How to read this: HVTrust (0–100) weighs supply-chain signals (provenance, OSSF Scorecard, signed commits, open license) alongside real-world adoption. Grade A reflects the trust score band: A ≥ 80, B ≥ 65, C ≥ 50, D < 50. Full methodology →
Signals refreshed2026-06-04 18:04 UTC·Repo last pushed today
Rank Trend
2026-05-252026-06-04
Activity & Reach
Stars
24.1k
Forks
2.4k
Last Push
2026-06-04
today
Commits (4 wk)
13
Downloads (7d)
2,628,077
pypi
HN mentions (30d)
0
Open Issues
278
Rank Change
▲3
was #16
Analysis
HVTrust Dimensions
89.3 / 100 · 100.0% confidence
Safety / IntegrityOSSF, provenance, signatures
21.2 / 25
Identity / ProvenanceListing and build link
18.0 / 18
TransparencyLicense and public checks
14.4 / 17
MaintenanceFreshness and commits
16.6 / 20
AdoptionStars and downloads
19.1 / 20
Activity Inputs
81.4 / 100
StarsRepository reach
26.3 / 30
FreshnessLast push recency
25.0 / 25
ActivityRecent commits
14.3 / 25
CommunityFork signal
15.8 / 20
Supply Chain Trust
Package Provenance
Verified
pypi attestation
OSSF Scorecard
7.0 / 10
via deps.dev · OpenSSF
Signed Commits
99%
of last 100 commits verified
Binary-Artifacts10
Branch-Protection8
CI-Tests9
CII-Best-Practices0
Code-Review9
Contributors10
Dangerous-Workflow10
Dependency-Update-Tool10
Fuzzing0
License10
Maintained10
Packaging-1
Pinned-Dependencies0
SAST0
Security-Policy9
Signed-Releases-1
Token-Permissions0
Vulnerabilities10
Is A2A / Agent2Agent Protocol safe?
Public supply-chain signals for A2A / Agent2Agent Protocol are strong: it has multiple independent trust indicators in place. This does not replace your own security review, but A2A / Agent2Agent Protocol carries less obvious unverified-evidence risk than projects with thin signals.
Does A2A / Agent2Agent Protocol publish package provenance?
Yes. A2A / Agent2Agent Protocol's package releases carry build provenance attestations, which cryptographically link the published package back to its source repository and CI workflow.
Does A2A / Agent2Agent Protocol have an OpenSSF Scorecard?
A2A / Agent2Agent Protocol has an OpenSSF Scorecard score of 7.0/10. The Scorecard checks for branch protection, signed releases, dependency updates, fuzzing, code review, and other supply-chain hygiene items. See the full check breakdown on this page.
Is A2A / Agent2Agent Protocol actively maintained?
Actively maintained. The repository was pushed to within the last 1 day(s).
What license does A2A / Agent2Agent Protocol use?
A2A / Agent2Agent Protocol ships under Apache-2.0. A declared, OSI-approved license is one of the transparency signals HVTrust scores.
Are A2A / Agent2Agent Protocol's commits signed?
99% of the last 100 commits to A2A / Agent2Agent Protocol are verified-signed (GPG, SSH, S/MIME, or GitHub's signing flow). Signed commits help confirm that code was authored by who the commit claims.
Not a safety endorsement. HVTracker describes what public signals show, not whether a project is safe for your use case. Run your own security review before adopting in production.
HVTrust currently scores supply-chain signals. We're adding runtime trust next: what an agent actually does when it runs — what it can reach, which tools it carries, what external services it depends on. Track progress on the roadmap →
MCP support
Tool / plugin surface
External service deps
Package provenance drift
Maintain A2A / Agent2Agent Protocol?
HVTrust scores A2A / Agent2Agent Protocol from public signals only — we never contact maintainers first. If a signal is wrong, stale, or missing (provenance you publish, a Scorecard you run, signed releases), tell us and we'll review it. Corrections are public and tracked on GitHub.
