Your AI confers, with anyone's — an open A2A protocol platform where AI Agents talk to each other on behalf of their owners. Self-hosted, DID:web identity, RFC 9421 signatures, Claude Code plugin.
- capability exposure inferred + 35
- tool safety inferred + 12
- trust mitigators mixed − 3
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 3d ago · see ecosystem CVEs →
- B · 31 → C · 44
- B · 27 → B · 31
- C · 47 → B · 27
- C · 39 → C · 47
- B · 20 → C · 39
- B · 32 → B · 20
- C · 36 → B · 32
- C · 43 → C · 36
- A · 0 → C · 43
No known CVEs for this server.
- high dangerous code
dynamic exec: eval(), new Function() · obfuscated payload: dynamic require()/import()
analyzed commit 92592eb · analyzer v33 · 3d ago
skills & prompt files 10
- agent-rules hyhmrright-Confer-92592eb/.claude/agents/a2a-contract-reviewer.md
- agent-rules hyhmrright-Confer-92592eb/.claude/agents/migration-reviewer.md
- agent-rules hyhmrright-Confer-92592eb/.claude/agents/rag-pipeline-reviewer.md
- skill hyhmrright-Confer-92592eb/.claude/skills/create-migration/SKILL.md
- skill hyhmrright-Confer-92592eb/.claude/skills/deploy/SKILL.md
- skill hyhmrright-Confer-92592eb/.claude/skills/rag-debug/SKILL.md
- skill hyhmrright-Confer-92592eb/.claude/skills/reset-user-password/SKILL.md
- skill hyhmrright-Confer-92592eb/.claude/skills/sync-env/SKILL.md
- agent-rules hyhmrright-Confer-92592eb/AGENTS.md
- agent-rules hyhmrright-Confer-92592eb/CLAUDE.md
danger signals11
- dynamic code execution eval() hyhmrright-Confer-92592eb/.github/scripts/check-docs-i18n.mjs :91
return eval(`(${html.slice(start + `const ${name} = `.length, end + 4)})`); - dynamic code execution new Function() hyhmrright-Confer-92592eb/plugins/confer-a2a/dist/server.mjs :2882
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); - suspicious endpoint 169.254.169.254 (cloud metadata) hyhmrright-Confer-92592eb/packages/gateway/src/a2a/outbound.test.ts :107
'https://169.254.169.254/latest', - suspicious endpoint 169.254.169.254 (cloud metadata) hyhmrright-Confer-92592eb/packages/gateway/src/lib/embedding.test.ts :94
'http://169.254.169.254', - suspicious endpoint 100.100.100.200 (cloud metadata) hyhmrright-Confer-92592eb/packages/gateway/src/lib/embedding.test.ts :95
'http://100.100.100.200', - suspicious endpoint 169.254.169.254 (cloud metadata) hyhmrright-Confer-92592eb/packages/gateway/src/lib/runtime-url.test.ts :44
'http://169.254.169.254', - suspicious endpoint 100.100.100.200 (cloud metadata) hyhmrright-Confer-92592eb/packages/gateway/src/lib/runtime-url.test.ts :46
'http://100.100.100.200', - suspicious endpoint 169.254.169.254 (cloud metadata) hyhmrright-Confer-92592eb/packages/gateway/src/routes/contacts.integration.test.ts :347
headers: { location: 'http://169.254.169.254/latest/meta-data/' }, - suspicious endpoint 169.254.169.254 (cloud metadata) hyhmrright-Confer-92592eb/packages/gateway/src/routes/users.integration.test.ts :200
'http://169.254.169.254', - suspicious endpoint 100.100.100.200 (cloud metadata) hyhmrright-Confer-92592eb/packages/gateway/src/routes/users.integration.test.ts :203
'http://100.100.100.200', - suspicious endpoint 169.254.169.254 (cloud metadata) hyhmrright-Confer-92592eb/packages/identity/src/did/resolver.test.ts :220
headers: { location: 'http://169.254.169.254/latest/' },
[](https://mcpobservatory.com/servers/github:hyhmrright/Confer/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of hyhmrright.