open-index/open-npm huggingface dataset:
npm package: @opena2a/aim-core
Description: Lightweight agent identity library — Ed25519 identity, local audit log, capability policy, trust scoring. No server required.
Author: OpenA2A
Latest version: 0.1.2

# @opena2a/aim-core

[![npm version](https://img.shields.io/npm/v/@opena2a/aim-core.svg)](https://www.npmjs.com/package/@opena2a/aim-core)
[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)

Lightweight agent identity library. Ed25519 identity, local audit log, capability policy, and trust scoring. No server required.

Part of the [HackMyAgent](https://github.com/opena2a-org/hackmyagent) security toolkit.

## Install

```bash
npm install @opena2a/aim-core
```

## Quick Start

```typescript
import { AIMCore } from '@opena2a/aim-core';

// Create or load an agent identity
const aim = new AIMCore({ agentId: 'my-agent' });

// Ed25519 identity (generated and persisted automatically)
const identity = await aim.getOrCreateIdentity();
console.log(identity.publicKey); // base64-encoded Ed25519 public key

// Sign and verify messages
const signature = aim.sign(Buffer.from('hello'));
const valid = aim.verify(Buffer.from('hello'), signature);

// Audit logging
aim.logEvent({ action: 'tool_call', target: 'read_file', details: { path: '/etc/config' } });
const events = aim.readAuditLog({ limit: 10 });

// Capability policy
aim.savePolicy({
  rules: [
    { capability: 'file:read', allow: true, paths: ['/data/*'] },
    { capability: 'file:write', allow: false },
  ]
});
const allowed = aim.checkCapability('file:read', { path: '/data/report.csv' });

// Trust scoring
const trust = aim.calculateTrust();
console.log(trust.score);   // 0.0 - 1.0
console.log(trust.factors); // { identity, audit, policy, behavior }
```

## API

| Function | Description |
|----------|-------------|
| `createIdentity()` | Generate a new Ed25519 keypair |
| `loadIdentity()` | Load an existing identity from disk |
| `getOrCreateIdentity()` | Load if exists, create if not |
| `sign(data)` | Sign data with the agent's private key |
| `verify(data, signature)` | Verify a signature against the public key |
| `logEvent(event)` | Append an event to the local audit log |
| `readAuditLog(options)` | Read audit log entries |
| `loadPolicy()` | Load capability policy from disk |
| `savePolicy(policy)` | Save capability policy to disk |
| `checkCapability(cap, ctx)` | Check if a capability is allowed |
| `calculateTrust()` | Compute a trust score based on identity, audit, and policy factors |

## License

Apache-2.0
npm package: @opena2a/contribute
Description: Shared community trust data contribution client for OpenA2A tools
Latest version: 0.1.1

# @opena2a/contribute

[![npm version](https://img.shields.io/npm/v/@opena2a/contribute.svg)](https://www.npmjs.com/package/@opena2a/contribute)
[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)

Shared community trust data contribution client for [OpenA2A](https://github.com/opena2a-org/opena2a) tools.

## Install

```bash
npm install @opena2a/contribute
```

## What It Does

When users opt in, OpenA2A tools (HackMyAgent, opena2a-cli, Browser Guard) can contribute anonymized scan results to the [OpenA2A Registry](https://registry.opena2a.org). This package provides the shared client that all tools use to queue and submit that data.

- **Opt-in only** -- no data is sent unless the user explicitly enables contribution
- **Anonymized** -- only aggregate scan summaries are submitted, never source code or secrets
- **Batched** -- events are queued locally and flushed in batches to reduce network calls
- **Consistent** -- all OpenA2A tools use this same client, ensuring uniform data format

## Usage

```typescript
import { contribute } from '@opena2a/contribute';

// Record a scan result (no-op if contribution is disabled)
await contribute.scanResult({
  tool: 'hackmyagent',
  toolVersion: '0.11.12',
  packageName: 'my-mcp-server',
  packageVersion: '1.0.0',
  ecosystem: 'npm',
  totalChecks: 42,
  passed: 38,
  critical: 0,
  high: 1,
  medium: 2,
  low: 1,
  score: 85,
  verdict: 'WARN',
  durationMs: 1200,
});

// Record a detection event
await contribute.detection({
  tool: 'opena2a-cli',
  toolVersion: '0.8.11',
  agentsFound: 3,
  mcpServersFound: 5,
  frameworkTypes: ['claude', 'openai'],
});

// Manually flush queued events
await contribute.flush();
```

## API

| Export | Description |
|--------|------------|
| `contribute.scanResult(params)` | Queue a scan result event |
| `contribute.detection(params)` | Queue a detection event |
| `contribute.flush()` | Submit all queued events to the Registry |
| `isContributeEnabled()` | Check if contribution is enabled |
| `queueEvent(event)` | Low-level: add an event to the local queue |
| `getQueuedEvents()` | Low-level: read queued events |
| `clearQueue()` | Low-level: clear the local queue |
| `shouldFlush()` | Check if the queue has reached the flush threshold |
| `buildBatch(events)` | Build a submission batch from queued events |
| `submitBatch(batch)` | Submit a batch to the Registry API |
| `getContributorToken()` | Get or create an anonymous contributor token |

## Part of OpenA2A

This is an internal package used by [opena2a-cli](https://github.com/opena2a-org/opena2a), [HackMyAgent](https://github.com/opena2a-org/hackmyagent), and other OpenA2A tools. For the CLI, see the [main repository](https://github.com/opena2a-org/opena2a).

## License

Apache-2.0
npm package: @opena2a/credvault-openclaw
Description: Credential protection for OpenClaw bots — encrypted local store, environment variable resolution, per-skill isolation. Credentials never touch the LLM context window.
Author: OpenA2A
Latest version: 0.1.2
Deprecated: Merged into hackmyagent@0.8.0.

# @opena2a/credvault-openclaw

[![npm version](https://img.shields.io/npm/v/@opena2a/credvault-openclaw.svg)](https://www.npmjs.com/package/@opena2a/credvault-openclaw)
[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)

Credential protection plugin for HackMyAgent. Encrypted local secret store, environment variable resolution, and per-skill isolation. Credentials never touch the LLM context window.

Part of the [HackMyAgent](https://github.com/opena2a-org/hackmyagent) security toolkit.

> **Looking for the standalone CLI?** See [`secretless-ai`](https://www.npmjs.com/package/secretless-ai) — one command to keep secrets out of any AI coding tool.

## Install

```bash
npm install @opena2a/credvault-openclaw
```

## Usage

```typescript
import { createPlugin } from '@opena2a/credvault-openclaw';
import { registerPlugin } from '@opena2a/plugin-core';

const plugin = createPlugin();
registerPlugin(plugin);

// Scan for credential issues
const findings = await plugin.scan('/path/to/project');

// Each finding includes:
// - patternName: 'Anthropic API Key', 'AWS Access Key', etc.
// - file: where the credential was found
// - severity: 'critical' or 'high'
// - remediation: how to fix it
```

## What It Does

- Scans project files for hardcoded credentials (API keys, tokens, passwords)
- Provides an encrypted local store for secrets
- Resolves credentials via environment variables at runtime
- Isolates secrets per-skill so plugins only access what they need

## Credential Patterns

Detects Anthropic, OpenAI, AWS, GitHub, Slack, Google, Stripe, SendGrid, Supabase, and Azure credentials.

## Related

- [`secretless-ai`](https://www.npmjs.com/package/secretless-ai) — Standalone CLI for protecting AI coding tools
- [`@opena2a/plugin-core`](https://www.npmjs.com/package/@opena2a/plugin-core) — Plugin interface
- [`hackmyagent`](https://www.npmjs.com/package/hackmyagent) — Full security toolkit

## License

Apache-2.0
npm package: @opena2a/oa2a
Description: OpenA2A Registry trust query CLI
Author: OpenA2A
Latest version: 0.1.0

# oa2a

Command-line tool for querying the [OpenA2A Registry](https://registry.opena2a.org) trust API. Look up trust verdicts, scores, CVE counts, and dependency risk for packages in the registry.

## Install

```bash
npm install -g oa2a
```

Or run directly with npx:

```bash
npx oa2a check @modelcontextprotocol/server-filesystem
```

## Usage

### Check a single package

```bash
oa2a check @modelcontextprotocol/server-filesystem
```

Specify the package type explicitly:

```bash
oa2a check my-agent --type a2a_agent
```

### Audit dependencies from a project file

Parse `package.json` or `requirements.txt` and batch-query all dependencies:

```bash
oa2a audit package.json
oa2a audit requirements.txt
```

Set a minimum trust level threshold (default: 3):

```bash
oa2a audit package.json --min-trust 2
```

### Batch lookup for multiple packages

```bash
oa2a batch express lodash chalk commander
```

Apply the same type to all packages:

```bash
oa2a batch my-server-a my-server-b --type mcp_server
```

### Output options

Get raw JSON output for scripting:

```bash
oa2a check express --json
oa2a audit package.json --json
```

Use a custom registry URL:

```bash
oa2a check express --registry-url http://localhost:8080
```

Disable colored output:

```bash
oa2a check express --no-color
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | All queried packages are safe |
| 1 | One or more packages have warnings, are blocked, or fall below the trust threshold |

## Trust Levels

| Level | Label | Description |
|-------|-------|-------------|
| 0 | Blocked | Package is blocked due to security concerns |
| 1 | Warning | Package has known issues |
| 2 | Listed | Package is listed but not yet scanned |
| 3 | Scanned | Package has been scanned by HackMyAgent |
| 4 | Verified | Package is verified by the publisher |

## Requirements

- Node.js 18 or later

## Development

```bash
git clone https://github.com/opena2a-org/oa2a.git
cd oa2a
npm install
npm run build
```

Run locally without installing globally:

```bash
node dist/index.js check express
```

## License

Apache-2.0
npm package: @opena2a/plugin-core
Description: Shared plugin interface and registry for OpenA2A security plugins. Defines the contract all plugins implement.
Author: OpenA2A
Latest version: 0.1.2
Deprecated: Merged into hackmyagent@0.8.0. Use hackmyagent/plugins instead.

# @opena2a/plugin-core

[![npm version](https://img.shields.io/npm/v/@opena2a/plugin-core.svg)](https://www.npmjs.com/package/@opena2a/plugin-core)
[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)

Shared plugin interface and registry for OpenA2A security plugins. Defines the contract that all HackMyAgent plugins implement.

Part of the [HackMyAgent](https://github.com/opena2a-org/hackmyagent) security toolkit.

## Install

```bash
npm install @opena2a/plugin-core
```

## Usage

### Using existing plugins

```typescript
import { registerPlugin, getPlugin, listPlugins } from '@opena2a/plugin-core';
import { createPlugin as createCredVault } from '@opena2a/credvault-openclaw';
import { createPlugin as createSignCrypt } from '@opena2a/signcrypt-openclaw';

// Register plugins
registerPlugin(createCredVault());
registerPlugin(createSignCrypt());

// List registered plugins
const plugins = listPlugins();
// => [{ id: 'credvault', name: 'CredVault', ... }, { id: 'signcrypt', name: 'SignCrypt', ... }]

// Get a specific plugin
const credvault = getPlugin('credvault');
```

### Writing a plugin

```typescript
import type { OpenA2APlugin, PluginMetadata, Finding } from '@opena2a/plugin-core';

export const metadata: PluginMetadata = {
  id: 'my-plugin',
  name: 'My Plugin',
  version: '0.1.0',
  description: 'Does something useful',
  category: 'security',
};

export class MyPlugin implements OpenA2APlugin {
  metadata = metadata;

  async scan(projectDir: string): Promise<Finding[]> {
    // Return findings
    return [];
  }

  async fix(finding: Finding): Promise<void> {
    // Apply a fix
  }
}
```

## Types

| Type | Description |
|------|-------------|
| `OpenA2APlugin` | Interface all plugins must implement |
| `PluginMetadata` | Plugin name, version, description, category |
| `Finding` | A security issue found during scanning |
| `Severity` | `'critical' \| 'high' \| 'medium' \| 'low' \| 'info'` |
| `Remediation` | A suggested fix for a finding |

## License

Apache-2.0
npm package: @opena2a/shared
Description: Shared types, config schema, and utilities for the OpenA2A platform
Latest version: 0.1.1

# @opena2a/shared

[![npm version](https://img.shields.io/npm/v/@opena2a/shared.svg)](https://www.npmjs.com/package/@opena2a/shared)
[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)

Shared types, config schema, and utilities for the [OpenA2A](https://github.com/opena2a-org/opena2a) platform.

## Install

```bash
npm install @opena2a/shared
```

## What's Inside

This package provides the common foundation used by `opena2a-cli` and other OpenA2A tools:

- **Project config** -- `loadProjectConfig()` reads and validates `.opena2a.yml` / `opena2a.config.json` using Zod schemas
- **User config** -- `loadUserConfig()` / `saveUserConfig()` manage per-user preferences stored in `~/.opena2a/`
- **Scan history** -- `loadScanHistory()` / `appendScanEntry()` track past scan results locally
- **Shared types** -- `AdapterType`, `AdapterResult`, `Finding`, and other interfaces used across adapters

## Usage

```typescript
import {
  loadProjectConfig,
  loadUserConfig,
  saveUserConfig,
  isContributeEnabled,
  loadScanHistory,
  appendScanEntry,
} from '@opena2a/shared';

// Load project config from current directory
const config = loadProjectConfig('./');

// Check user preferences
const userConfig = loadUserConfig();
console.log('Contribute enabled:', isContributeEnabled());

// Track scan history
appendScanEntry({
  tool: 'hackmyagent',
  target: 'my-project',
  score: 85,
  timestamp: new Date().toISOString(),
});
```

## API

| Export | Description |
|--------|------------|
| `loadProjectConfig(dir)` | Load and validate project config from a directory |
| `projectConfigSchema` | Zod schema for project configuration |
| `loadUserConfig()` | Load user preferences from `~/.opena2a/` |
| `saveUserConfig(config)` | Persist user preferences |
| `isContributeEnabled()` | Check if anonymous data contribution is enabled |
| `setContributeEnabled(bool)` | Toggle data contribution |
| `loadScanHistory()` | Load local scan history |
| `appendScanEntry(entry)` | Add a scan result to history |
| `getLastScan()` | Get the most recent scan entry |
| `getRecentScans()` | Get recent scan entries |

## Part of OpenA2A

This is an internal package used by [opena2a-cli](https://github.com/opena2a-org/opena2a) and other OpenA2A tools. For the CLI, see the [main repository](https://github.com/opena2a-org/opena2a).

## License

Apache-2.0
npm package: @opena2a/signcrypt-openclaw
Description: Configuration integrity for OpenClaw bots — Ed25519 signing, DNS publisher verification, heartbeat expiry enforcement.
Author: OpenA2A
Latest version: 0.1.2
Deprecated: Merged into hackmyagent@0.8.0.

# @opena2a/signcrypt-openclaw

[![npm version](https://img.shields.io/npm/v/@opena2a/signcrypt-openclaw.svg)](https://www.npmjs.com/package/@opena2a/signcrypt-openclaw)
[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)

Configuration integrity plugin for HackMyAgent. Ed25519 signing, DNS publisher verification, and heartbeat expiry enforcement.

Part of the [HackMyAgent](https://github.com/opena2a-org/hackmyagent) security toolkit.

## Install

```bash
npm install @opena2a/signcrypt-openclaw
```

## Usage

```typescript
import { createPlugin } from '@opena2a/signcrypt-openclaw';
import { registerPlugin } from '@opena2a/plugin-core';

const plugin = createPlugin();
registerPlugin(plugin);

// Scan for configuration integrity issues
const findings = await plugin.scan('/path/to/project');
```

## What It Does

- **Ed25519 signing** — Signs configuration files so tampering is detected
- **DNS publisher verification** — Verifies that plugins and skills come from their claimed publisher via DNS TXT records
- **Heartbeat expiry** — Enforces time-based configuration expiry so stale configs are flagged

## Related

- [`@opena2a/plugin-core`](https://www.npmjs.com/package/@opena2a/plugin-core) — Plugin interface
- [`@opena2a/skillguard-openclaw`](https://www.npmjs.com/package/@opena2a/skillguard-openclaw) — Skill integrity
- [`hackmyagent`](https://www.npmjs.com/package/hackmyagent) — Full security toolkit

## License

Apache-2.0
npm package: @opena2a/skillguard-openclaw
Description: Skill integrity for OpenClaw bots — hash pinning, filesystem watcher, sandbox enforcement, tamper detection.
Author: OpenA2A
Latest version: 0.1.2
Deprecated: Merged into hackmyagent@0.8.0.

# @opena2a/skillguard-openclaw

[![npm version](https://img.shields.io/npm/v/@opena2a/skillguard-openclaw.svg)](https://www.npmjs.com/package/@opena2a/skillguard-openclaw)
[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)

Skill integrity plugin for HackMyAgent. Hash pinning, filesystem watcher, sandbox enforcement, and tamper detection.

Part of the [HackMyAgent](https://github.com/opena2a-org/hackmyagent) security toolkit.

## Install

```bash
npm install @opena2a/skillguard-openclaw
```

## Usage

```typescript
import { createPlugin } from '@opena2a/skillguard-openclaw';
import { registerPlugin } from '@opena2a/plugin-core';

const plugin = createPlugin();
registerPlugin(plugin);

// Scan for skill integrity issues
const findings = await plugin.scan('/path/to/project');
```

## What It Does

- **Hash pinning** — Pins skill files by SHA-256 hash so modifications are detected
- **Filesystem watcher** — Monitors skill directories for unauthorized changes at runtime
- **Sandbox enforcement** — Verifies skills run within their declared capability boundaries
- **Tamper detection** — Alerts when skill files have been modified since last verification

## Related

- [`@opena2a/plugin-core`](https://www.npmjs.com/package/@opena2a/plugin-core) — Plugin interface
- [`@opena2a/signcrypt-openclaw`](https://www.npmjs.com/package/@opena2a/signcrypt-openclaw) — Configuration integrity
- [`hackmyagent`](https://www.npmjs.com/package/hackmyagent) — Full security toolkit

## License

Apache-2.0
npm package: @openaci/http
Description: OpenACI HTTP Library
Author: Luis Farzati
Latest version: 0.2.0


**Application Conversational Interfaces** (ACIs) introduce a new paradigm, in a way comparable to what GraphQL was for RPC or RESTful APIs, but in this case proposing something entirely different to replace the term “API”.

We can enumerate a few radically different points when compared to APIs:

1. ACIs don't have a fixed or pre-established contract, schema, methods or a precise workflow. They are **intent-based** rather than **procedural call-based**.

2. These interfaces put humans as the main consumer, **without making a distinction** whether they are **end-users** or **developers**.

3. With the previous point in mind, **accessibility** is an important aspect of ACIs. Not only for inclusivity but also for convenience. ACIs are **multi-language** and **multi-modal**.

4. As LLMs continue evolving and AI agents perform better at reasoning, they will also qualify as consumers of ACIs. In this sense, we can iterate over the concept and think of a consumer as anybody capable of interacting with these interfaces **using natural language.**

5. Reached this point, LLM-backed clients would interact with ACIs almost autonomously. This would enable a scenario of distributed multi-agentic systems. 

## Quick Start

```bash
npm install @openaci/http zod
```

```tsx
// main.js
import { HttpAci } from '@openaci/http';
import { z } from 'zod';

const app = new HttpAci({ llmName: 'gpt-4o-mini' });

const schema = z.object({
    name: z.string(),
});

app.intent('Convert name to base64', schema, async ({ entities }) => {
    const { name } = entities;

    return Buffer.from(name).toString('base64');
});

app.listen(3000);
```

```bash
node main.js

curl -XPOST http://localhost:3000 -d "How does my name look like in base64? It's John"
Your name "John" in base64 is: Sm9obg==

curl -XPOST http://localhost:3000 -d "Write a JSON document with `code: {base64 of 'OpenACI'}`"
{"code":"T3BlbkFDSQ=="}

curl -XPOST http://localhost:3000 -d "Show me an ascii table with the base64 representation of these names: John Connor, Sarah Connor, Kyle Reese"
| Name          | Base64                |
|---------------|-----------------------|
| John Connor   | Sm9obiBDb25ub3I=     |
| Sarah Connor  | U2FyYWggQ29ubm9y     |
| Kyle Reese    | S3lsZSBSZWVzZQ==     |
```