3. Request a scan token from the registry, then submit the scan results, or the metadata alone when no scan ran.

A dry run performs none of these steps: it makes no HTTP requests and runs no scan.

Expected Output

$ opena2a self-register --dry-run --skip-scan --only aim,secretless-ai,hackmyagent
Registering 3 OpenA2A tool(s) at https://api.oa2a.org

[DRY RUN] No HTTP requests will be made.


Tool                       Status  Scan     Crit  High  Med  Low  Published
-------------------------  ------  -------  ----  ----  ---  ---  ---------
HackMyAgent                new     skipped  -     -     -    -    dry-run
Secretless AI              new     skipped  -     -     -    -    dry-run
Agent Identity Management  new     skipped  -     -     -    -    dry-run

Summary: 3 tools, 0 scanned, 3 metadata-only, 0 errors
Registry: https://api.oa2a.org

Exit Codes

  • 0: every selected tool was processed without an error.
  • 1: --only matched no tool (the accepted names are printed), or a tool failed.
  • 2: publishing was refused or cancelled at the confirmation step. Nothing was published.

Run with --dry-run first to confirm which tools will be submitted.

Related Commands

identityscanbaselinesverify