OpenA2A: CLI · HackMyAgent · Secretless · AIM · Browser Guard · DVAA · Registry (April 2026)

HackMyAgent

183 security checks for AI agents. Find what can go wrong before an attacker does.

Security scanner and red-team toolkit for Claude Code, Cursor, VS Code, and any MCP server setup.

npx hackmyagent secure

That's it. No config files, no setup, no flags needed.

For a full security dashboard covering credentials, config integrity, shadow AI, and more:

npx opena2a-cli review

Website | Security Checks Reference | Use Cases | Demos | OpenA2A CLI

What It Finds

Attack testing -- 115 adversarial payloads across 11 categories (prompt injection, data exfiltration, jailbreak, MCP exploitation, supply chain, memory weaponization, A2A protocol attacks, context window attacks).

Static analysis -- 183 security checks across 35 categories covering credentials, MCP configs, OpenClaw/NemoClaw, Unicode steganography, CVE detection, governance, supply chain, memory poisoning, agent identity, and sandbox escape patterns.

183 checks across 35 categories. 115 attack payloads. No flags needed.

Quick Start

# Run without installing
npx hackmyagent secure

# Install globally
npm install -g hackmyagent

# Or add to your project
npm install --save-dev hackmyagent

Requirements: Node.js 18+

┌──────────────────────────────────────────┐
│  HackMyAgent v0.11.5 — Security Scanner          │
│  Found: 3 critical · 5 high · 12 medium          │
│                                                  │
│  CRED-001  critical  Hardcoded API key in .env   │
│  MCP-003   high      MCP server on 0.0.0.0       │
│  NET-001   high      Open port exposed           │
│  ...                                             │
│                                                  │
│  Run with --fix to auto-remediate 8 issues       │
└──────────────────────────────────────────┘

Use Cases

Step-by-step guides for common workflows:

• Scan my agent -- Run all 183 checks and auto-fix findings (5 min)
• Red-team MCP servers -- Test MCP servers with adversarial payloads (10 min)
• Secure OpenClaw -- OpenClaw-specific checks, CVE detection, ClawHavoc IOC scanning (10 min)
• Secure NemoClaw -- Scan NVIDIA NemoClaw sandbox installations for credential exposure, network misconfig, and sandbox escape vectors (5 min)
• CI/CD pipeline -- GitHub Actions with JSON/SARIF output (5 min)

Built-in Help

hackmyagent --help          # All commands and flags
hackmyagent --version       # Current version
hackmyagent [command] -h    # Help for a specific command
hackmyagent secure --ci     # Non-interactive mode for CI/CD

Commands

hackmyagent secure -- Security Scan

hackmyagent secure                            # scan current directory
hackmyagent secure ./my-project               # scan specific directory
hackmyagent secure --fix                      # auto-fix issues
hackmyagent secure --fix --dry-run            # preview fixes before applying
hackmyagent secure --ignore CRED-001,GIT-002  # skip specific checks
hackmyagent secure --json                     # JSON output for CI/CD
hackmyagent secure --verbose                  # show all checks including passed
hackmyagent secure --publish                  # push results to OpenA2A Registry

hackmyagent attack -- Red Team

Test your AI agent with 115 adversarial payloads across 11 attack categories.

hackmyagent attack --local                                    # local simulation
hackmyagent attack --local --system-prompt "You are helpful"  # with custom system prompt
hackmyagent attack https://api.example.com/v1/chat            # test live endpoint
hackmyagent attack --local --category prompt-injection         # single category
hackmyagent attack --local --intensity aggressive              # full payload suite
hackmyagent attack --local -f sarif -o results.sarif           # SARIF output
hackmyagent attack https://api.example.com --fail-on-vulnerable medium  # CI gate

Only test systems you own or have written authorization to test.

hackmyagent secure -b oasb-1 -- OASB Benchmarks

Run the OASB-1 benchmark -- 46 controls across 10 categories with three maturity levels. OASB-2 adds behavioral governance (scan-soul) for a composite score.

hackmyagent secure -b oasb-1              # L1 baseline (26 controls)
hackmyagent secure -b oasb-1 -l L2        # L2 standard (44 controls)
hackmyagent secure -b oasb-1 --fail-below 70          # CI gate
hackmyagent secure -b oasb-2              # composite: infrastructure + governance

hackmyagent scan-soul -- Behavioral Governance

Scan a SOUL.md against OASB v2 behavioral governance controls -- 8 domains, up to 68 controls.

hackmyagent scan-soul                     # scan current directory
hackmyagent scan-soul --deep              # LLM semantic analysis (requires ANTHROPIC_API_KEY)
hackmyagent scan-soul --fail-below 60     # CI gate

Auto-detects governance file: SOUL.md > system-prompt.md > CLAUDE.md > .cursorrules > agent-config.yaml.

hackmyagent harden-soul -- Generate Governance

Generate a SOUL.md or add missing governance sections. Existing content is preserved.

hackmyagent harden-soul                   # add missing sections
hackmyagent harden-soul --dry-run         # preview without writing

hackmyagent secure-nemoclaw -- NemoClaw Sandbox Scanner

Scan NVIDIA NemoClaw installations for credential exposure, network misconfiguration, blueprint integrity issues, sandbox escape vectors, and inherited OpenClaw vulnerabilities. 28 checks across 6 categories.

hackmyagent secure-nemoclaw                  # scan auto-detected directory
hackmyagent secure-nemoclaw ~/.nemoclaw      # scan specific directory
hackmyagent secure-nemoclaw --json           # JSON output for CI
hackmyagent secure-nemoclaw --verbose        # show all checks including passed

hackmyagent trust -- Package Trust Verification

Check trust levels for AI packages before installing them. Queries the OpenA2A Registry trust graph (launching April 2026).

hackmyagent trust server-filesystem          # MCP shorthand
hackmyagent trust --audit package.json       # audit all dependencies
hackmyagent trust --batch pkg1 pkg2 pkg3     # batch lookup
hackmyagent trust express --json             # JSON output

Uses ai-trust under the hood.

More Commands

Using with opena2a-cli

opena2a-cli is the unified CLI for all OpenA2A security tools. HackMyAgent powers opena2a review, opena2a scan, opena2a protect, opena2a benchmark, and opena2a scan-soul.

npm install -g opena2a-cli
opena2a review    # best place to start

Runtime Protection (ARP)

ARP monitors AI agents during execution with a 3-layer intelligence stack: rule-based pattern matching (40+ patterns), statistical anomaly detection, and LLM-assisted assessment.

opena2a runtime init     # generate config
opena2a runtime start    # start monitoring
opena2a runtime status   # check status

Also supports HTTP reverse proxy mode for inspecting OpenAI API, MCP, and A2A protocol traffic. See npx hackmyagent arp-guard proxy --help.

CI/CD Integration

All commands support --json and --ci flags.

name: Agent Security
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20' }
      - run: npx hackmyagent secure --json > security-report.json
      - run: npx hackmyagent secure -b oasb-1 --fail-below 70

- run: npx hackmyagent attack --local -f sarif -o results.sarif --fail-on-vulnerable medium
- uses: github/codeql-action/upload-sarif@v3
  with: { sarif_file: results.sarif }

#!/bin/sh
# .git/hooks/pre-commit
npx hackmyagent secure --ignore LOG-001,RATE-001

Exit Codes

Programmatic API

import { HardeningScanner, AgentRuntimeProtection, AttackScanner } from 'hackmyagent';

See the Plugin API documentation for writing custom security plugins.

Contributing

Contributions welcome. See CONTRIBUTING.md.

git clone https://github.com/opena2a-org/hackmyagent.git
cd hackmyagent && npm install && npm run build && npm test

License

Apache-2.0

OpenA2A Ecosystem

OpenA2A CLI | Secretless AI | AIM | AI Browser Guard | DVAA