Security Scanner & CI/CD Gating for Agent Cards
Audit your agent-card.json files for security flaws, missing signatures, private IP leaks, and dangerous tool permissions before deploying to production.
║ A2A AGENT CARD SECURITY AUDIT REPORT ║
╚════════════════════════════════════════════════════════════════════════════╝
Agent Name: SupportBot
Skills Audited: 3 | Interfaces: 1
Timestamp: 2026-09-13
Straightforward Pricing
Test locally for free or upgrade to Pro to unlock automated Pull Request gating and full remediation code.
Community Edition
Free forever for local development and manual testing on your laptop.
Pro Developer
For developers and teams shipping production AI agents.
Lifetime License
Pay once, use forever. No recurring monthly subscriptions.
What We Check
Every rule is grounded in the official Linux Foundation and Google Cloud Agent2Agent specification.
Unsigned Agent Card
Missing cryptographic signatures. Makes it easy for bad actors to impersonate your agent.
Insecure Signatures & Key Spoofing
Uses weak symmetric keys (HS256) or points to an untrusted external key server.
Cleartext HTTP Endpoints
Interfaces or auth URLs using unencrypted http:// instead of secure https://.
Private Network & SSRF Leaks
Endpoints pointing to localhost, private internal IPs, or cloud metadata (169.254.169.254).
Prompt Injections in Metadata
Hidden system prompt overrides or invisible zero-width Unicode characters in descriptions.
Unauthenticated Dangerous Tools
High-privilege actions (shell commands, database queries, payments) without login requirements.
Deprecated OAuth Login Flows
Uses legacy password or implicit flows that are officially deprecated in the A2A spec.
API Keys Exposed in URLs
API keys passed via query parameters, leaking secrets into browser history and server logs.
Unauthenticated Extended Capabilities
Enabling extended card features without declaring authentication requirements.
Missing Required Specification Fields
Missing core fields required by the standard: name, description, supported interfaces, or skills.
How to Use Your License Key
Activate in seconds using whichever method fits your workflow best.
CLI Flag
Pass directly in your terminal command.
Environment Variable
Set once in your shell or .env file.
GitHub Actions Secret
Save in repository secrets for automated PR gating.
Frequently Asked Questions
How do I receive my license key?
Your license key is generated immediately upon successful checkout and sent to your PayPal email address.
Does a2a-audit send our code or data to external servers?
No. a2a-audit runs 100% locally on your machine or CI/CD runner. It never uploads your files or agent cards anywhere. License key validation happens entirely offline using built-in public-key cryptography.
Can I use this on private repositories?
Yes. Both the Pro and Lifetime licenses authorize your organization to scan all of your public and private repositories.
What is an Agent Card?
An Agent Card (agent-card.json) is the identity and capabilities file defined by the Linux Foundation and Google Cloud A2A specification. It tells multi-agent systems who an agent is and what skills it can perform.