@opena2a/plugin-core

Shared plugin interface and registry for OpenA2A security plugins. Defines the contract that all HackMyAgent plugins implement.

Part of the HackMyAgent security toolkit.

Install

npm install @opena2a/plugin-core

Usage

Using existing plugins

import { registerPlugin, getPlugin, listPlugins } from '@opena2a/plugin-core';
import { createPlugin as createCredVault } from '@opena2a/credvault-openclaw';
import { createPlugin as createSignCrypt } from '@opena2a/signcrypt-openclaw';

// Register plugins
registerPlugin(createCredVault());
registerPlugin(createSignCrypt());

// List registered plugins
const plugins = listPlugins();
// => [{ id: 'credvault', name: 'CredVault', ... }, { id: 'signcrypt', name: 'SignCrypt', ... }]

// Get a specific plugin
const credvault = getPlugin('credvault');

Writing a plugin

import type { OpenA2APlugin, PluginMetadata, Finding } from '@opena2a/plugin-core';

export const metadata: PluginMetadata = {
  id: 'my-plugin',
  name: 'My Plugin',
  version: '0.1.0',
  description: 'Does something useful',
  category: 'security',
};

export class MyPlugin implements OpenA2APlugin {
  metadata = metadata;

  async scan(projectDir: string): Promise<Finding[]> {
    // Return findings
    return [];
  }

  async fix(finding: Finding): Promise<void> {
    // Apply a fix
  }
}

Types

| Type | Description | |------|-------------| | OpenA2APlugin | Interface all plugins must implement | | PluginMetadata | Plugin name, version, description, category | | Finding | A security issue found during scanning | | Severity | 'critical' \| 'high' \| 'medium' \| 'low' \| 'info' | | Remediation | A suggested fix for a finding |

License

Apache-2.0