Improving your trust score

Check your package's trust score, scan and fix it, and monitor the score in CI.

Step 1: Check your current score

Start by seeing where you stand. Run opena2a trust to view your current trust score, trust level, and any findings.

If the command fails with fetch failed and names registry.opena2a.org, the installed version looks up a registry address that no longer resolves. Update it with npm install -g opena2a-cli@latest.

The --source flag defaults to npm, so you do not need to specify it for npm packages. For PyPI packages, pass --source pypi. GitHub URLs are auto-detected.

If your package has not been scanned yet, the score will reflect only the basic supply chain signals (dependency count, maintainer activity, publish recency). The output includes specific recommendations for what to do next.

Step 2: Run security scans

HackMyAgent is a separate security scanner. Install it with:

Then run a scan locally. Publishing the results is optional:

--publish sends the scan results to the OpenA2A registry as a community submission, under the name in your package.json or, if there is none, the folder name.

Step 3: Fix findings and rescan

The scan output includes actionable fix instructions for each finding. Address the highest-severity findings first, then rescan to confirm they are resolved.

Common fixes:

• Remove hardcoded credentials (opena2a protect)
• Add a SOUL.md governance file (hackmyagent harden-soul)
• Pin dependency versions and audit for known vulnerabilities
• Declare capabilities explicitly in your MCP server configuration

Step 4: Monitor over time

The score can change as the data the registry holds for the package changes. This CI step fails when the score is below a floor you choose:

- name: Check trust score
  run: |
    npx opena2a-cli trust --ci --json > trust.json
    SCORE=$(jq '.trustScore' trust.json)
    echo "Trust score: $SCORE"
    # Fail if trustScore (between 0 and 1) is below your floor; 0.6 is an example
    jq -e '.trustScore >= 0.6' trust.json

Related