Agent Card security posture
Grade an A2A agent's security posture in one read.
a2a-audit fetches an agent's /.well-known/agent-card.json, checks it against the OWASP Top 10 for Agentic Applications (ASI 2026), and returns a single transparent score and letter grade. Conformance tools tell you if a card is valid; this tells you if it is safe to trust.
Synthetic example cards (clean, unsigned, plaintext, injected skill, over-exposed, v1.0): click to audit instantly.
Pick a pre-tested card, then click "Show pre-computed score" for a result pre-computed on-device with the full DeBERTa classifier. Pasting your own and clicking "Audit card" runs the heuristic gate live in your browser. Nothing is uploaded. Note: the browser demo only uses the heuristic gate; download and install the full version to run the classifiers.
Pick a pre-tested URL, then click "Show pre-computed score" for an on-device full-classifier result (no live fetch). Entering your own and clicking "Fetch & audit" attempts a live browser fetch (often blocked by CORS); if it fails, use Paste or the CLI.
How a2a-audit works
In plain terms: every AI agent publishes a small public file called an Agent Card, like a business card, that says where it lives, how to connect to it, and what it can do. a2a-audit reads that card and grades how safely the agent is set up. You get one letter grade from A to F and the exact weaknesses behind it. Think of it as a credit score for an AI agent's security.
What it does
It scores an agent's public Agent Card against a recognized security checklist for AI agents (the OWASP Top 10 for Agentic Applications). It needs no access to the agent and sends it nothing. It only reads what the agent already publishes. The output is one grade plus a ranked list of issues, each with a plain-language fix.
When to use it
Three moments. Before you connect your business to an outside agent, as vendor due diligence. Before you launch your own agent, as a pre-ship check. And on every release, as an automatic gate that blocks the launch when the security grade drops.
Why it is needed
AI agents now connect to each other on their own, with no human in the loop. In a scan of 114 live agents, every one lacked a tamper-proof signature and more than three quarters required no login. An outsider could impersonate an agent or hide instructions inside it. a2a-audit turns that hidden risk into one number a non-specialist can act on.
Valid is not the same as safe. Other A2A tools check whether an agent's card is correctly formatted and works (conformance), or list individual issues. a2a-audit answers a different question: how safe is this agent to trust, as one grade you can compare across agents and enforce in your release pipeline.
| Tool type | Question it answers | Examples |
|---|---|---|
| Conformance check | Is the card valid and does it work? | a2a-inspector, a2a-tck |
| Issue scanner | What individual problems exist? | Cisco a2a-scanner |
| Posture auditor | How safe is it to trust, as one grade? | a2a-audit (this tool) |
Static checks are offline. Only the skill-intent check calls a model, and the model stage runs in the CLI. This demo runs the heuristic gate.
How classification works
The skill-intent check (ASI01) is a two-stage pipeline. This demo runs stage 1 only. The CLI runs both, and the model stage is pluggable.
Stage 1: heuristic gate (this demo + CLI)
A high-recall regex pre-filter over each skill's text. It is tuned to catch anything suspicious, so it over-flags by design. A match means "candidate," not "verdict." On its own it reports findings as unverified.
Stage 2: model verdict (CLI only)
A backend confirms or clears each candidate and sets severity. A confirmed hit is HIGH; a gate hit the model does not confirm stays flagged at MEDIUM for review. The gate hit is never silently dropped (recall-favoring).
Backends (route with --backend)
- deberta: local ProtectAI DeBERTa injection classifier (ONNX, CPU, deterministic). Default when installed.Apache-2.0
- gguf: local Qwen2.5-7B via llama.cpp (Metal). Reasoning + JSON verdict.Apache-2.0
- openai: any OpenAI-compatible server (Ollama, llama-server, vLLM, OpenRouter).route anything
- claude: Anthropic API.cloud
- heuristic: gate only (what this demo runs).no model
Install and run: uv pip install -e ".[deberta]" then a2a-audit <url> --backend deberta. See the repo README for Qwen and routing.
Real-world posture
An aggregate snapshot of - live agent cards from a public registry, audited with a2a-audit. Aggregate only: no individual agent is named or labeled vulnerable (responsible disclosure).
Grade distribution
Mean posture score
Most common findings across the corpus
Source: a2aregistry.org live cards, captured 2026-05-29, canonical re-fetch. Stats aggregate only.