A2a Auditor MCP server

by 4hmetuyar·io.github.4hmetuyar/a2a-auditor·v0.1.1·1 stars

Scans Agent2Agent (A2A) protocol code for webhook SSRF, missing auth, and credential exposure

A86/100grade A

What users say

No reviews yet

Safety scan

A86/100

Adoption

Growing

1 stars305 downloads/wk

Reviews

Nobody has reviewed A2a Auditor yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

list_patterns
List every A2A (Agent2Agent) protocol pattern this auditor detects, grouped by category
scan_directory
Recursively scan a directory of A2A agent source for protocol anti-patterns
scan_file
Scan a single file for A2A (Agent2Agent) protocol anti-patterns
scan_text
Scan Agent2Agent (A2A) protocol implementation code for anti-patterns found in the reference SDKs and sample agents: an Agent Card fetching a client-supplied push-notification webhook URL with no host allowlist (SSRF), a request handler wired up with no authentication at all, and a literal credential embedded directly in Agent Card metadata (which is served publicly).

scanner v0.1.10 · 2026-10-01 · same rubric, same numbers if you re-run it

no findings

Code scan15 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 0 days ago15/15
Maintainer identitynamespace and repository owner differ4/10

Overall 86/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

Runs npx -y @guardbee/mcp-a2a-auditor on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add a2a-auditor -- npx -y @guardbee/mcp-a2a-auditor

From the A2a Auditor repository's README, as published. We do not edit it. Read it on GitHub

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文

guardbee.ai — AI Security Copilot for websites.

GuardBee's family of MCP (Model Context Protocol) servers — a single monorepo, independent npm packages.

Nothing above is checked by us. What we check is on the safety report.

Is A2a Auditor MCP server safe?: Yes, by our scan: it is graded A (86/100). Read the A2a Auditor safety report
How do I install A2a Auditor?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does A2a Auditor need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is A2a Auditor maintained?: The last commit was 12 days ago (2026-10-01). The latest release is v0.1.1.
What can I use instead of A2a Auditor?: Servers from other publishers that do the same job: Oauth Auditor MCP server, Auth Token Service MCP server and PyMemoryEditor MCP server. Compare all A2a Auditor alternatives.

Same job from other publishers: the closest match first, then the best rated.

Oauth Auditor
Scans MCP server auth code for OAuth 2.1 anti-patterns: token passthrough, missing audience
More from GuardBee →
not reviewed
Growing
A
Auth Token Service
Hash passwords with bcrypt and issue/verify JWT session tokens over A2A + MCP.
not reviewed
Growing
A
PyMemoryEditor
Read, write and scan process memory, Cheat Engine style, on Windows, Linux and macOS.
not reviewed
Established
A
Rede
MCP server for Rede — Itaú-owned BR acquirer: authorize/capture/refund, zero-auth, card tokens
not reviewed
Established
B
Autopilot Jobhunt
Agentic job hunt: scan careers pages, score against your resume, draft applications. Never applies.
not reviewed
Growing
A