piiiico/a2a-trust-audit-action

A2A Trust Audit is a GitHub Action that audits A2A agent cards across four trust layers (L1 Identity, L2 Authentication, L3 Authorization, L4 Behavioral Trust) on every PR or push. Intended for maintainers and CI pipelines of A2A agents (e.g., AgentLair users), it runs 22 weighted checks (identity, DID, signed card, JWKS, x402/mTLS, capabilities, attestation, audit trail, etc.), computes per-layer scores, an overall numeric score and A–F grade, and emits workflow outputs (`grade`, `score`, `l1`–`l4`). Key features: in-place PR comment and job summary, configurable fail-on threshold, live README badge, self-contained vendored audit logic (no npm install), and read-only probing of well-known card endpoints. MIT licensed.