Getting started
Find the right tool for what you need to do.
Start here: Run review to get a full security report, then follow the recommendations.
npx opena2a-cli review
"I want to scan a project for security issues"
Start with the CLI. It runs a security assessment and gives you a trust score.
npx opena2a-cli init"I want to check the trust score of an AI agent or MCP server"
Use trust to look up the trust profile, security posture, and supply chain data for any package.
opena2a trust @anthropic/mcp-server-fetch"I want to claim my agent and improve its trust score"
Use claim to verify your publisher identity and link it to your trust profile.
opena2a claim"I want to find vulnerabilities in my AI agent"
Use HackMyAgent for 310 static + 29 semantic + 164 adversarial checks and attack simulation.
opena2a scan --attack"I have hardcoded API keys in my code"
Use protect to detect and migrate credentials to a secure vault.
opena2a protect"I want to prevent AI tools from leaking my credentials"
Use Secretless to block credential access in LLM contexts.
npx secretless-ai init"I want to monitor my agents at runtime"
Use ARP (Agent Runtime Protection) for process, network, and filesystem monitoring.
opena2a runtime start"I want to manage agent identities and trust"
Use AIM for Ed25519 identity, trust scoring, MCP security, and ABOM.
docker compose up -d"I want to benchmark my agent against a standard"
Use OASB for 222 standardized attack scenarios and compliance scoring.
opena2a benchmark"I want to learn AI agent security hands-on"
Use DVAA - an intentionally vulnerable agent you can practice attacking.
docker run -p 3000:3000 opena2a/dvaa"I want to detect AI agents in the browser"
Use BrowserGuard - a Chrome extension with 4-layer detection.
BrowserGuard docsTools at a glance
| Tool | Purpose | Install |
|---|---|---|
| OpenA2A CLI | Unified security CLI | npm i -g opena2a-cli |
| HackMyAgent | Security testing and attack simulation | npm i -g hackmyagent |
| Secretless AI | Keep secrets out of AI tools | npm i -g secretless-ai |
| AIM | Agent identity and governance | pip install aim-sdk |
| OASB | Attack-scenario benchmark for agent security tools | Tool page |
| Runtime Protection | Process, network, and filesystem monitoring for running agents | npm i -g arp-guard |
| AI Browser Guard | Detect and monitor browser AI agents | Tool page |
| DVAA | Deliberately vulnerable AI agent for security training | Tool page |
| ai-trust | Trust verification for AI packages | npm i -g ai-trust |
| aicomply | PII and credential checks for agent I/O | Tool page |
Install commands are shown only for packages on npm or PyPI as of 2026-08-26; other tools link to their page.