{"_id":"@a2a-compliance/cli","_rev":"5-b5bd5be22fa533e70445827db08be763","name":"@a2a-compliance/cli","dist-tags":{"latest":"0.3.3"},"versions":{"0.1.0":{"name":"@a2a-compliance/cli","version":"0.1.0","keywords":["a2a","agent2agent","compliance","cli","testing","protocol"],"author":{"name":"a2a-compliance contributors"},"license":"MIT","_id":"@a2a-compliance/cli@0.1.0","maintainers":[{"name":"demonskye","email":"rainer.lute.vp@gmail.com"}],"homepage":"https://github.com/UltraSkye/a2a-compliance#readme","bugs":{"url":"https://github.com/UltraSkye/a2a-compliance/issues"},"bin":{"a2a-compliance":"dist/index.js"},"dist":{"shasum":"c95f6e489a96130b3e86bb4303a50dc72b5590cd","tarball":"https://registry.npmjs.org/@a2a-compliance/cli/-/cli-0.1.0.tgz","fileCount":23,"integrity":"sha512-Py5LB/nOQk3LHjOFFQ3TdkXMrowv7tcnQZ7QGCq8XxyRn/yMCMMEXj/RCKU7p15vmNS3dGanZAz3mJNicJWMqg==","signatures":[{"sig":"MEUCIQCX917dIwVJDvikw4NgkVAqdgna4iVV/d4za5Wsq1tfmwIgWGOqylFfdQwuf22/XANoCIl0o2QKwi9HOUMVrXc9csw=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":27853},"main":"./dist/index.js","type":"module","_from":"file:a2a-compliance-cli-0.1.0.tgz","types":"./dist/index.d.ts","engines":{"node":">=22.10.0"},"scripts":{"dev":"tsc -p tsconfig.json --watch","test":"vitest run --passWithNoTests","build":"tsc -p tsconfig.build.json && chmod +x dist/index.js","start":"node dist/index.js","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"demonskye","email":"rainer.lute.vp@gmail.com"},"_resolved":"/tmp/7cd110d9634f204e786207a4e09863c8/a2a-compliance-cli-0.1.0.tgz","_integrity":"sha512-Py5LB/nOQk3LHjOFFQ3TdkXMrowv7tcnQZ7QGCq8XxyRn/yMCMMEXj/RCKU7p15vmNS3dGanZAz3mJNicJWMqg==","repository":{"url":"git+https://github.com/UltraSkye/a2a-compliance.git","type":"git","directory":"packages/cli"},"_npmVersion":"11.11.0","description":"CLI for running A2A protocol compliance tests against agent endpoints","directories":{},"_nodeVersion":"24.14.1","dependencies":{"commander":"^12.1.0","picocolors":"^1.1.0","@a2a-compliance/core":"0.1.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.4","typescript":"^5.6.0"},"_npmOperationalInternal":{"tmp":"tmp/cli_0.1.0_1776502472957_0.9556442610538807","host":"s3://npm-registry-packages-npm-production"}},"0.3.0":{"name":"@a2a-compliance/cli","version":"0.3.0","keywords":["a2a","a2a-protocol","a2a-compliance","a2a-validator","a2a-test-kit","a2a-conformance","a2a-security","a2a-sarif","agent2agent","agent-card","agent-card-validator","agent-compliance","agent-endpoint-tester","agent-protocol","ai-agent","ai-agents","llm-agent","llm-tools","google-a2a","jsonrpc","json-rpc","json-rpc-2.0","jsonrpc-compliance","compliance","compliance-testing","conformance","conformance-testing","tck","test-kit","validator","cli","protocol","protocol-testing","security","security-audit","security-scanner","ssrf","ssrf-protection","cors","tls","dns-rebinding","oauth","oidc","openid-connect","openid","sarif","junit","code-scanning","github-action","gitlab-ci","ci","ci-cd","monitoring","snapshot-testing","regression-testing"],"author":{"name":"a2a-compliance contributors"},"license":"MIT","_id":"@a2a-compliance/cli@0.3.0","maintainers":[{"name":"demonskye","email":"rainer.lute.vp@gmail.com"}],"homepage":"https://github.com/UltraSkye/a2a-compliance#readme","bugs":{"url":"https://github.com/UltraSkye/a2a-compliance/issues"},"bin":{"a2a-compliance":"dist/index.js"},"dist":{"shasum":"fc6d3b8a19596ce8e121a87ec2efc5f2f88efb38","tarball":"https://registry.npmjs.org/@a2a-compliance/cli/-/cli-0.3.0.tgz","fileCount":27,"integrity":"sha512-yjFfgJ7CyjThsfcXTYfr9V6AyhtAteup7vO1iIKuvkhKgnOxtWcA/JulJVmcWAjNh/S6qTWofgLQvnqpaDDfWg==","signatures":[{"sig":"MEUCIQDvCW7Jk2BvqlSlcwdq5swDyUsNYtfA8ZqHr2vw9vhUtAIgQAoO2McIVb3EKzG0GAzD1X1zoizPEuxqm5xogSuXgW0=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":47433},"main":"./dist/index.js","type":"module","_from":"file:a2a-compliance-cli-0.3.0.tgz","types":"./dist/index.d.ts","engines":{"node":">=22.10.0"},"scripts":{"dev":"tsc -p tsconfig.json --watch","test":"vitest run --passWithNoTests","build":"tsc -p tsconfig.build.json && chmod +x dist/index.js","start":"node dist/index.js","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"demonskye","email":"rainer.lute.vp@gmail.com"},"_resolved":"/tmp/b0148f3c0a266624c9fe9708eeba3a47/a2a-compliance-cli-0.3.0.tgz","_integrity":"sha512-yjFfgJ7CyjThsfcXTYfr9V6AyhtAteup7vO1iIKuvkhKgnOxtWcA/JulJVmcWAjNh/S6qTWofgLQvnqpaDDfWg==","repository":{"url":"git+https://github.com/UltraSkye/a2a-compliance.git","type":"git","directory":"packages/cli"},"_npmVersion":"11.11.0","description":"Command-line compliance test kit + security audit for A2A (Agent2Agent) protocol endpoints. Validates agent cards, JSON-RPC conformance, auth, and SSRF/TLS/CORS. Emits JSON, JUnit, SARIF, badge, snapshot diff.","directories":{},"_nodeVersion":"24.14.1","dependencies":{"commander":"^12.1.0","picocolors":"^1.1.0","@a2a-compliance/core":"0.3.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.4","typescript":"^5.6.0"},"_npmOperationalInternal":{"tmp":"tmp/cli_0.3.0_1776508807753_0.413428370008194","host":"s3://npm-registry-packages-npm-production"}},"0.3.1":{"name":"@a2a-compliance/cli","version":"0.3.1","keywords":["a2a","a2a-protocol","a2a-compliance","a2a-validator","a2a-test-kit","a2a-conformance","a2a-security","a2a-sarif","agent2agent","agent-card","agent-card-validator","agent-compliance","agent-endpoint-tester","agent-protocol","ai-agent","ai-agents","llm-agent","llm-tools","google-a2a","jsonrpc","json-rpc","json-rpc-2.0","jsonrpc-compliance","compliance","compliance-testing","conformance","conformance-testing","tck","test-kit","validator","cli","protocol","protocol-testing","security","security-audit","security-scanner","ssrf","ssrf-protection","cors","tls","dns-rebinding","oauth","oidc","openid-connect","openid","sarif","junit","code-scanning","github-action","gitlab-ci","ci","ci-cd","monitoring","snapshot-testing","regression-testing"],"author":{"name":"a2a-compliance contributors"},"license":"MIT","_id":"@a2a-compliance/cli@0.3.1","maintainers":[{"name":"demonskye","email":"rainer.lute.vp@gmail.com"}],"homepage":"https://github.com/UltraSkye/a2a-compliance#readme","bugs":{"url":"https://github.com/UltraSkye/a2a-compliance/issues"},"bin":{"a2a-compliance":"dist/index.js"},"dist":{"shasum":"f74644070b1f758cb7c530203e4b5ae6c5d46e4d","tarball":"https://registry.npmjs.org/@a2a-compliance/cli/-/cli-0.3.1.tgz","fileCount":27,"integrity":"sha512-eZNkG5Elq+Ycrbng6Z1lufZaPF+eufcGjWMwg0WT93+k7HKdAQ253ebZVMiMcCysnwdcCNJ32AMxaf1DY9P+Yg==","signatures":[{"sig":"MEQCIAZC58FWiqCEMap9p2c6LCjGoEOcBSv4YZWpt0Qw1PIgAiBEGRqOWK+NOMrBBn9YuRU7HG+6QW8PjBCg1CTNes8nUA==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":47433},"main":"./dist/index.js","type":"module","_from":"file:a2a-compliance-cli-0.3.1.tgz","types":"./dist/index.d.ts","engines":{"node":">=22.10.0"},"scripts":{"dev":"tsc -p tsconfig.json --watch","test":"vitest run --passWithNoTests","build":"tsc -p tsconfig.build.json && chmod +x dist/index.js","start":"node dist/index.js","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"demonskye","email":"rainer.lute.vp@gmail.com"},"_resolved":"/tmp/f7056beaffeadd80f7e5a37fb67efe3c/a2a-compliance-cli-0.3.1.tgz","_integrity":"sha512-eZNkG5Elq+Ycrbng6Z1lufZaPF+eufcGjWMwg0WT93+k7HKdAQ253ebZVMiMcCysnwdcCNJ32AMxaf1DY9P+Yg==","repository":{"url":"git+https://github.com/UltraSkye/a2a-compliance.git","type":"git","directory":"packages/cli"},"_npmVersion":"11.11.0","description":"Command-line compliance test kit + security audit for A2A (Agent2Agent) protocol endpoints. Validates agent cards, JSON-RPC conformance, auth, and SSRF/TLS/CORS. Emits JSON, JUnit, SARIF, badge, snapshot diff.","directories":{},"_nodeVersion":"24.14.1","dependencies":{"commander":"^12.1.0","picocolors":"^1.1.0","@a2a-compliance/core":"0.3.1"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.4","typescript":"^5.6.0"},"_npmOperationalInternal":{"tmp":"tmp/cli_0.3.1_1776509216104_0.6826459623206589","host":"s3://npm-registry-packages-npm-production"}},"0.3.2":{"name":"@a2a-compliance/cli","version":"0.3.2","keywords":["a2a","a2a-protocol","a2a-compliance","a2a-validator","a2a-test-kit","a2a-conformance","a2a-security","a2a-sarif","agent2agent","agent-card","agent-card-validator","agent-compliance","agent-endpoint-tester","agent-protocol","ai-agent","ai-agents","llm-agent","llm-tools","google-a2a","jsonrpc","json-rpc","json-rpc-2.0","jsonrpc-compliance","compliance","compliance-testing","conformance","conformance-testing","tck","test-kit","validator","cli","protocol","protocol-testing","security","security-audit","security-scanner","ssrf","ssrf-protection","cors","tls","dns-rebinding","oauth","oidc","openid-connect","openid","sarif","junit","code-scanning","github-action","gitlab-ci","ci","ci-cd","monitoring","snapshot-testing","regression-testing"],"author":{"name":"a2a-compliance contributors"},"license":"MIT","_id":"@a2a-compliance/cli@0.3.2","maintainers":[{"name":"demonskye","email":"rainer.lute.vp@gmail.com"}],"homepage":"https://github.com/UltraSkye/a2a-compliance#readme","bugs":{"url":"https://github.com/UltraSkye/a2a-compliance/issues"},"bin":{"a2a-compliance":"dist/index.js"},"dist":{"shasum":"23833b1c4e3a67be896a57b92be5cdd9b5219f9d","tarball":"https://registry.npmjs.org/@a2a-compliance/cli/-/cli-0.3.2.tgz","fileCount":27,"integrity":"sha512-RHNjIAm+0s6/UtGyCTJKv9vlwgTm+tsMcYfuwhJzD0pzzstARsOm7u4aHDdCXY64py7LXiFIFYjbF0ob6LFwyg==","signatures":[{"sig":"MEQCIGO4lduGJhzmA1JQkOeAVTSj3f1+h+5eBKsm1hDOrTM6AiAOoNW6FHaRTPwI5OnNXYyrmIPzBuzbkfhc21sX1uFqRg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":47433},"main":"./dist/index.js","type":"module","_from":"file:a2a-compliance-cli-0.3.2.tgz","types":"./dist/index.d.ts","engines":{"node":">=22.10.0"},"scripts":{"dev":"tsc -p tsconfig.json --watch","test":"vitest run --passWithNoTests","build":"tsc -p tsconfig.build.json && chmod +x dist/index.js","start":"node dist/index.js","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"demonskye","email":"rainer.lute.vp@gmail.com"},"_resolved":"/tmp/0689792e2ae53bb4950ff4e7c0cb4bf5/a2a-compliance-cli-0.3.2.tgz","_integrity":"sha512-RHNjIAm+0s6/UtGyCTJKv9vlwgTm+tsMcYfuwhJzD0pzzstARsOm7u4aHDdCXY64py7LXiFIFYjbF0ob6LFwyg==","repository":{"url":"git+https://github.com/UltraSkye/a2a-compliance.git","type":"git","directory":"packages/cli"},"_npmVersion":"11.11.0","description":"Command-line compliance test kit + security audit for A2A (Agent2Agent) protocol endpoints. Validates agent cards, JSON-RPC conformance, auth, and SSRF/TLS/CORS. Emits JSON, JUnit, SARIF, badge, snapshot diff.","directories":{},"_nodeVersion":"24.14.1","dependencies":{"commander":"^12.1.0","picocolors":"^1.1.0","@a2a-compliance/core":"0.3.2"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.4","typescript":"^5.6.0"},"_npmOperationalInternal":{"tmp":"tmp/cli_0.3.2_1776515204996_0.15574655143594018","host":"s3://npm-registry-packages-npm-production"}},"0.3.3":{"name":"@a2a-compliance/cli","version":"0.3.3","description":"Command-line compliance test kit + security audit for A2A (Agent2Agent) protocol endpoints. Validates agent cards, JSON-RPC conformance, auth, and SSRF/TLS/CORS. Emits JSON, JUnit, SARIF, badge, snapshot diff.","keywords":["a2a","a2a-protocol","a2a-compliance","a2a-validator","a2a-test-kit","a2a-conformance","a2a-security","a2a-sarif","agent2agent","agent-card","agent-card-validator","agent-compliance","agent-endpoint-tester","agent-protocol","ai-agent","ai-agents","llm-agent","llm-tools","google-a2a","jsonrpc","json-rpc","json-rpc-2.0","jsonrpc-compliance","compliance","compliance-testing","conformance","conformance-testing","tck","test-kit","validator","cli","protocol","protocol-testing","security","security-audit","security-scanner","ssrf","ssrf-protection","cors","tls","dns-rebinding","oauth","oidc","openid-connect","openid","sarif","junit","code-scanning","github-action","gitlab-ci","ci","ci-cd","monitoring","snapshot-testing","regression-testing"],"license":"MIT","author":{"name":"a2a-compliance contributors"},"homepage":"https://github.com/UltraSkye/a2a-compliance#readme","bugs":{"url":"https://github.com/UltraSkye/a2a-compliance/issues"},"repository":{"type":"git","url":"git+https://github.com/UltraSkye/a2a-compliance.git","directory":"packages/cli"},"publishConfig":{"access":"public"},"engines":{"node":">=22.10.0"},"type":"module","bin":{"a2a-compliance":"dist/index.js"},"main":"./dist/index.js","types":"./dist/index.d.ts","dependencies":{"commander":"^12.1.0","picocolors":"^1.1.0","@a2a-compliance/core":"0.3.3"},"devDependencies":{"typescript":"^5.6.0","vitest":"^4.1.4"},"scripts":{"build":"tsc -p tsconfig.build.json && chmod +x dist/index.js","dev":"tsc -p tsconfig.json --watch","typecheck":"tsc -p tsconfig.json --noEmit","start":"node dist/index.js","test":"vitest run --passWithNoTests"},"_id":"@a2a-compliance/cli@0.3.3","_integrity":"sha512-Wq9nCiWj80ZcS+t8yRoGzcUThXxt8gc1gZ8Cr77fnakPkCyuiGQ4YKD9cNXLmvY1It2Gc1nDOsF6Tq6vklG90w==","_resolved":"/tmp/573c4e2a0c5d93964176e27d51f3a753/a2a-compliance-cli-0.3.3.tgz","_from":"file:a2a-compliance-cli-0.3.3.tgz","_nodeVersion":"24.14.1","_npmVersion":"11.11.0","dist":{"integrity":"sha512-Wq9nCiWj80ZcS+t8yRoGzcUThXxt8gc1gZ8Cr77fnakPkCyuiGQ4YKD9cNXLmvY1It2Gc1nDOsF6Tq6vklG90w==","shasum":"bca065d9fb5131fe4876687f648925b203b4db59","tarball":"https://registry.npmjs.org/@a2a-compliance/cli/-/cli-0.3.3.tgz","fileCount":27,"unpackedSize":47948,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQDVlcxCTsG+hy/5ewSEdxAbkwJRfV6vNBjMIqpOUAJHXwIhAOqYf3uWjgJV3BFESJxbzsFfIvCDPJ8x1/PzgVh/4cjv"}]},"_npmUser":{"name":"demonskye","email":"rainer.lute.vp@gmail.com"},"directories":{},"maintainers":[{"name":"demonskye","email":"rainer.lute.vp@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/cli_0.3.3_1777021547066_0.7370013730447043"},"_hasShrinkwrap":false}},"time":{"created":"2026-04-18T08:54:32.897Z","modified":"2026-04-24T09:05:47.351Z","0.1.0":"2026-04-18T08:54:33.093Z","0.3.0":"2026-04-18T10:40:07.897Z","0.3.1":"2026-04-18T10:46:56.239Z","0.3.2":"2026-04-18T12:26:45.124Z","0.3.3":"2026-04-24T09:05:47.237Z"},"bugs":{"url":"https://github.com/UltraSkye/a2a-compliance/issues"},"author":{"name":"a2a-compliance contributors"},"license":"MIT","homepage":"https://github.com/UltraSkye/a2a-compliance#readme","keywords":["a2a","a2a-protocol","a2a-compliance","a2a-validator","a2a-test-kit","a2a-conformance","a2a-security","a2a-sarif","agent2agent","agent-card","agent-card-validator","agent-compliance","agent-endpoint-tester","agent-protocol","ai-agent","ai-agents","llm-agent","llm-tools","google-a2a","jsonrpc","json-rpc","json-rpc-2.0","jsonrpc-compliance","compliance","compliance-testing","conformance","conformance-testing","tck","test-kit","validator","cli","protocol","protocol-testing","security","security-audit","security-scanner","ssrf","ssrf-protection","cors","tls","dns-rebinding","oauth","oidc","openid-connect","openid","sarif","junit","code-scanning","github-action","gitlab-ci","ci","ci-cd","monitoring","snapshot-testing","regression-testing"],"repository":{"type":"git","url":"git+https://github.com/UltraSkye/a2a-compliance.git","directory":"packages/cli"},"description":"Command-line compliance test kit + security audit for A2A (Agent2Agent) protocol endpoints. Validates agent cards, JSON-RPC conformance, auth, and SSRF/TLS/CORS. Emits JSON, JUnit, SARIF, badge, snapshot diff.","maintainers":[{"name":"demonskye","email":"rainer.lute.vp@gmail.com"}],"readme":"# @a2a-compliance/cli\n\n> **Command-line compliance test kit + security audit for\n> [A2A (Agent2Agent) protocol](https://a2a-protocol.org/) endpoints.**\n> Point it at a URL, get a graded verdict (`NON_COMPLIANT` /\n> `MANDATORY` / `RECOMMENDED` / `FULL_FEATURED`) in seconds, wire the\n> exit code into CI. JSON, JUnit, SARIF 2.1.0, SVG badge, snapshot diff.\n\n[![npm](https://img.shields.io/npm/v/%40a2a-compliance%2Fcli.svg)](https://www.npmjs.com/package/@a2a-compliance/cli)\n[![license](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/UltraSkye/a2a-compliance/blob/main/LICENSE)\n\nPart of [`a2a-compliance`](https://github.com/UltraSkye/a2a-compliance)\n— the operator-facing companion to\n[`a2aproject/a2a-tck`](https://github.com/a2aproject/a2a-tck) (which\ncertifies SDK implementations). **This tool monitors your deployment.**\n\n## Install\n\n```bash\n# one-shot, no install\nnpx @a2a-compliance/cli run https://your-agent.example.com\n\n# or add globally\nnpm i -g @a2a-compliance/cli\na2a-compliance run https://your-agent.example.com\n```\n\nNode 22.10+ required.\n\n## Commands\n\n```bash\na2a-compliance run <url>           # full run (card + protocol + security + auth)\na2a-compliance card <url>          # card-only, faster\na2a-compliance list                # list every check id, grouped by category\na2a-compliance explain <check-id>  # full docs + spec reference for one check\n```\n\n## What it checks\n\n- **Agent Card** — reachability at `/.well-known/agent-card.json`,\n  valid JSON, Zod-schema conformance, Content-Type, URL shape, skills\n  presence, declared `protocolVersion`.\n- **JSON-RPC 2.0 envelope** — parse-error (-32700), invalid-request\n  (-32600), method-not-found (-32601), batch handling.\n- **A2A method set** — `message/send`, `message/stream`, `tasks/get`,\n  `tasks/cancel`, `tasks/resubscribe`, `tasks/pushNotificationConfig/*`.\n  Method names auto-adapt to the `protocolVersion` declared by the\n  card (A2A v0.3 and v1.0 supported today). Capability-gated checks\n  promote from SHOULD to MUST when the card declares the capability\n  — false-advertising detection.\n- **Auth** — anonymous-challenge probe (expect 401+`WWW-Authenticate`\n  or a typed JSON-RPC error when a non-`none` scheme is declared),\n  OAuth / OIDC discovery reachability.\n- **Security** — SSRF probe on every URL in the card, HTTPS\n  enforcement, CORS `*` combined with credentials, redirect-chain\n  re-check, DNS-rebinding pinning in the HTTP client.\n\nEvery report ends with a **compliance tier**: `NON_COMPLIANT` /\n`MANDATORY` / `RECOMMENDED` / `FULL_FEATURED`.\n\nFor the full threat catalog, see the [A2A Security Top 10](https://github.com/UltraSkye/a2a-compliance/blob/main/docs/A2A_SECURITY_TOP_10.md).\n\n## Common invocations\n\n```bash\n# Full run\na2a-compliance run <url>\n\n# CI artefacts\na2a-compliance run <url> --json   > report.json\na2a-compliance run <url> --junit  ./report.junit.xml\na2a-compliance run <url> --sarif  ./report.sarif    # → GitHub code-scanning\na2a-compliance run <url> --badge  ./badge.svg\n\n# Snapshot a known-good state, then fail on regression\na2a-compliance run <url> --snapshot-out ./baseline.json\na2a-compliance run <url> --snapshot    ./baseline.json\n\n# Narrow to categories / ids\na2a-compliance run <url> --category security --category auth\na2a-compliance run <url> --only sec.ssrf --only sec.tls.https\n\n# Skip expensive blocks\na2a-compliance run <url> --skip-protocol    # card-only\na2a-compliance run <url> --skip-security\na2a-compliance run <url> --skip-auth\n```\n\n## Exit-code policy (`--fail-on`)\n\n| Value                | Exit non-zero when…                |\n|----------------------|------------------------------------|\n| `must` *(default)*   | any MUST-level check failed        |\n| `any`                | any check failed                   |\n| `never`              | never (reporting-only runs)        |\n\nSnapshot regressions always fail the build unless `--fail-on never`.\n\n## GitHub Actions\n\nComposite action:\n\n```yaml\n- uses: UltraSkye/a2a-compliance@v1\n  with:\n    url: https://agent.example.com\n    junit: ./reports/a2a.junit.xml\n    badge: ./badges/a2a.svg\n```\n\nOr call the CLI directly + drop SARIF into code-scanning:\n\n```yaml\n- run: npx @a2a-compliance/cli run ${{ env.AGENT_URL }} \\\n         --sarif ./a2a.sarif --fail-on never\n- uses: github/codeql-action/upload-sarif@v3\n  with: { sarif_file: ./a2a.sarif }\n```\n\nDrop-in workflows for GitHub, GitLab, and CircleCI live in\n[`examples/ci-integrations/`](https://github.com/UltraSkye/a2a-compliance/tree/main/examples/ci-integrations).\n\n## Sample output\n\n```\nA2A compliance — https://agent.example.com\n\n  ✓ [MUST]   Agent card reachable at /.well-known/agent-card.json\n  ✓ [MUST]   Agent card conforms to A2A schema\n  ✓ [SHOULD] Agent card declares a known protocolVersion (v1.0)\n  ✓ [MUST]   Rejects invalid JSON with -32700 Parse error\n  ✓ [SHOULD] Handles a JSON-RPC batch request\n  ✓ [MUST]   message/send returns a valid JSON-RPC response\n  ✓ [MUST]   message/stream responds with text/event-stream\n  - [INFO]   Push notifications capability not declared — skipping\n  ✗ [MUST]   All URLs declared in the agent card use HTTPS\n      cleartext URLs: http://agent.example.com/a2a\n\n  16 passed, 0 warnings, 1 failed  tier: NON_COMPLIANT\n```\n\n## Related packages\n\n- [`@a2a-compliance/core`](https://www.npmjs.com/package/@a2a-compliance/core) — library / programmatic API\n- [`@a2a-compliance/schemas`](https://www.npmjs.com/package/@a2a-compliance/schemas) — Zod schemas alone\n\n## See also\n\n- 🏠 [Repository + full docs](https://github.com/UltraSkye/a2a-compliance)\n- 🤖 [`AGENTS.md`](https://github.com/UltraSkye/a2a-compliance/blob/main/AGENTS.md) — AI-agent quick reference\n- 🛡️ [A2A Security Top 10](https://github.com/UltraSkye/a2a-compliance/blob/main/docs/A2A_SECURITY_TOP_10.md)\n- 🧪 [Reference A2A agent](https://github.com/UltraSkye/a2a-compliance/tree/main/examples/reference-agent) — zero-dep, spec-compliant, for local testing\n\n## License\n\nMIT.\n","readmeFilename":"README.md"}