A2a Auditor

What the a2a-auditor MCP server does

The a2a-auditor MCP server examines source code for Agent2Agent (A2A) protocol implementations written in TypeScript or Python. Its checks are based on anti-patterns identified in the source of reference A2A SDKs, rather than being a general-purpose code scanner.

The review focuses on three areas:

• Push-notification webhook handling that fetches a URL without authentication, creating a potential server-side request forgery (SSRF) issue.
• Agent Cards that do not declare an authentication requirement.
• Credentials included in Agent Card metadata that is served publicly.

This scope is suited to teams building or reviewing A2A agents, especially where agents accept push-notification configuration or publish Agent Cards for discovery.

How it works

The a2a-auditor MCP server is exposed through the Model Context Protocol, allowing an MCP-compatible AI client to invoke its code-auditing capability. The target is an agent's A2A implementation, and the supported implementation languages identified by the project are TypeScript and Python.

The scanner uses patterns associated with the A2A reference SDKs to identify potentially unsafe implementation choices. Its checks cover both request behavior, such as webhook URL fetching, and metadata behavior, such as authentication declarations and credential placement in Agent Cards.

The results should be treated as targeted findings for the listed A2A risks. The supplied project material does not describe the result schema, severity model, remediation output, or whether the scanner executes the target code.

Tools and capabilities

The a2a-auditor MCP server provides capabilities for:

• Scanning TypeScript A2A implementation code.
• Scanning Python A2A implementation code.
• Detecting unauthenticated push-notification webhook fetches associated with SSRF.
• Checking whether Agent Cards require authentication.
• Finding credentials embedded in publicly served Agent Card metadata.
• Reviewing code against anti-patterns found in reference A2A SDK sources.

Limitations and notes

The documented scope is limited to A2A implementation anti-patterns. It does not establish coverage for general dependency vulnerabilities, arbitrary secret scanning, all SSRF variants, or broader application security issues.

The project material names TypeScript and Python as supported languages. It does not document support for other languages, specific A2A framework versions, configuration options, environment variables, transport details, installation commands, or MCP client-specific setup. Confirm those details in the package documentation before integrating it into an automated review workflow.