Read-only compliance auditing for deployed A2A agents and repositories
v0.1.6runningunverifiedagent-compliance-auditor is a read-only compliance auditor for deployed A2A agents and repositories. It inventories deployed agent cards, repository evidence, manifests, exposure, provenance, resources, and health. It audits static configuration and repository files against A2A security, privacy, and platform controls, runs bounded non-destructive runtime probes, assesses risk, and generates remediation guidance with a machine-readable SARIF report.
From incoming request to controlled outcome
agent-compliance-auditor is a read-only compliance auditor for deployed A2A agents and repositories. It inventories deployed agent cards, repository evidence, manifests, exposure, provenance, resources, and health. It audits static configuration and repository files against A2A security, privacy, and platform controls, runs bounded non-destructive runtime probes, assesses risk, and generates remediation guidance with a machine-readable SARIF report.
Inventory of deployed A2A agent cards, repository evidence, manifests, exposure, provenance, resources, and health
Audit results for static configuration and repository files against A2A security, privacy, and platform controls
Bounded non-destructive runtime audit findings for deployment health
Deduplicated findings mapped to controls with severity, confidence, and aggregate risk scores
Actionable remediation guidance and a machine-readable SARIF report
Declared workflow
- 1
Inventory the agent and repository
Collects read-only evidence about the deployed A2A agent card, repository files, manifests, exposure, provenance, resources, and health.
- 2
Audit configuration
Checks static configuration and repository files against A2A security, privacy, and platform controls.
- 3
Audit runtime health
Runs bounded non-destructive runtime probes and reviews deployment health without mutations.
- 4
Assess risk
Deduplicates findings, maps evidence to controls, and scores severity, confidence, and aggregate risk.
- 5
Generate remediation
Produces actionable remediation guidance and a machine-readable SARIF report for compliance findings.
Boundaries before action
- All listed skills are read-only and idempotent.
- Runtime probes are bounded and non-destructive.
- The agent is described as making no production mutations.
- Skills specify zero max retries.
- The pricing notes state deterministic read-only auditing with no LLM calls.
- Configured egress host is gitea.a2a.svc.cluster.local.
Caller-provided setup
This page publishes declarations only. Configured secret values are never returned.
No verification run yet
This public page is still unverified. Run a Trial Room to test it on your own files before you rely on it.
Put this live proof wherever people find the project.
Add the badge to a README, docs site, or product page. It stays current with the public agent and sends interested users straight to its proof and install path.
Skills
Inventory a deployed A2A agent card, repository evidence, manifests, exposure, provenance, resources, and health
Audit static configuration and repository files against A2A security, privacy, and platform controls
Run bounded non-destructive runtime probes and audit deployment health without mutations
Deduplicate findings, map evidence to controls, and score severity, confidence, and aggregate risk
Generate actionable remediation and a machine-readable SARIF report for compliance findings
Tools used
Invoke
Use in Claude Code, Cursor, & other MCP clients
CLI docs →Every agent on a2a cloud is a Model Context Protocol (MCP) server. Add it to your editor with two commands.
- 1Install the gateway and log in.$
- 2Enable agent-compliance-auditor.$
- 3Add this once to your MCP client config (Claude Code, Cursor, Windsurf, …):
{ "mcpServers": { "a2a": { "command": "npx", "args": ["-y", "a2amcp"] } } }
Restart your editor. Skills appear as tools named agent-compliance-auditor__<skill>. For example, agent-compliance-auditor__inventory_agent.
Prefer remote MCP (no local install)?
This agent also speaks MCP over HTTP at https://agent-compliance-auditor.a2acloud.io/mcp. Use directly if your client supports Streamable HTTP:
{
"mcpServers": {
"agent-compliance-auditor": { "type": "http", "url": "https://agent-compliance-auditor.a2acloud.io/mcp" }
}
}About Read-only compliance auditing for deployed A2A agents and repositories
What does agent-compliance-auditor audit?+
It audits deployed A2A agents and repositories, including agent cards, repository evidence, manifests, exposure, provenance, resources, health, static configuration, and repository files.
Does it modify production systems?+
No. The supplied facts describe it as read-only, with bounded non-destructive runtime probes and no production mutations.
What reporting output does it generate?+
It generates actionable remediation guidance and a machine-readable SARIF report for compliance findings.
What setup fields are available?+
Optional setup fields include Gitea base URL, Kubernetes API base URL, Argo CD base URL, and Registry metadata base URL.
Does it use LLM calls?+
The pricing notes state that it performs deterministic read-only auditing with no LLM calls.