opena2a trust
Look up the trust record the registry currently holds for an AI agent or MCP server package name.
Prerequisites
Install the OpenA2A CLI globally:
npm install -g opena2a-cliIf opena2a trust fails with fetch failed and names registry.opena2a.org, the installed version looks up a registry address that no longer resolves. Run the install command again to update.
Usage
opena2a trust [package] [options]Description
Queries the trust record the registry holds for a package name, or for the current project. Returns the trust score, trust level, security scan results and supply chain data. Text output shows the score as a percentage; with --json, trustScore is a fraction from 0 to 1. When run without arguments, reads the package name from package.json in the current directory.
Trust scores are synthesized from multiple signals: security scan findings (hardening checks, governance analysis, attack simulation), supply chain data (dependency risk, maintainer activity, version history), and community verification (published scan results).
Trust levels
| Level | Description |
|---|---|
discovered | Package exists in a public index (npm, PyPI, GitHub). No security data yet. |
scanned | Automated security scans have been run. Trust score reflects scan findings. |
claimed | The profile is marked claimed. This does not show that a publisher proved ownership: the registry does not verify package ownership yet. |
The registry also defines the levels verified and certified. This page does not describe them until the registry documents what sets each one.
Flags
| Flag | Description |
|---|---|
--source <npm|pypi|github> | Package source. Defaults to npm. Auto-detected from package name or URL if omitted. |
--json | Output as JSON. Shorthand for --format json. |
--verbose | Show detailed breakdown of trust score components. |
--registry-url <url> | Override the trust profile endpoint. |
--ci | CI mode with deterministic output. |
Examples
opena2a trust expressopena2a trust https://github.com/modelcontextprotocol/serversopena2a trustopena2a trust express --json