Published A2A agent card with no authentication
MediumAV-IDENT-003IdentityCore packNew in 2.0
What it finds
An Agent-to-Agent (A2A) agent card advertises skills but declares no security scheme.
Why it matters
Other agents discover and call you from this card. With no auth declared, any agent can call your skills and you cannot tell callers apart.
What an attacker could do: Unknown agents can invoke this agent's skills.
How to fix it
Declare securitySchemes (OAuth2 or API key) in the card and enforce them on every request.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- A2A_AGENT_CARD_NO_AUTH
- How it detects
- Looks for a risky pattern, and stays quiet when a matching safeguard is present.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Any text-based agent source or configuration (JS/TS/Python/JSON/YAML)
- OWASP LLM Top 10
- LLM07 - Insecure Plugin Design
- NIST AI RMF
- GV-4.1
- SOC 2
- CC6.1
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.