Open Agent Composition Analysis

Your dependency scanner can't see your agent stack.

OpenACA resolves plugins, MCP servers, skills, hooks, and dependencies into a composition graph, then matches them against known security records. Run your first scan locally in under a minute.

Scan your agent stack
$ curl -fsSL https://openaca.dev/install.sh | sh
openaca scan endpoint composition + findings 
$ openaca scan endpoint
Claude Code · ~/.claude · 2 plugins · 9 components

claude-plugin/superpowers@5.1.0
  mcp servers
    @cyanheads/git-mcp-server@1.1.0 ⚠
  skills
    brainstorming · pdf-tools
claude-plugin/supabase@0.1.6
  mcp servers
    supabase-mcp@0.4.0

── findings (1) ──────────────────
HIGH GHSA-3q26-f695-pp76 command injection
  component @cyanheads/git-mcp-server@1.1.0
  via       plugin superpowers
  fix       upgrade to ≥ 2.1.5   osv.dev

Works with

Claude CodeClaude pluginsMCP serversSkillsHooksOSV

Built for review

Open sourceRuns locallyNo MCP executionCycloneDX Agent BOMCLI + GitHub Action

Identity Resolution

Identify everything — even the unnamed

Resolve npx one-liners, unpinned installs, and components with no package coordinates into stable, matchable identities.

Composition Graph

See your whole agent stack

Map the structure: host → plugin → MCP server, skill, hook, dependency. Your Agent BOM.

Risk Attribution

Trace every risk to its source

Not "package X is vulnerable" — "X is here because plugin Y bundles it." Know what to remove or fix.

Advisory Intelligence

Know what's vulnerable

Match components against OSV / GHSA / CVE / MAL, enriched with agent-specific context.

Browse advisory context →

Local

Scan your stack

Developers run the open-source scanner on their endpoint or in a repo.

CI

Gate shared configs

Check agent manifests before plugins, skills, and MCP servers spread.

Try it on your own stack

Scan an agent stack in under a minute.

Start with the local CLI — no account, nothing uploaded.

$ curl -fsSL https://openaca.dev/install.sh | sh