We believe security tools should be transparent about how they handle data. Here is exactly what OpenA2A collects, why, and how you control it.
Summary: OpenA2A is opt-in by default. No telemetry is collected unless you explicitly enable it with opena2a config contribute on. When enabled, only anonymized security scan metadata is shared -- never source code, credentials, or personally identifiable information.
When you opt in to community contributions, the following metadata is collected from each scan:
| Data | Example | Purpose |
|---|---|---|
| Package name | hackmyagent | Identify which tools are scanned |
| Package version | 0.7.2 | Track security across versions |
| Scan severity counts | critical: 0, high: 1 | Build community security profiles |
| Scan status | passed, warnings | Aggregate security health metrics |
| Behavioral metrics | fileCount: 42 | Detect anomalous package behavior |
| Timestamp | 2026-03-01T12:00:00Z | Time-series analysis |
When you run a scan with contributions enabled, the CLI extracts only the metadata listed above and sends it to the OpenA2A Registry. The registry aggregates this data to compute community trust scores. No raw scan data is stored beyond severity counts.
Opt in -- Enable telemetry:
Opt out -- Disable telemetry (this is the default):
Check status -- See current settings:
Data deletion -- Request removal of your contributed data:
Inspect data -- All submitted data is visible in the CLI output:
Every line of code that handles telemetry is open source. You can audit exactly what data is collected:
Questions about data transparency or this policy? Reach out: