Verify Trust Before You Install

Query OpenA2A community trust data for security scans, dependency risk, community consensus, and known advisories on any AI package.

View on GitHubAIM Documentation
terminal
$ npx ai-trust check server-filesystem
  Resolved: server-filesystem -> @modelcontextprotocol/server-filesystem

  ai-trust v0.2.20

  @modelcontextprotocol/server-filesystem
  ---------------------------------------------
  Trust Level    4 -- Verified
  Publisher      Anthropic
  Last Scanned   2026-03-12
  Advisories     None
  Dependencies   3 (all scanned)
  ---------------------------------------------
  Verdict: safe to install

Installation

Available via Homebrew, npm, or npx. No configuration required.

terminal
# Homebrew (macOS/Linux)
$ brew install opena2a-org/tap/ai-trust

# npm global install
$ npm install -g ai-trust

# Run directly (no install needed)
$ npx ai-trust check express

Commands

Three commands for single-package lookups, dependency file audits, and batch verification.

ai-trust check

Look up trust information for a single package. If not yet scanned, scan it locally with HMA.

$ ai-trust check server-filesystem

ai-trust audit

Parse dependency files (.json, .txt) and batch-query all dependencies

$ ai-trust audit package.json --min-trust 3

ai-trust batch

Look up trust verdicts for multiple packages at once, with optional type filtering

$ ai-trust batch express lodash chalk --min-trust 2

Trust Levels

OpenA2A assigns one of five trust levels to each package based on scan results, publisher verification, and community consensus.

0
Blocked
Package is blocked due to security concerns
1
Warning
Package has known issues or advisories
2
Listed
Package is listed but not yet scanned
3
Scanned
Package has been scanned by HackMyAgent
4
Verified
Package is verified by the publisher

Scan on Demand

Package not yet scanned? ai-trust downloads it and runs a HackMyAgent security scan locally. Results are shown immediately and can be contributed as anonymized telemetry to grow the community trust graph.

terminal
# Scan a package not yet in the database
$ ai-trust check mcp-server-xyz --scan-if-missing

# Scan and contribute results to the community
$ ai-trust check mcp-server-xyz --scan-if-missing --contribute

# Force re-scan even if existing data exists
$ ai-trust check server-filesystem --rescan

# Scan missing deps in a dependency audit
$ ai-trust audit package.json --scan-missing --contribute

Community Contribution

Share anonymized scan findings with the OpenA2A community to help identify unsafe packages. No personal data, no source code -- only check pass/fail results and severity. Your choice is saved and shared across all OpenA2A tools.

Opt-in prompt

On your first scan, ai-trust asks once. Your choice is saved to ~/.opena2a/config.json.

Privacy-first

Only check IDs, pass/fail, and severity are sent. No file paths, descriptions, fix text, or code.

Shared config

Opt-in carries across opena2a-cli, hackmyagent, and ai-trust. Configure once, contribute from any tool.

terminal
# Contribute scan results (non-interactive / CI)
$ ai-trust check chalk --rescan --contribute

# Configure globally
$ opena2a config set contribute true    # opt in
$ opena2a config set contribute false   # opt out

CI/CD Integration

All commands support --json output. Non-zero exit codes when packages are blocked or below the trust threshold.

.github/workflows/trust-gate.yml
- name: Verify AI package trust
  run: npx ai-trust audit package.json --min-trust 3 --json

- name: Check and scan if missing
  run: npx ai-trust check @org/mcp-server --scan-if-missing --json

- name: Audit with local scanning for unknown deps
  run: npx ai-trust audit package.json --scan-missing --contribute

Part of the OpenA2A Ecosystem

ai-trust queries community trust data and can also scan locally with HackMyAgent, contributing results back to grow the community trust graph.

HackMyAgent scans

Populates the trust database with scan results

ai-trust queries

Checks trust before installation

Trust database stores

Trust graph for all AI packages

Check trust in one command

npx ai-trust check server-filesystem
GitHubAll Tools