opena2a claim

Claim ownership of your agent's trust profile to verify your identity and improve its trust score.

Usage

opena2a claim [package] [options]

Description

AI agents and MCP servers are automatically discovered from public package indexes (npm, PyPI, GitHub). Their trust profiles start at the discovered level with a baseline score. Claiming a profile proves you are the publisher and upgrades the trust level to claimed.

The claim process verifies your identity through your npm or GitHub credentials, generates an Ed25519 (a modern digital signature algorithm) keypair for signing, and links your publisher identity to the trust profile. When run without arguments, the command reads package.json orpyproject.toml in the current directory.

What Happens During a Claim

Verifies you are a published maintainer of the package (npm whoami, GitHub API)
Generates an Ed25519 keypair stored in ~/.opena2a/keys/
Signs a claim attestation linking your identity to the package
Upgrades the trust level from discovered to claimed

Flags

Flag	Description
`--source <npm\|pypi\|github>`	Package source. Auto-detected from package name if omitted.
`--json`	Output as JSON.
`--dry-run`	Preview the claim without submitting.
`--registry-url <url>`	Override the trust profile endpoint.
`--ci`	CI mode with deterministic output.
`--verbose`	Show detailed verification steps.

Examples

# Claim current project

opena2a claim

# Claim a specific npm package

opena2a claim @my-org/my-agent

# Claim a PyPI package

opena2a claim my-agent --source pypi

# Preview without submitting

opena2a claim --dry-run --verbose

Example Output

  Claiming @my-org/my-agent (npm)

  Verification
    npm whoami          @my-org-admin
    Package maintainer  confirmed

  Keypair
    Generated Ed25519 keypair
    Public key stored   ~/.opena2a/keys/my-org__my-agent.pub
    Private key stored  ~/.opena2a/keys/my-org__my-agent.key

  Trust Profile Updated
    Previous level      discovered
    New level           claimed
    Trust score         34 -> 51  (+17)

  Next Steps
    Run security scans to improve your score:
      hackmyagent scan . --publish
    Add a trust badge to your README:
      opena2a trust @my-org/my-agent --badge

Your private key is stored locally at ~/.opena2a/keys/ and never transmitted. Only the public key and signed attestation are published to the trust profile.

After Claiming

Once you have claimed your profile, the following actions will further improve your trust score:

Run hackmyagent scan . --publish to publish security scan results
Fix findings reported by the scan and re-run to show improvement
Add a trust badge to your README (see Trust Badges guide)
Run opena2a trust periodically to check your current score

trust scan Improving Your Trust Score Trust Badges