ai-trust 0.1.0

package/README.md

@@ -0,0 +1,117 @@
+# oa2a
+
+Command-line tool for querying the [OpenA2A Registry](https://registry.opena2a.org) trust API. Look up trust verdicts, scores, CVE counts, and dependency risk for packages in the registry.
+
+## Install
+
+```bash
+npm install -g oa2a
+```
+
+Or run directly with npx:
+
+```bash
+npx oa2a check @modelcontextprotocol/server-filesystem
+```
+
+## Usage
+
+### Check a single package
+
+```bash
+oa2a check @modelcontextprotocol/server-filesystem
+```
+
+Specify the package type explicitly:
+
+```bash
+oa2a check my-agent --type a2a_agent
+```
+
+### Audit dependencies from a project file
+
+Parse `package.json` or `requirements.txt` and batch-query all dependencies:
+
+```bash
+oa2a audit package.json
+oa2a audit requirements.txt
+```
+
+Set a minimum trust level threshold (default: 3):
+
+```bash
+oa2a audit package.json --min-trust 2
+```
+
+### Batch lookup for multiple packages
+
+```bash
+oa2a batch express lodash chalk commander
+```
+
+Apply the same type to all packages:
+
+```bash
+oa2a batch my-server-a my-server-b --type mcp_server
+```
+
+### Output options
+
+Get raw JSON output for scripting:
+
+```bash
+oa2a check express --json
+oa2a audit package.json --json
+```
+
+Use a custom registry URL:
+
+```bash
+oa2a check express --registry-url http://localhost:8080
+```
+
+Disable colored output:
+
+```bash
+oa2a check express --no-color
+```
+
+## Exit Codes
+
+| Code | Meaning |
+|------|---------|
+| 0 | All queried packages are safe |
+| 1 | One or more packages have warnings, are blocked, or fall below the trust threshold |
+
+## Trust Levels
+
+| Level | Label | Description |
+|-------|-------|-------------|
+| 0 | Blocked | Package is blocked due to security concerns |
+| 1 | Warning | Package has known issues |
+| 2 | Listed | Package is listed but not yet scanned |
+| 3 | Scanned | Package has been scanned by HackMyAgent |
+| 4 | Verified | Package is verified by the publisher |
+
+## Requirements
+
+- Node.js 18 or later
+
+## Development
+
+```bash
+git clone https://github.com/opena2a-org/oa2a.git
+cd oa2a
+npm install
+npm run build
+```
+
+Run locally without installing globally:
+
+```bash
+node dist/index.js check express
+```
+
+## License
+
+Apache-2.0

package/dist/api/client.d.ts

@@ -0,0 +1,52 @@
+/**
+ * API client for the OpenA2A Registry trust query endpoints.
+ */
+export interface TrustAnswer {
+    name: string;
+    type: string;
+    found: boolean;
+    verdict: string;
+    trustLevel: number;
+    trustScore: number;
+    cveCount: number;
+    recommendation: string;
+    profile?: SecurityProfile;
+    dependencies?: DependencyInfo;
+}
+export interface SecurityProfile {
+    id: string;
+    packageId: string;
+    version: string;
+    trustFactors: Record<string, unknown>;
+    riskIndicators: string[];
+    createdAt: string;
+}
+export interface DependencyInfo {
+    direct: number;
+    transitive: number;
+    maxDepth: number;
+    riskSummary: {
+        blocked: number;
+        warning: number;
+        safe: number;
+    };
+}
+export interface BatchResponse {
+    results: TrustAnswer[];
+    meta: {
+        total: number;
+        found: number;
+        notFound: number;
+    };
+}
+export interface PackageQuery {
+    name: string;
+    type?: string;
+}
+export declare class RegistryClient {
+    private baseUrl;
+    constructor(registryUrl: string);
+    checkTrust(name: string, type?: string): Promise<TrustAnswer>;
+    batchQuery(packages: PackageQuery[]): Promise<BatchResponse>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/api/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,YAAY,CAAC,EAAE,cAAc,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,IAAI,EAAE;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAS;gBAEZ,WAAW,EAAE,MAAM;IAIzB,UAAU,CACd,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,WAAW,CAAC;IA8BjB,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;CAqBnE"}

package/dist/api/client.js

@@ -0,0 +1,50 @@
+/**
+ * API client for the OpenA2A Registry trust query endpoints.
+ */
+export class RegistryClient {
+    baseUrl;
+    constructor(registryUrl) {
+        this.baseUrl = registryUrl.replace(/\/+$/, "");
+    }
+    async checkTrust(name, type) {
+        const params = new URLSearchParams({
+            name,
+            includeProfile: "true",
+            includeDeps: "true",
+        });
+        if (type) {
+            params.set("type", type);
+        }
+        const url = `${this.baseUrl}/api/v1/trust/query?${params.toString()}`;
+        const response = await fetch(url, {
+            method: "GET",
+            headers: {
+                "Accept": "application/json",
+                "User-Agent": "oa2a-cli/0.1.0",
+            },
+        });
+        if (!response.ok) {
+            const body = await response.text();
+            throw new Error(`Registry API returned ${response.status}: ${body}`);
+        }
+        return (await response.json());
+    }
+    async batchQuery(packages) {
+        const url = `${this.baseUrl}/api/v1/trust/batch`;
+        const response = await fetch(url, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "Accept": "application/json",
+                "User-Agent": "oa2a-cli/0.1.0",
+            },
+            body: JSON.stringify({ packages }),
+        });
+        if (!response.ok) {
+            const body = await response.text();
+            throw new Error(`Registry API returned ${response.status}: ${body}`);
+        }
+        return (await response.json());
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/api/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAiDH,MAAM,OAAO,cAAc;IACjB,OAAO,CAAS;IAExB,YAAY,WAAmB;QAC7B,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,UAAU,CACd,IAAY,EACZ,IAAa;QAEb,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,IAAI;YACJ,cAAc,EAAE,MAAM;YACtB,WAAW,EAAE,MAAM;SACpB,CAAC,CAAC;QAEH,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,uBAAuB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,QAAQ,EAAE,kBAAkB;gBAC5B,YAAY,EAAE,gBAAgB;aAC/B;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,CACpD,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgB,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAwB;QACvC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,qBAAqB,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,QAAQ,EAAE,kBAAkB;gBAC5B,YAAY,EAAE,gBAAgB;aAC/B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,CACpD,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;IAClD,CAAC;CACF"}

package/dist/commands/audit.d.ts

@@ -0,0 +1,6 @@
+/**
+ * oa2a audit - Parse dependency files and batch query trust.
+ */
+import type { Command } from "commander";
+export declare function registerAuditCommand(program: Command): void;
+//# sourceMappingURL=audit.d.ts.map

package/dist/commands/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/commands/audit.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA8D3D"}

package/dist/commands/audit.js

@@ -0,0 +1,52 @@
+/**
+ * oa2a audit - Parse dependency files and batch query trust.
+ */
+import { RegistryClient } from "../api/client.js";
+import { parseDependencyFile } from "../utils/parser.js";
+import { formatBatchResults, formatJson } from "../output/formatter.js";
+export function registerAuditCommand(program) {
+    program
+        .command("audit <file>")
+        .description("Audit dependencies from package.json or requirements.txt")
+        .option("--min-trust <level>", "minimum trust level threshold", "3")
+        .action(async (file, opts) => {
+        const globalOpts = program.opts();
+        const minTrust = parseInt(opts.minTrust, 10);
+        if (isNaN(minTrust) || minTrust < 0 || minTrust > 4) {
+            console.error("Error: --min-trust must be a number between 0 and 4");
+            process.exitCode = 1;
+            return;
+        }
+        try {
+            const packages = await parseDependencyFile(file);
+            if (packages.length === 0) {
+                console.log("No dependencies found in the specified file.");
+                return;
+            }
+            if (packages.length > 100) {
+                console.error(`Error: Too many dependencies (${packages.length}). The batch API supports a maximum of 100 packages per request.`);
+                process.exitCode = 1;
+                return;
+            }
+            const client = new RegistryClient(globalOpts.registryUrl);
+            const response = await client.batchQuery(packages);
+            if (globalOpts.json) {
+                console.log(formatJson(response));
+            }
+            else {
+                console.log(formatBatchResults(response, minTrust));
+            }
+            // Exit code 1 if any package is below threshold
+            const belowThreshold = response.results.some((r) => r.found && r.trustLevel < minTrust);
+            if (belowThreshold) {
+                process.exitCode = 1;
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`Error: ${message}`);
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=audit.js.map

package/dist/commands/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/commands/audit.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAExE,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CACV,0DAA0D,CAC3D;SACA,MAAM,CACL,qBAAqB,EACrB,+BAA+B,EAC/B,GAAG,CACJ;SACA,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAA0B,EAAE,EAAE;QACzD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAG9B,CAAC;QAEF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACrE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAEjD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAK,CACX,iCAAiC,QAAQ,CAAC,MAAM,kEAAkE,CACnH,CAAC;gBACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAEnD,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;YACtD,CAAC;YAED,gDAAgD;YAChD,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ,CAC1C,CAAC;YACF,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;YACnC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/batch.d.ts

@@ -0,0 +1,6 @@
+/**
+ * oa2a batch - Batch trust lookup for multiple packages.
+ */
+import type { Command } from "commander";
+export declare function registerBatchCommand(program: Command): void;
+//# sourceMappingURL=batch.d.ts.map

package/dist/commands/batch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch.d.ts","sourceRoot":"","sources":["../../src/commands/batch.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmE3D"}

package/dist/commands/batch.js

@@ -0,0 +1,51 @@
+/**
+ * oa2a batch - Batch trust lookup for multiple packages.
+ */
+import { RegistryClient } from "../api/client.js";
+import { formatBatchResults, formatJson } from "../output/formatter.js";
+export function registerBatchCommand(program) {
+    program
+        .command("batch <names...>")
+        .description("Batch trust lookup for multiple packages")
+        .option("-t, --type <type>", "package type to apply to all packages")
+        .option("--min-trust <level>", "minimum trust level threshold", "3")
+        .action(async (names, opts) => {
+        const globalOpts = program.opts();
+        const minTrust = parseInt(opts.minTrust, 10);
+        if (isNaN(minTrust) || minTrust < 0 || minTrust > 4) {
+            console.error("Error: --min-trust must be a number between 0 and 4");
+            process.exitCode = 1;
+            return;
+        }
+        if (names.length > 100) {
+            console.error(`Error: Too many packages (${names.length}). The batch API supports a maximum of 100 packages per request.`);
+            process.exitCode = 1;
+            return;
+        }
+        const packages = names.map((name) => ({
+            name,
+            ...(opts.type ? { type: opts.type } : {}),
+        }));
+        const client = new RegistryClient(globalOpts.registryUrl);
+        try {
+            const response = await client.batchQuery(packages);
+            if (globalOpts.json) {
+                console.log(formatJson(response));
+            }
+            else {
+                console.log(formatBatchResults(response, minTrust));
+            }
+            // Exit code 1 if any package is below threshold
+            const belowThreshold = response.results.some((r) => r.found && r.trustLevel < minTrust);
+            if (belowThreshold) {
+                process.exitCode = 1;
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`Error: ${message}`);
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=batch.js.map

package/dist/commands/batch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch.js","sourceRoot":"","sources":["../../src/commands/batch.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAExE,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,uCAAuC,CAAC;SACpE,MAAM,CACL,qBAAqB,EACrB,+BAA+B,EAC/B,GAAG,CACJ;SACA,MAAM,CACL,KAAK,EACH,KAAe,EACf,IAAyC,EACzC,EAAE;QACF,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAG9B,CAAC;QAEF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,KAAK,CACX,qDAAqD,CACtD,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CACX,6BAA6B,KAAK,CAAC,MAAM,kEAAkE,CAC5G,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAmB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI;YACJ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC,CAAC,CAAC;QAEJ,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAE1D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAEnD,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;YACtD,CAAC;YAED,gDAAgD;YAChD,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ,CAC1C,CAAC;YACF,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;YACnC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CACF,CAAC;AACN,CAAC"}

package/dist/commands/check.d.ts

@@ -0,0 +1,6 @@
+/**
+ * oa2a check - Single package trust lookup.
+ */
+import type { Command } from "commander";
+export declare function registerCheckCommand(program: Command): void;
+//# sourceMappingURL=check.d.ts.map

package/dist/commands/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAgC3D"}

package/dist/commands/check.js

@@ -0,0 +1,34 @@
+/**
+ * oa2a check - Single package trust lookup.
+ */
+import { RegistryClient } from "../api/client.js";
+import { formatCheckResult, formatJson } from "../output/formatter.js";
+export function registerCheckCommand(program) {
+    program
+        .command("check <name>")
+        .description("Look up trust information for a single package")
+        .option("-t, --type <type>", "package type (mcp_server, a2a_agent, ai_tool, etc.)")
+        .action(async (name, opts) => {
+        const globalOpts = program.opts();
+        const client = new RegistryClient(globalOpts.registryUrl);
+        try {
+            const result = await client.checkTrust(name, opts.type);
+            if (globalOpts.json) {
+                console.log(formatJson(result));
+            }
+            else {
+                console.log(formatCheckResult(result));
+            }
+            // Exit code 1 if blocked or warning
+            if (result.found && (result.verdict === "blocked" || result.verdict === "warning")) {
+                process.exitCode = 1;
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`Error: ${message}`);
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=check.js.map

package/dist/commands/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEvE,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,gDAAgD,CAAC;SAC7D,MAAM,CAAC,mBAAmB,EAAE,qDAAqD,CAAC;SAClF,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAuB,EAAE,EAAE;QACtD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAG9B,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAE1D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAExD,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;YACzC,CAAC;YAED,oCAAoC;YACpC,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;gBACnF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;YACnC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+/**
+ * ai-trust - Trust verification CLI for AI packages.
+ *
+ * Check MCP servers, A2A agents, and AI tools before you install.
+ * Powered by the OpenA2A Registry.
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;GAKG"}

package/dist/index.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+/**
+ * ai-trust - Trust verification CLI for AI packages.
+ *
+ * Check MCP servers, A2A agents, and AI tools before you install.
+ * Powered by the OpenA2A Registry.
+ */
+import { Command } from "commander";
+import { registerCheckCommand } from "./commands/check.js";
+import { registerAuditCommand } from "./commands/audit.js";
+import { registerBatchCommand } from "./commands/batch.js";
+const program = new Command();
+program
+    .name("ai-trust")
+    .description("Trust verification CLI for AI packages")
+    .version("0.1.0")
+    .option("--registry-url <url>", "registry base URL", "https://registry.opena2a.org")
+    .option("--json", "output raw JSON", false)
+    .option("--no-color", "disable colored output");
+registerCheckCommand(program);
+registerAuditCommand(program);
+registerBatchCommand(program);
+program.parse();
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,UAAU,CAAC;KAChB,WAAW,CAAC,wCAAwC,CAAC;KACrD,OAAO,CAAC,OAAO,CAAC;KAChB,MAAM,CACL,sBAAsB,EACtB,mBAAmB,EACnB,8BAA8B,CAC/B;KACA,MAAM,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,CAAC;KAC1C,MAAM,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;AAElD,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE9B,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/output/formatter.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Output formatting for trust query results.
+ * Supports colored terminal output and raw JSON.
+ */
+import type { TrustAnswer, BatchResponse } from "../api/client.js";
+export declare function formatCheckResult(answer: TrustAnswer): string;
+export declare function formatBatchResults(response: BatchResponse, minTrust: number): string;
+export declare function formatJson(data: unknown): string;
+//# sourceMappingURL=formatter.d.ts.map

package/dist/output/formatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatter.d.ts","sourceRoot":"","sources":["../../src/output/formatter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAsCnE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CA2C7D;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,MAAM,GACf,MAAM,CA6FR;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAEhD"}

package/dist/output/formatter.js

@@ -0,0 +1,143 @@
+/**
+ * Output formatting for trust query results.
+ * Supports colored terminal output and raw JSON.
+ */
+import chalk from "chalk";
+function verdictColor(verdict) {
+    switch (verdict) {
+        case "safe":
+            return chalk.green;
+        case "warning":
+            return chalk.yellow;
+        case "blocked":
+            return chalk.red;
+        default:
+            return chalk.gray;
+    }
+}
+function trustLevelLabel(level) {
+    switch (level) {
+        case 0:
+            return "Blocked";
+        case 1:
+            return "Warning";
+        case 2:
+            return "Listed";
+        case 3:
+            return "Scanned";
+        case 4:
+            return "Verified";
+        default:
+            return `Unknown (${level})`;
+    }
+}
+function trustLevelColor(level) {
+    if (level >= 3)
+        return chalk.green;
+    if (level >= 1)
+        return chalk.yellow;
+    return chalk.red;
+}
+export function formatCheckResult(answer) {
+    if (!answer.found) {
+        return [
+            "",
+            chalk.bold(`  ${answer.name}`),
+            chalk.gray(`  Type: ${answer.type || "unknown"}`),
+            chalk.gray("  Status: Not found in registry"),
+            "",
+        ].join("\n");
+    }
+    const colorVerdict = verdictColor(answer.verdict);
+    const colorTrust = trustLevelColor(answer.trustLevel);
+    const lines = [
+        "",
+        chalk.bold(`  ${answer.name}`),
+        `  Type:           ${answer.type}`,
+        `  Verdict:        ${colorVerdict(answer.verdict.toUpperCase())}`,
+        `  Trust Level:    ${colorTrust(trustLevelLabel(answer.trustLevel))} (${answer.trustLevel}/4)`,
+        `  Trust Score:    ${answer.trustScore.toFixed(2)}`,
+        `  CVEs:           ${answer.cveCount > 0 ? chalk.red(String(answer.cveCount)) : chalk.green("0")}`,
+        `  Recommendation: ${answer.recommendation}`,
+    ];
+    if (answer.dependencies) {
+        const deps = answer.dependencies;
+        lines.push("");
+        lines.push(chalk.bold("  Dependencies"));
+        lines.push(`  Direct:         ${deps.direct}`);
+        lines.push(`  Transitive:     ${deps.transitive}`);
+        if (deps.riskSummary) {
+            const rs = deps.riskSummary;
+            const parts = [];
+            if (rs.blocked > 0)
+                parts.push(chalk.red(`${rs.blocked} blocked`));
+            if (rs.warning > 0)
+                parts.push(chalk.yellow(`${rs.warning} warning`));
+            if (rs.safe > 0)
+                parts.push(chalk.green(`${rs.safe} safe`));
+            lines.push(`  Risk Summary:   ${parts.join(", ")}`);
+        }
+    }
+    lines.push("");
+    return lines.join("\n");
+}
+export function formatBatchResults(response, minTrust) {
+    const lines = [];
+    lines.push("");
+    lines.push(chalk.bold(`  Trust Audit: ${response.meta.total} packages queried, ${response.meta.found} found, ${response.meta.notFound} not found`));
+    lines.push("");
+    // Table header
+    const nameWidth = 40;
+    const typeWidth = 14;
+    const verdictWidth = 10;
+    const levelWidth = 12;
+    const scoreWidth = 8;
+    const cveWidth = 6;
+    lines.push("  " +
+        "PACKAGE".padEnd(nameWidth) +
+        "TYPE".padEnd(typeWidth) +
+        "VERDICT".padEnd(verdictWidth) +
+        "TRUST".padEnd(levelWidth) +
+        "SCORE".padEnd(scoreWidth) +
+        "CVEs".padEnd(cveWidth));
+    lines.push("  " + "-".repeat(nameWidth + typeWidth + verdictWidth + levelWidth + scoreWidth + cveWidth));
+    for (const result of response.results) {
+        const colorVerdict = verdictColor(result.verdict);
+        const colorTrust = trustLevelColor(result.trustLevel);
+        const name = result.name.length > nameWidth - 2
+            ? result.name.substring(0, nameWidth - 5) + "..."
+            : result.name;
+        lines.push("  " +
+            name.padEnd(nameWidth) +
+            (result.type || "-").padEnd(typeWidth) +
+            colorVerdict(result.verdict.toUpperCase().padEnd(verdictWidth)) +
+            colorTrust(trustLevelLabel(result.trustLevel).padEnd(levelWidth)) +
+            (result.found ? result.trustScore.toFixed(2) : "-").toString().padEnd(scoreWidth) +
+            (result.found ? String(result.cveCount) : "-").padEnd(cveWidth));
+    }
+    // Summary
+    const belowThreshold = response.results.filter((r) => r.found && r.trustLevel < minTrust);
+    const notFound = response.results.filter((r) => !r.found);
+    lines.push("");
+    if (belowThreshold.length > 0) {
+        lines.push(chalk.yellow(`  [!] ${belowThreshold.length} package(s) below minimum trust level ${minTrust}:`));
+        for (const pkg of belowThreshold) {
+            lines.push(chalk.yellow(`      - ${pkg.name} (trust level ${pkg.trustLevel}, verdict: ${pkg.verdict})`));
+        }
+    }
+    if (notFound.length > 0) {
+        lines.push(chalk.gray(`  [?] ${notFound.length} package(s) not found in registry:`));
+        for (const pkg of notFound) {
+            lines.push(chalk.gray(`      - ${pkg.name}`));
+        }
+    }
+    if (belowThreshold.length === 0 && notFound.length === 0) {
+        lines.push(chalk.green(`  All ${response.meta.found} packages meet minimum trust level ${minTrust}.`));
+    }
+    lines.push("");
+    return lines.join("\n");
+}
+export function formatJson(data) {
+    return JSON.stringify(data, null, 2);
+}
+//# sourceMappingURL=formatter.js.map

package/dist/output/formatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatter.js","sourceRoot":"","sources":["../../src/output/formatter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,SAAS,YAAY,CAAC,OAAe;IACnC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,MAAM,CAAC;QACtB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,GAAG,CAAC;QACnB;YACE,OAAO,KAAK,CAAC,IAAI,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,CAAC;YACJ,OAAO,SAAS,CAAC;QACnB,KAAK,CAAC;YACJ,OAAO,SAAS,CAAC;QACnB,KAAK,CAAC;YACJ,OAAO,QAAQ,CAAC;QAClB,KAAK,CAAC;YACJ,OAAO,SAAS,CAAC;QACnB,KAAK,CAAC;YACJ,OAAO,UAAU,CAAC;QACpB;YACE,OAAO,YAAY,KAAK,GAAG,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC;IACnC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IACpC,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO;YACL,EAAE;YACF,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;YACjD,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC;YAC7C,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IAED,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAa;QACtB,EAAE;QACF,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,qBAAqB,MAAM,CAAC,IAAI,EAAE;QAClC,qBAAqB,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE;QACjE,qBAAqB,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,KAAK;QAC9F,qBAAqB,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACnD,qBAAqB,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QAClG,qBAAqB,MAAM,CAAC,cAAc,EAAE;KAC7C,CAAC;IAEF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;YAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC,OAAO,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;YACnE,IAAI,EAAE,CAAC,OAAO,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;YACtE,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC;YAC5D,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAAuB,EACvB,QAAgB;IAEhB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,IAAI,CACR,kBAAkB,QAAQ,CAAC,IAAI,CAAC,KAAK,sBAAsB,QAAQ,CAAC,IAAI,CAAC,KAAK,WAAW,QAAQ,CAAC,IAAI,CAAC,QAAQ,YAAY,CAC5H,CACF,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,eAAe;IACf,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,MAAM,YAAY,GAAG,EAAE,CAAC;IACxB,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,MAAM,UAAU,GAAG,CAAC,CAAC;IACrB,MAAM,QAAQ,GAAG,CAAC,CAAC;IAEnB,KAAK,CAAC,IAAI,CACR,IAAI;QACF,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QACxB,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAC1B,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC;IAEzG,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,GAAG,CAAC;YAC7C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,GAAG,KAAK;YACjD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QAEhB,KAAK,CAAC,IAAI,CACR,IAAI;YACF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACtB,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;YACtC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC/D,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACjE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;YACjF,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAClE,CAAC;IACJ,CAAC;IAED,UAAU;IACV,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ,CAC1C,CAAC;IACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAE1D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,MAAM,CACV,SAAS,cAAc,CAAC,MAAM,yCAAyC,QAAQ,GAAG,CACnF,CACF,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,MAAM,CACV,WAAW,GAAG,CAAC,IAAI,iBAAiB,GAAG,CAAC,UAAU,cAAc,GAAG,CAAC,OAAO,GAAG,CAC/E,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,IAAI,CACR,SAAS,QAAQ,CAAC,MAAM,oCAAoC,CAC7D,CACF,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,KAAK,CACT,SAAS,QAAQ,CAAC,IAAI,CAAC,KAAK,sCAAsC,QAAQ,GAAG,CAC9E,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAa;IACtC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC"}

package/dist/utils/parser.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Parsers for dependency files (package.json, requirements.txt).
+ */
+import type { PackageQuery } from "../api/client.js";
+export declare function parseDependencyFile(filePath: string): Promise<PackageQuery[]>;
+//# sourceMappingURL=parser.d.ts.map

package/dist/utils/parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/utils/parser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,EAAE,CAAC,CAezB"}

package/dist/utils/parser.js

@@ -0,0 +1,55 @@
+/**
+ * Parsers for dependency files (package.json, requirements.txt).
+ */
+import { readFile } from "node:fs/promises";
+import { basename } from "node:path";
+export async function parseDependencyFile(filePath) {
+    const fileName = basename(filePath);
+    const content = await readFile(filePath, "utf-8");
+    if (fileName === "package.json") {
+        return parsePackageJson(content);
+    }
+    if (fileName === "requirements.txt") {
+        return parseRequirementsTxt(content);
+    }
+    throw new Error(`Unsupported dependency file: ${fileName}. Supported: package.json, requirements.txt`);
+}
+function parsePackageJson(content) {
+    const pkg = JSON.parse(content);
+    const packages = [];
+    const seen = new Set();
+    for (const deps of [pkg.dependencies, pkg.devDependencies]) {
+        if (!deps)
+            continue;
+        for (const name of Object.keys(deps)) {
+            if (!seen.has(name)) {
+                seen.add(name);
+                packages.push({ name });
+            }
+        }
+    }
+    return packages;
+}
+function parseRequirementsTxt(content) {
+    const packages = [];
+    const seen = new Set();
+    for (const rawLine of content.split("\n")) {
+        const line = rawLine.trim();
+        // Skip empty lines and comments
+        if (!line || line.startsWith("#") || line.startsWith("-")) {
+            continue;
+        }
+        // Extract package name (before version specifiers)
+        const match = line.match(/^([a-zA-Z0-9_-]+(?:\[[a-zA-Z0-9_,-]+\])?)/);
+        if (match) {
+            // Strip extras like [security] from requests[security]
+            const name = match[1].replace(/\[.*\]/, "");
+            if (!seen.has(name)) {
+                seen.add(name);
+                packages.push({ name });
+            }
+        }
+    }
+    return packages;
+}
+//# sourceMappingURL=parser.js.map

package/dist/utils/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../src/utils/parser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB;IAEhB,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAElD,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChC,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QACpC,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,KAAK,CACb,gCAAgC,QAAQ,6CAA6C,CACtF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAG7B,CAAC;IAEF,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC3C,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAE5B,gCAAgC;QAChC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,SAAS;QACX,CAAC;QAED,mDAAmD;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACtE,IAAI,KAAK,EAAE,CAAC;YACV,uDAAuD;YACvD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "ai-trust",
+  "version": "0.1.0",
+  "description": "Trust verification CLI for AI packages — check MCP servers, A2A agents, and AI tools before you install",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "ai-trust": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "ts-node src/index.ts",
+    "lint": "tsc --noEmit",
+    "test": "echo \"No tests yet\" && exit 0"
+  },
+  "keywords": [
+    "ai",
+    "trust",
+    "security",
+    "mcp",
+    "a2a",
+    "supply-chain",
+    "cli",
+    "model-context-protocol",
+    "ai-agent",
+    "opena2a"
+  ],
+  "author": "OpenA2A",
+  "license": "Apache-2.0",
+  "dependencies": {
+    "chalk": "^5.3.0",
+    "commander": "^12.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.11.0",
+    "typescript": "^5.3.0"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}