opena2a-org/OpenA2A Trust Gate
Check AI package dependencies against the OpenA2A Registry trust API and verify AI agent identity status in PRs.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| min-trust-level | Minimum trust level required (0-4 scale: 0=Blocked, 1=Warning, 2=Listed, 3=Scanned, 4=Verified) | no | 3 |
| fail-on-warning | Whether to fail the check when warning-level packages are found | no | true |
| registry-url | OpenA2A Registry API URL | no | https://api.oa2a.org |
| package-file | Path to dependency file (auto-detected if not specified) | no | "" |
| check-aim | Whether to check AIM agent identity status | no | true |
| post-comment | Post results as a PR comment (requires GITHUB_TOKEN) | no | true |
Outputs
| name | description |
|---|---|
| result | JSON summary of trust gate findings |
| safe-count | Number of packages at or above the minimum trust level |
| warning-count | Number of packages below the minimum trust level but not blocked |
| blocked-count | Number of blocked packages (trust level 0) |
| aim-initialized | Whether AIM is initialized in the repository |
| identity-count | Number of registered agent identities |
| has-policy | Whether capability policy exists |
| signature-count | Number of config signatures |
| has-governance | Whether SOUL.md governance file exists |