Sigil

AgentA2A

AI agent supply chain security scanner. Quarantines and scans repos, packages, and MCP servers before they run. Eight-phase static analysis with quarantine-first workflow. Runs as a CLI, MCP server with 12 tools, Claude Code plugin, or CI/CD step.

homepage ↗

Is this yours?

This record is unclaimed

Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.

Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"sigil-2","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.

Claim this record

Observed by Wellknown

Evidence

Everything here was measured by our prober or read from a registry. Nothing is self-reported.

30-day availability112/112 checks ok

when	check	result	http	latency	detail
39 min ago	a2a card	ok	200	20 ms	card: Sigil · 12 skills
7 h ago	a2a card	ok	200	27 ms	card: Sigil · 12 skills
14 h ago	a2a card	ok	200	26 ms	card: Sigil · 12 skills
20 h ago	a2a card	ok	200	26 ms	card: Sigil · 12 skills
26 h ago	a2a card	ok	200	17 ms	card: Sigil · 12 skills
33 h ago	a2a card	ok	200	20 ms	card: Sigil · 12 skills
2 d ago	a2a card	ok	200	208 ms	card: Sigil · 12 skills
2 d ago	a2a card	ok	200	55 ms	card: Sigil · 12 skills
2 d ago	a2a card	ok	200	21 ms	card: Sigil · 12 skills
2 d ago	a2a card	ok	200	189 ms	card: Sigil · 12 skills

Declared by sources

What the publisher says

Attributed to the source that supplied each field. Treated as claims, not facts.

No long description beyond the summary.

Declared skills

Scan File or Directory — Scan a local file or directory for supply chain security threats. Runs eight-phase static analysis: install hooks, code patterns, network exfiltration, credentials, obfuscation, provenance, prompt injection, and skill security.
Scan Package from Registry — Download and scan a package from npm or PyPI. The package is downloaded into quarantine and scanned across all eight phases before anything is installed.
Clone and Scan Repository — Clone a git repository into quarantine and scan it. The repo is held in quarantine until explicitly approved or rejected.
List Quarantined Items — List all items currently held in quarantine with their status, source, risk score, and quarantine ID.
Approve Quarantined Item — Release a quarantined item from quarantine for installation or use. Moves the item out of the quarantine directory.
Reject Quarantined Item — Permanently delete a quarantined item. The downloaded files are removed from the quarantine directory.
Grade Path — Letter grade (A-F), recommendation, behaviour profile and key risks for a path. Cheaper to read than sigil_scan when only the verdict matters.
Scan Host for Agent-Tooling Residue — Read-only scan of this machine for what installed agent tooling left behind: shell rc edits, cron/launchd/systemd persistence, git hooks, world-readable credential files, leftover tool directories, /etc/hosts redirects, global agent packages. Nothing is changed.
Plan Residue Cleanup — Show the reversible fixes Sigil would make for host residue, without applying them. Apply and rollback are not exposed as tools; a human runs them in a terminal.
Check Package in Scan Database — Look up a package or skill's risk assessment in the Sigil public scan database. Works for ClawHub skills, PyPI packages, npm packages, GitHub repos, and MCP servers. Does not require the Sigil CLI.
Search Scan Database — Search the Sigil public scan database for packages by name or keyword. Returns scanned packages with their verdicts and risk scores. Does not require the Sigil CLI.
Report Threat — Report a malicious file to the Sigil threat intelligence database by its SHA256 hash. Requires the Sigil CLI and an authenticated session (sigil login). Reports are reviewed by the security team.

kind A2A Agent Card

name A2A Agent Card

summary A2A Agent Card

description A2A Agent Card

homepageUrl A2A Agent Card

publisherUrl A2A Agent Card

Provenance

Where this record came from

Every source is kept verbatim. Field changes are logged as events.

A2A Agent Cardhttps://sigilsec.ai/.well-known/agent-card.json

first seen 20 d ago · fetched 6 d agoopen ↗

A2A Agent Cardhttps://www.sigilsec.ai/.well-known/agent-card.json

first seen 1 mo ago · fetched 1 mo agoopen ↗

Field history (5 recent events)

1 mo ago · declared · publisherUrl → "https://nomark.ai"
1 mo ago · declared · summary → "AI agent supply chain security scanner. Quarantines and scans repos, packages, and MCP servers before they run. Eight-p
1 mo ago · declared · description → "AI agent supply chain security scanner. Quarantines and scans repos, packages, and MCP servers before they run. Eight-p
1 mo ago · declared · homepageUrl → "https://nomark.ai"
1 mo ago · declared · protocols → ["a2a"]

This record is unclaimed

Evidence

What the publisher says

Capabilities

Where this record came from