So, this week came with a new challenge, tasking but interesting. This document chronicles the development of a simple A2A (Agent-to-Agent) Protocol agent built with Python and FastAPI. The agent monitors package dependencies for security vulnerabilities, providing both conversational (Telex) and RESTful interfaces.
Package Health Monitor Agent is an A2A (Agent-to-Agent) Protocol AI Agent built with Python and FastAPI that monitors package dependencies for security vulnerabilities, outdated versions, and deprecated packages. It was designed for Telex integration with natural language processing capabilities.
Its features include: A2A Protocol Support, Multi-Language Support, Security Scanning, Health Scoring, Smart Recommendations, Natural Language and RESTful API with traditi…
So, this week came with a new challenge, tasking but interesting. This document chronicles the development of a simple A2A (Agent-to-Agent) Protocol agent built with Python and FastAPI. The agent monitors package dependencies for security vulnerabilities, providing both conversational (Telex) and RESTful interfaces.
Package Health Monitor Agent is an A2A (Agent-to-Agent) Protocol AI Agent built with Python and FastAPI that monitors package dependencies for security vulnerabilities, outdated versions, and deprecated packages. It was designed for Telex integration with natural language processing capabilities.
Its features include: A2A Protocol Support, Multi-Language Support, Security Scanning, Health Scoring, Smart Recommendations, Natural Language and RESTful API with traditional REST endpoints for direct integration
The Problem This project was carried out as part of the HNG stage tasks. However, modern software projects depend on dozens, sometimes hundreds, of third-party packages. These dependencies can become outdated, vulnerable or deprecated, and developers need a quick, conversational way to check their dependencies’ health without context-switching between multiple websites and tools.
This problem led to building this AI agent that:
- Accepts natural language queries (“Check flask==2.0.1, requests==2.25.0”)
- Analyzes packages across multiple ecosystems (Python/PyPI, JavaScript/npm)
- Checks real-time vulnerability databases (OSV)
- Provides actionable recommendations
- Integrates with Telex for conversational workflows
Core Components
- FastAPI Application (main_a2a.py)
- Modern async web framework
- Automatic OpenAPI documentation
Native Pydantic integration for validation 1.
Data Models (models/) 1.
a2a.py - A2A Protocol models (messages, requests, responses) 1.
schemas.py - API request/response models 1.
A2A Handler (a2a_handler.py) 1.
Message processing logic 1.
Natural language parsing 1.
Package analysis orchestration 1.
Package Checker Integration with external APIs: 1.
PyPI - Python Package Index (https://pypi.org/pypi/{package}/json) 1.
npm - Node Package Manager (https://registry.npmjs.org/{package}) 1.
OSV - Open Source Vulnerabilities (https://api.osv.dev/v1/query) 1.
A2A Handler (a2a_handler.py) 1.
Message processing logic 1.
Natural language parsing 1.
Package analysis orchestration 1.
Package Checker Integration with external APIs: 1.
PyPI - Python Package Index (https://pypi.org/pypi/{package}/json) 1.
npm - Node Package Manager (https://registry.npmjs.org/{package}) 1.
OSV - Open Source Vulnerabilities (https://api.osv.dev/v1/query)
Live API: https://packagehealthmonitoragent-2367cacc569a.herokuapp.com/
Documentation: https://packagehealthmonitoragent-2367cacc569a.herokuapp.com/docs
**Technical Stack*
Core Technologies
| Technology | Version | Purpose |
|---|---|---|
| Python | 3.13 | Runtime with improved performance |
| FastAPI | 0.115.5 | Async web framework |
| Pydantic | 2.10.3 | Data validation with strict typing |
| Uvicorn | 0.32.1 | ASGI server for production |
| Requests | 2.32.3 | HTTP client for external APIs |
External APIs
- PyPI JSON API -
https://pypi.org/pypi/{package}/json - npm Registry -
https://registry.npmjs.org/{package} - OSV Database -
https://api.osv.dev/v1/query
Development Tools
- Git/GitHub - Version control
- Heroku - PaaS deployment
- Postman - API testing
- VS Code - Development environment
Performance Characteristics
Response Times (Average)
- /health - <10ms (no external calls)
- /check-package - 150-300ms (2 external API calls)
- /analyze/python - 500ms-2s (N packages × 2 API calls each)
- /a2a - 200ms-2s (depends on message complexity)
Scalability Considerations
Current Limitations:
- Sequential package checking (no parallelization)
- No caching of PyPI/npm responses
- No rate limiting on external APIs
Future Improvements:
- Use
asyncio.gather()for parallel package checks - Implement Redis cache for package metadata
- Add rate limiting with exponential backoff
Code Statistics
Language Files Lines Code Comments
────────────────────────────────────────────────────────────────────
Python 4 850 650 100
Markdown 2 650 550 50
TOML 1 20 18 2
Text 2 15 15 0
────────────────────────────────────────────────────────────────────
Total 9 1535 1233 152
Test Coverage
- A2A Protocol: Tested
- Python Package Analysis: Tested
- npm Package Analysis: Tested
- Error Handling: Tested
- Edge Cases: Tested
Resources & References
Documentation
- FastAPI Official Docs
- Pydantic V2 Docs
- JSON-RPC 2.0 Specification
- A2A Protocol Specification
- OSV Schema
Helpful Articles
- “Type Hints in Python” - Real Python
- “Building Production-Ready APIs” - FastAPI Best Practices
- “Protocol Design Patterns” - Martin Fowler
Tools Used
- Poetry - Dependency management (initial)
- Postman - API testing
- Heroku CLI - Deployment
Conclusion
Building this Package Health Monitor Agent was a journey from simple REST API to enterprise-grade A2A protocol implementation. The key insights:
Start Simple, Refactor Thoughtfully - The initial flexible approach taught us what we needed before committing to strict types. 1.
Protocol Compliance Matters - Proper JSON-RPC 2.0 error codes make debugging integration issues 10x easier. 1.
Type Safety is Worth It - Strict Literal types caught bugs before they reached production. 1.
Production is Different - Logging, error handling, and documentation separate hobby projects from professional tools. 1.
Iterate Based on Real Use - The Telex integration exposed assumptions we didn’t know we had.
The agent now serves as a production-ready example of:
- Modern Python API development with FastAPI
- A2A Protocol implementation best practices
- Type-safe protocol design with Pydantic
- Professional DevOps practices with Heroku
Live Demo: Try it at https://packagehealthmonitoragent-2367cacc569a.herokuapp.com/docs
Source Code: https://github.com/MyITjournal/package-health-agent
Want to build your own A2A agent? Clone this repo and use it as a starting template! All code is MIT licensed.
Questions or suggestions? Open an issue on GitHub or connect with me at @MyITjournal.