---
schema_version: "1"
id: 35ab40b44e4f610087e93ef7c0b8876e3a01c67560d52e7c9a5bcfbd69a4a4b8
title: Agent Network (2.0) YAML Reference
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/agent-network/latest/af-agent-network-yaml-reference.md
canonical_url: https://docs.mulesoft.com/agent-network/latest/af-agent-network-yaml-reference
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 596a96cc5858298fe39fcf4cfd54b09d24b9837e7b19b0187783495fdebed9b7
description: MuleSoft Documentation Site
release: "2.0"
latest: true
---
---
product: Building Agent Networks
version: 2.0
is-latest-version: true
---

# Agent Network (2.0) YAML Reference

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The `agent-network.yaml` file details the required structure and properties that define your
project’s assets, connections, and policies.

- [Agent Network Section](#agent-network-section)

- [Info Section](#info-section)

- [Registry Section](#registry-section)

- [Context Section](#context-section)

- [Brokers Section](#brokers-section)

- [Expressions Format](#expressions-format)

- [Exchange JSON File](#exchange-json-file)

  - [Runtime System Limits Configuration](#runtime-system-limits)

## Agent Network Section

This is the root section of the agent network. Must include at least one of `registry`, `context`,
or `brokers`.

This section has these properties.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Required</th></tr></thead><tbody><tr><td><p>info</p></td><td><p>Provides metadata about the graphs.</p></td><td><p><a href="#info-section">info Object</a></p></td><td><p>No</p></td></tr><tr><td><p>agentNetwork</p></td><td><p>This string must be the version number of the agent network specification used by the agent network document. This is not related to the document’s <code>info.version</code> property.</p></td><td><p>String</p></td><td><p>Yes</p></td></tr><tr><td><p>registry</p></td><td><p>Definitions of agents, MCPs, and LLMs.</p></td><td><p><a href="#registry-section">registry</a> Object</p></td><td><p>No</p></td></tr><tr><td><p>context</p></td><td><p>Reusable entities scoped to the graphs defined in this file (for example, connections and policies).</p></td><td><p>Object</p></td><td><p>No</p></td></tr><tr><td><p>brokers</p></td><td><p>A mapping of runtime Agent Script definitions that can be executed by the platform.</p></td><td><p><a href="#brokers-section">brokers Object</a></p></td><td><p>No</p></td></tr></tbody></table>

## Info Section

This section contains basic metadata about the agent network document itself.

**Example**

```yaml
info:
  label: Employee Onboarding Workflow
  description: >-
    A multi-agent network for employee onboarding. Orchestrates HR system setup, Salesforce profile
    creation, laptop and badge requests, and Slack notifications for new hires.
  version: 1.0.0
  tags:
    - employee-onboarding
    - multi-agent
    - hr
    - production
```

The section has these properties.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Required</th></tr></thead><tbody><tr><td><p>label</p></td><td><p>The human-readable name of the agent network.</p></td><td><p>String</p></td><td><p>Yes</p></td></tr><tr><td><p>version</p></td><td><p>The version number of the <code>agent-network.yaml</code> file.</p></td><td><p>String</p></td><td><p>Yes</p></td></tr><tr><td><p>description</p></td><td><p>A human readable summary of what the agent network does.  Accepts CommonMark syntax.</p></td><td><p>String</p></td><td><p>No</p></td></tr><tr><td><p>tags</p></td><td><p>Categorization tags for this agent network document.</p></td><td><p>Array of Strings</p></td><td><p>No</p></td></tr><tr><td><p><code>summary</code></p></td><td><p>A short summary of the purpose of the agent network.</p></td><td><p>String</p></td><td><p>No</p></td></tr><tr><td><p><code>termsOfService</code></p></td><td><p>A URI for the Terms of Service for the API. This must be in the form of a URI.</p></td><td><p>String</p></td><td><p>No</p></td></tr><tr><td><p><code>contact</code></p></td><td><p>The contact information for the agent network.</p></td><td><p>Object</p></td><td><p>No</p></td></tr><tr><td><p><code>contact.name</code></p></td><td><p>The identifying name of the contact person/organization.</p></td><td><p>String</p></td><td><p>No</p></td></tr><tr><td><p><code>contact.url</code></p></td><td><p>The URI for the contact information. This must be in the form of a URI.</p></td><td><p>String</p></td><td><p>No</p></td></tr><tr><td><p><code>contact.email</code></p></td><td><p>The email address of the contact person/organization. This must be in the form of an email address.</p></td><td><p>String</p></td><td><p>No</p></td></tr><tr><td><p><code>license</code></p></td><td><p>The license information for the agent network.</p></td><td><p>Object</p></td><td><p>No</p></td></tr><tr><td><p><code>license.name</code></p></td><td><p>The license name used for the agent network.</p></td><td><p>String</p></td><td><p>Yes (if license present)</p></td></tr><tr><td><p><code>license.identifier</code></p></td><td><p>An SPDX license expression. Mutually exclusive with <code>license.url</code>.</p></td><td><p>String</p></td><td><p>No</p></td></tr><tr><td><p><code>license.url</code></p></td><td><p>A URI for the license. This must be in the form of a URI. Mutually exclusive with <code>license.identifier</code>.</p></td><td><p>String</p></td><td><p>No</p></td></tr></tbody></table>

## Registry Section

Use this section to organize and reference reusable agents, LLMs, and MCP tools. The registry
section defined in the file is considered the "local registry". Assets defined in the registry are
published to Exchange.

**Example**

```yaml
registry:
  agents:
    hr-system-agent:
      info:
        label: HR System Agent
        description: Agent that creates new-hire records and manages HR system setup.
      metadata:
        platform: AgentForce
        interfaces:
          a2a:
            card:
              name: hr-system-agent
              description: Creates and manages employee records in the HR system.
              version: "1.0.0"
              capabilities: {}
              defaultInputModes: [application/json, text/plain]
              defaultOutputModes: [application/json, text/plain]
              supportedInterfaces:
                - url: https://hr-agent.example.com/a2a
                  protocolBinding: JSONRPC
                  protocolVersion: "1.0"
              skills: []
        tools:
          - mcp:
              ref:
                name: slack-mcp
              allowed: [sendMessage, listChannels]
        llm:
          ref:
            name: Open-AI-LLM
    salesforce-agent:
      info:
        label: Salesforce Onboarding Agent
        description: Agent that provisions Salesforce profiles for new hires.
      metadata:
        platform: AgentForce
        interfaces:
          a2a:
            card:
              name: salesforce-agent
              description: Onboards new employees to Salesforce.
              version: "1.0.0"
              capabilities: {}
              defaultInputModes: [application/json]
              defaultOutputModes: [application/json]
              supportedInterfaces:
                - url: https://sfdc-agent.example.com/a2a
                  protocolBinding: JSONRPC
                  protocolVersion: "1.0"
              skills: []
        llm:
          ref:
            name: Open-AI-LLM
  mcps:
    slack-mcp:
      info:
        label: Slack MCP Server
        description: MCP server for sending messages and listing Slack channels.
      metadata:
        protocolVersion: "2024-11-05"
        transport:
          kind: sse
          ssePath: /mcp
        tools:
          - name: sendMessage
            description: Send a message to a Slack channel.
            inputSchema:
              type: object
              properties:
                text: { type: string }
                channelId: { type: string }
          - name: listChannels
            description: List available Slack channels.
            inputSchema:
              type: object
  llms:
    Open-AI-LLM:
      info:
        label: OpenAI LLM
        description: OpenAI provider for orchestration and generation nodes.
      metadata:
        platform: OpenAI
        models:
          - gpt-4o
          - gpt-4o-mini
          - gpt5-mini
    Azure-OpenAI-LLM:
      info:
        label: Azure OpenAI LLM
        description: Azure OpenAI for orchestration nodes.
      metadata:
        platform: AzureOpenai
        models:
          - gpt-4o
```

The `registry` section has these properties.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Required</th><th>Values</th></tr></thead><tbody><tr><td><p><code>agents</code></p></td><td><p>The list of agents defined as part of this network.</p></td><td><p>Object</p></td><td><p>No</p></td><td><p>Keys: identifiers matching ^[a-zA-Z_][a-zA-Z0-9_.-]*$. Values: AgentEntity</p></td></tr><tr><td><p><code>mcps</code></p></td><td><p>The list of MCP servers defined as part of this network.</p></td><td><p>Object</p></td><td><p>No</p></td><td><p>Keys: identifiers. Values: MCPServerEntity</p></td></tr><tr><td><p><code>llms</code></p></td><td><p>The list of LLM providers defined as part of this network.</p></td><td><p>Object</p></td><td><p>No</p></td><td><p>Keys: identifiers. Values: LLMEntity. Each <code>LLMEntity</code> requires <code>metadata.platform</code>, which can be <code>Gemini</code>, <code>OpenAI</code>, <code>AzureOpenai</code>, or a custom platform name.</p></td></tr></tbody></table>

### LLMs

Each LLM entity requires `metadata.platform`. The optional `metadata.authentication` array declares
the authentication kinds that the LLM platform supports and can provide default configuration
values. If `authentication` is absent, the LLM platform’s authentication requirements are unknown.
An array that contains only `kind: none` explicitly declares that the platform doesn’t require
authentication.

LLM metadata can declare `none`, `basic`, `apiKey`, `apikey-client-credentials`,
`oauth2-client-credentials`, `amazonSigv4`, or `custom`. A connection to the LLM can’t use `custom`
authentication.

For example, this LLM declares OAuth 2.0 client credentials authentication and its token endpoint as
defaults:

```yaml
registry:
  llms:
    my-llm:
      info:
        label: My LLM
      metadata:
        platform: SomeCustomPlatform
        authentication:
          - kind: oauth2-client-credentials
            defaultConfiguration:
              token:
                url: https://auth.example.com/token
```

### Info

All nodes in this section share these properties.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Required</th></tr></thead><tbody><tr><td><p><code>label</code></p></td><td><p>The human readable short text.</p></td><td><p>String</p></td><td><p>No</p></td></tr><tr><td><p><code>description</code></p></td><td><p>A human readable text of what this element does. Accepts CommonMark syntax.</p></td><td><p>String</p></td><td><p>No</p></td></tr><tr><td><p><code>tags</code></p></td><td><p>Optional tags.</p></td><td><p>Array of Strings</p></td><td><p>No</p></td></tr></tbody></table>

### Agents

Each registry agent is an `AgentEntity`. The schema requires a `metadata` object. The interfaces,
tools, and LLM reference are nested under `metadata`, not at the root of the agent.

The agents section has these properties.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Required</th></tr></thead><tbody><tr><td><p><code>agents.info</code></p></td><td><p>Metadata for the agent.</p></td><td><p>InfoObject</p></td><td><p>No</p></td></tr><tr><td><p><code>agents.metadata</code></p></td><td><p>Platform, interfaces, tools, and LLM wiring for the agent.</p></td><td><p>Object</p></td><td><p>Yes</p></td></tr><tr><td><p><code>agents.metadata.platform</code></p></td><td><p>Host platform for the agent (for example, AgentForce or Bedrock).</p></td><td><p>String</p></td><td><p>Yes</p></td></tr><tr><td><p><code>agents.metadata.interfaces</code></p></td><td><p>The interfaces that this agent supports. At least one of <code>a2a</code>, <code>a2a_v03</code>, or <code>other</code> must be present.</p></td><td><p>Object</p></td><td><p>Yes</p></td></tr><tr><td><p><code>agents.metadata.interfaces.a2a</code></p></td><td><p>A2A protocol version 1.x interface definition. Contains the agent card.</p></td><td><p>Object</p></td><td><p>No (at least one interface required)</p></td></tr><tr><td><p><code>agents.metadata.interfaces.a2a.card</code></p></td><td><p>The A2A v1 agent card. See <a href="#a2a-card">A2A Card</a>.</p></td><td><p>AgentCard</p></td><td><p>No</p></td></tr><tr><td><p><code>agents.metadata.interfaces.a2a_v03</code></p></td><td><p>A2A protocol version 0.3.x interface definition (legacy).</p></td><td><p>Object</p></td><td><p>No (at least one interface required)</p></td></tr><tr><td><p><code>agents.metadata.interfaces.a2a_v03.card</code></p></td><td><p>The A2A v0.3 agent card.</p></td><td><p>AgentCard</p></td><td><p>No</p></td></tr><tr><td><p><code>agents.metadata.interfaces.other</code></p></td><td><p>Other protocol interface definition.</p></td><td><p>Object</p></td><td><p>No (at least one interface required)</p></td></tr><tr><td><p><code>agents.metadata.interfaces.other.protocol</code></p></td><td><p>The protocol name for this interface.</p></td><td><p>String</p></td><td><p>Yes (when using other)</p></td></tr><tr><td><p><code>agents.metadata.interfaces.other.card</code></p></td><td><p>The card for this protocol.</p></td><td><p>Object</p></td><td><p>No</p></td></tr><tr><td><p><code>agents.urls</code></p></td><td><p>Named URLs for the agent.</p></td><td><p>Array</p></td><td><p>No</p></td></tr><tr><td><p><code>agents.metadata.tools</code></p></td><td><p>The list of tool providers (MCP or A2A)</p></td><td><p>Array[Object]</p></td><td><p>No</p></td></tr><tr><td><p><code>agents.metadata.llm</code></p></td><td><p>Reference to the LLM used by this agent (ref to a declared LLM)</p></td><td><p>Object</p></td><td><p>No</p></td></tr></tbody></table>

Authentication for outbound calls is configured on [`connections`](#connections) (and related
policies), not on registry `AgentEntity` definitions.

> [!NOTE] If you are connecting to an agent that uses A2A protocol version 0.3.x, use the `a2a_v03`
> interface key instead of `a2a`. The `a2a` key targets A2A protocol version 1.x.

#### A2A Card

This section adheres to the Agent-to-Agent (A2A) specification v1.0 and describes an agent’s
contract, skills, and capabilities. This is a standard A2A agent card
[as defined in the Agent2Agent (A2A) Protocol specification](https://a2a-protocol.org/latest/specification/#441-agentcard).

The A2A card section has these properties.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Required</th><th>Values</th></tr></thead><tbody><tr><td><p><code>name</code></p></td><td><p>A human-readable name for the agent.</p></td><td><p>String</p></td><td><p>No</p></td><td><p> — </p></td></tr><tr><td><p><code>description</code></p></td><td><p>A human-readable description of the agent.</p></td><td><p>String</p></td><td><p>No</p></td><td><p> — </p></td></tr><tr><td><p><code>version</code></p></td><td><p>The version of the agent (format defined by provider).</p></td><td><p>String</p></td><td><p>No</p></td><td><p>for example, 1.0.0</p></td></tr><tr><td><p><code>capabilities</code></p></td><td><p>Optional capabilities supported by the agent.</p></td><td><p>AgentCapabilities</p></td><td><p>No</p></td><td><p>See <a href="#capabilities-properties">Capabilities Properties</a></p></td></tr><tr><td><p><code>defaultInputModes</code></p></td><td><p>Interaction modes the agent supports across all skills (media types).</p></td><td><p>Array of String</p></td><td><p>No</p></td><td><p> — </p></td></tr><tr><td><p><code>defaultOutputModes</code></p></td><td><p>Media types supported as outputs from this agent.</p></td><td><p>Array of String</p></td><td><p>No</p></td><td><p> — </p></td></tr><tr><td><p><code>skills</code></p></td><td><p>The set of skills or distinct capabilities the agent can perform.</p></td><td><p>Array of AgentSkill</p></td><td><p>No</p></td><td><p>See <a href="#skills-properties">Skills Properties</a></p></td></tr><tr><td><p><code>supportedInterfaces</code></p></td><td><p>Transport and URL combinations for interacting with the agent.</p></td><td><p>Array of AgentInterface</p></td><td><p>No</p></td><td><p>See <a href="#agent-interface-properties">Agent Interface Properties</a></p></td></tr><tr><td><p><code>provider</code></p></td><td><p>The service provider of the agent.</p></td><td><p>AgentProvider</p></td><td><p>No</p></td><td><p>{ organization: string, url: string }</p></td></tr><tr><td><p><code>documentationUrl</code></p></td><td><p>A URL providing additional documentation about the agent.</p></td><td><p>String</p></td><td><p>No</p></td><td><p> — </p></td></tr><tr><td><p><code>iconUrl</code></p></td><td><p>A URL to an icon for the agent.</p></td><td><p>String</p></td><td><p>No</p></td><td><p> — </p></td></tr><tr><td><p><code>security</code></p></td><td><p>Security requirement objects for all interactions (OpenAPI 3.0 style; OR of ANDs).</p></td><td><p>Array of Object</p></td><td><p>No</p></td><td><p>Each object: scheme names → array of scope strings</p></td></tr><tr><td><p><code>securitySchemes</code></p></td><td><p>Declared security schemes (key \= scheme name). OpenAPI 3.0 Security Scheme Object.</p></td><td><p>Object</p></td><td><p>No</p></td><td><p>apiKey, http, oauth2, openIdConnect, mutualTLS</p></td></tr><tr><td><p><code>signatures</code></p></td><td><p>JSON Web Signatures for this AgentCard (RFC 7515 JWS).</p></td><td><p>Array of AgentCardSignature</p></td><td><p>No</p></td><td><p>{ protected, signature, header? }</p></td></tr></tbody></table>

##### Skills Properties

Skills describe the distinct capabilities the agent can perform and have these properties.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Valid Values</th><th>Required</th></tr></thead><tbody><tr><td><p><code>id</code></p></td><td><p>Unique identifier for the skill.</p></td><td><p>String</p></td><td><p>Any string value</p></td><td><p>No</p></td></tr><tr><td><p><code>name</code></p></td><td><p>A human-readable name for the skill.</p></td><td><p>String</p></td><td><p>Any string value</p></td><td><p>No</p></td></tr><tr><td><p><code>description</code></p></td><td><p>A description of what this skill does.</p></td><td><p>String</p></td><td><p>Any string value</p></td><td><p>No</p></td></tr><tr><td><p><code>examples</code></p></td><td><p>Usage examples demonstrating how to use this skill.</p></td><td><p>Array of strings</p></td><td><p>Array of example strings</p></td><td><p>No</p></td></tr><tr><td><p><code>inputModes</code></p></td><td><p>Supported input MIME types for this skill (overrides defaultInputModes).</p></td><td><p>Array of strings</p></td><td><p>Array of MIME type strings</p></td><td><p>No</p></td></tr><tr><td><p><code>outputModes</code></p></td><td><p>Supported output MIME types for this skill (overrides defaultOutputModes).</p></td><td><p>Array of strings</p></td><td><p>Array of MIME type strings</p></td><td><p>No</p></td></tr><tr><td><p><code>tags</code></p></td><td><p>Categorization tags for this skill.</p></td><td><p>Array of strings</p></td><td><p>Array of tag strings</p></td><td><p>No</p></td></tr><tr><td><p><code>securityRequirements</code></p></td><td><p>Security requirements specific to this skill.</p></td><td><p>Array of SecurityRequirement</p></td><td><p>Array of security requirement objects</p></td><td><p>No</p></td></tr></tbody></table>

##### Capabilities Properties

Capabilities describe optional features supported by the agent and have these properties.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Valid Values</th><th>Required</th></tr></thead><tbody><tr><td><p><code>streaming</code></p></td><td><p>Indicates if the agent supports streaming responses.</p></td><td><p>Boolean</p></td><td><p><code>true</code> or <code>false</code></p></td><td><p>No</p></td></tr><tr><td><p><code>pushNotifications</code></p></td><td><p>Indicates if the agent supports push notifications.</p></td><td><p>Boolean</p></td><td><p><code>true</code> or <code>false</code></p></td><td><p>No</p></td></tr><tr><td><p><code>extendedAgentCard</code></p></td><td><p>Indicates if the agent supports providing an extended agent card when authenticated.</p></td><td><p>Boolean</p></td><td><p><code>true</code> or <code>false</code></p></td><td><p>No</p></td></tr><tr><td><p><code>extensions</code></p></td><td><p>List of protocol extensions supported by the agent.</p></td><td><p>Array of AgentExtension</p></td><td><p>See below</p></td><td><p>No</p></td></tr></tbody></table>

##### Agent Extension Properties

Each extension object describes a protocol extension supported by the agent.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Valid Values</th><th>Required</th></tr></thead><tbody><tr><td><p><code>uri</code></p></td><td><p>The unique URI identifying the extension.</p></td><td><p>String</p></td><td><p>Any URI string</p></td><td><p>No</p></td></tr><tr><td><p><code>description</code></p></td><td><p>Human-readable description of how this agent uses the extension.</p></td><td><p>String</p></td><td><p>Any string value</p></td><td><p>No</p></td></tr><tr><td><p><code>required</code></p></td><td><p>If true, the client must understand and comply with the extension’s requirements.</p></td><td><p>Boolean</p></td><td><p><code>true</code> or <code>false</code> (default: <code>false</code>)</p></td><td><p>No</p></td></tr><tr><td><p><code>params</code></p></td><td><p>Extension-specific configuration parameters.</p></td><td><p>Object</p></td><td><p>Any JSON object</p></td><td><p>No</p></td></tr></tbody></table>

##### Agent Interface Properties

Each interface object declares a transport and URL combination for interacting with the agent.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Valid Values</th><th>Required</th></tr></thead><tbody><tr><td><p><code>url</code></p></td><td><p>The URL where this interface is available.</p></td><td><p>String</p></td><td><p>Valid URI string</p></td><td><p>No</p></td></tr><tr><td><p><code>protocolBinding</code></p></td><td><p>The protocol binding for this interface.</p></td><td><p>String</p></td><td><p><code>JSONRPC</code>, <code>GRPC</code>, <code>HTTP+JSON</code></p></td><td><p>No</p></td></tr><tr><td><p><code>protocolVersion</code></p></td><td><p>The A2A protocol version for this interface.</p></td><td><p>String</p></td><td><p>For example, 1.0<br><br>IMPORTANT: The A2A protocol version you declare for a connection must match the deployed agent’s actual runtime protocol version. A mismatch causes the platform to apply the wrong Agent Card policy, which prevents the agent card URL from being rewritten to the egress proxy and results in a <code>401 Unauthorized</code> error at runtime rather than a version error.</p></td><td><p>No</p></td></tr><tr><td><p><code>tenant</code></p></td><td><p>Tenant ID to be used in the request when calling the agent.</p></td><td><p>String</p></td><td><p>Any string value</p></td><td><p>No</p></td></tr></tbody></table>

### MCP

The MCP Server section has these properties.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Required</th><th>Values</th></tr></thead><tbody><tr><td><p><code>info</code></p></td><td><p>Metadata for the MCP Server</p></td><td><p><code>InfoObject</code></p></td><td><p>No</p></td><td><p> — </p></td></tr><tr><td><p><code>urls</code></p></td><td><p>Named URLs for the MCP server.</p></td><td><p>Array</p></td><td><p>No</p></td><td><p> — </p></td></tr><tr><td><p><code>metadata</code></p></td><td><p>MCP server descriptor (how to connect and what it exposes).</p></td><td><p>Object</p></td><td><p>Yes</p></td><td><p> — </p></td></tr><tr><td><p><code>metadata.protocolVersion</code></p></td><td><p>Version of the MCP protocol.</p></td><td><p>String</p></td><td><p>No</p></td><td><p>"2024-11-05", "2025-03-26", "2025-06-18", "2025-11-25"</p></td></tr><tr><td><p><code>metadata.transport</code></p></td><td><p>Transport used for communication.</p></td><td><p>MCPTransport</p></td><td><p>Yes</p></td><td><p>SseTransport, StreamableHttpTransport, or StdioTransport</p></td></tr><tr><td><p><code>metadata.provider</code></p></td><td><p>Service provider of the MCP server.</p></td><td><p>Object</p></td><td><p>No</p></td><td><p>{ organization: string, url: string }</p></td></tr><tr><td><p><code>metadata.capabilities</code></p></td><td><p>Server capabilities.</p></td><td><p>ServerCapabilities</p></td><td><p>No</p></td><td><p>completions, experimental, tasks, logging, prompts, resources, tools</p></td></tr><tr><td><p><code>metadata.tools</code></p></td><td><p>List of tools.</p></td><td><p>Array</p></td><td><p>No</p></td><td><p>action definitions</p></td></tr><tr><td><p><code>metadata.resources</code></p></td><td><p>List of resources.</p></td><td><p>Array</p></td><td><p>No</p></td><td><p>Resource definitions</p></td></tr><tr><td><p><code>metadata.resourceTemplates</code></p></td><td><p>List of resource templates.</p></td><td><p>Array</p></td><td><p>No</p></td><td><p>ResourceTemplate definitions</p></td></tr><tr><td><p><code>metadata.prompts</code></p></td><td><p>List of prompts.</p></td><td><p>Array</p></td><td><p>No</p></td><td><p>Prompt definitions</p></td></tr><tr><td><p><code>metadata.platform</code></p></td><td><p>Platform the MCP server runs on.</p></td><td><p>String</p></td><td><p>No</p></td><td><p> — </p></td></tr><tr><td><p><code>metadata.securitySchemes</code></p></td><td><p>Security schemes for authentication.</p></td><td><p>Object</p></td><td><p>No</p></td><td><p>SecurityScheme by key</p></td></tr></tbody></table>

#### MCP Transport types

The `metadata.transport` object describes how clients connect to the MCP server. The supported
transport kinds are `sse`, `streamableHttp`, and `stdio`.

**Example**

```yaml
registry:
  mcps:
    weather-mcp:
      metadata:
        protocolVersion: "2025-06-18"
        transport:
          kind: streamableHttp
          path: /weather/mcp
        provider:
          organization: Acme Inc.
          url: https://www.acme.com
    my-mcp-sse:
      metadata:
        transport:
          kind: sse
          ssePath: /mcp/sse
          messagesPath: /mcp
```

##### SseTransport

Sse Transport has these properties.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Required</th><th>Values</th></tr></thead><tbody><tr><td><p><code>kind</code></p></td><td><p>Transport type.</p></td><td><p>String</p></td><td><p>Yes</p></td><td><p><code>"sse"</code></p></td></tr><tr><td><p><code>ssePath</code></p></td><td><p>Path to the SSE endpoint.</p></td><td><p>String</p></td><td><p>Yes</p></td><td><p> — </p></td></tr><tr><td><p><code>messagesPath</code></p></td><td><p>Path to the messages endpoint.</p></td><td><p>String</p></td><td><p>No</p></td><td><p>Agent Graph Expression Optional</p></td></tr></tbody></table>

##### StreamableHttpTransport

StreamableHttpTransport has these properties.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Required</th><th>Values</th></tr></thead><tbody><tr><td><p><code>kind</code></p></td><td><p>Transport type.</p></td><td><p>String</p></td><td><p>Yes</p></td><td><p>"streamableHttp"</p></td></tr><tr><td><p><code>path</code></p></td><td><p>Path to the MCP endpoint.</p></td><td><p>String</p></td><td><p>No</p></td><td><p> — </p></td></tr></tbody></table>

##### StdioTransport

StdioTransport has these properties.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Required</th><th>Values</th></tr></thead><tbody><tr><td><p><code>kind</code></p></td><td><p>Transport type.</p></td><td><p>String</p></td><td><p>Yes</p></td><td><p><code>"stdio"</code></p></td></tr><tr><td><p><code>instructions</code></p></td><td><p>Instructions to run the MCP server.</p></td><td><p>String</p></td><td><p>No</p></td><td><p> — </p></td></tr></tbody></table>

### Reference Types

Reference types are reusable objects that point to other entities defined in the registry, such as
agents, MCP servers, LLMs, connections, and policies.

**Example**

```yaml
registry:
  agents:
    myEvaluationAgent:
      type: a2a_agent
      protocol: a2a
      platform: agentforce
      kind: evaluation
      connections:
        - kind: mcp
          ref:
            assetId: my-mcp-server
            version: 1.0.0
          allowed:
            - tool-name-1
      provenance:
        kind: exchange
        metadata:
          organizationId: my-org
```

Reference types used in the Registry section have these properties.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Reference</th><th>Description</th><th>Type</th><th>Required</th><th>Values</th></tr></thead><tbody><tr><td><p><code>AgentRef</code></p></td><td><p>Reference to an agent.</p></td><td><p>Object</p></td><td><p>No</p></td><td><p><code>{ name: string, namespace?: string }</code></p></td></tr><tr><td><p><code>MCPRef</code></p></td><td><p>Reference to an MCP server.</p></td><td><p>Object</p></td><td><p>No</p></td><td><p><code>{ name: string, namespace?: string }</code></p></td></tr><tr><td><p><code>LLMRef</code></p></td><td><p>Reference to an LLM provider.</p></td><td><p>Object</p></td><td><p>No</p></td><td><p><code>{ name: string, namespace?: string }</code></p></td></tr><tr><td><p><code>ConnectionRef</code></p></td><td><p>Reference to a connection.</p></td><td><p>Object</p></td><td><p>No</p></td><td><p><code>{ name: string }</code></p></td></tr><tr><td><p><code>PolicyRef</code></p></td><td><p>Reference to a policy.</p></td><td><p>Object</p></td><td><p>No</p></td><td><p><code>{ name: string, namespace?: string }</code></p></td></tr></tbody></table>

## Context Section

This section is for reusable entities scoped to the graphs defined in the `agent-network.yaml` file.
It holds definitions that are used by the document (for example, connections, policies) but are not
published to the agent registry.

**Example**

```yaml
context:
  connections:
    hr_system_agent:
      kind: a2a
      ref:
        name: hr-system-agent
      url: https://hr-agent.example.com/a2a
      policies:
        outbound:
          - ref:
              name: retry-policy
    salesforce_agent:
      kind: a2a
      ref:
        name: salesforce-agent
      url: https://sfdc-agent.example.com/a2a
    slack_mcp:
      kind: mcp
      ref:
        name: slack-mcp
      url: https://mcp.example.com/slack
    openai_llm:
      kind: llm
      ref:
        name: Open-AI-LLM
      url: https://api.openai.com/v1
      authentication:
        kind: apiKey
        apiKey: "${env.OPENAI_API_KEY}"
  policies:
    retry-policy:
      ref:
        name: retry-policy
      configuration:
        maxAttempts: 3
        backoffMs: 1000
```

The `context` section has these properties.

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th></tr></thead><tbody><tr><td><p>connections</p></td><td><p>The list of connections defined as part of this network.</p></td><td><p>Connection Objects</p></td></tr><tr><td><p>policies</p></td><td><p>Policy definitions that govern connection behavior, access, and execution.</p></td><td><p>Policies Object</p></td></tr></tbody></table>

### Connections

Connection definitions live in the `context` object. Each `connections` object has a kind field that
determines its connection type: either `a2a`, `llm`, or `mcp`.

Connection objects have these properties.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Field Name</th><th>Description</th><th>Type</th><th>Required</th></tr></thead><tbody><tr><td><p><code>kind</code></p></td><td><p>Connection type</p></td><td><p><code>mcp</code>, <code>a2a</code>, or <code>llm</code></p></td><td><p>Yes</p></td></tr><tr><td><p><code>ref</code></p></td><td><p>A reference to an asset representing the target system.</p></td><td><p>Reference Object</p></td><td><p>Yes</p></td></tr><tr><td><p><code>url</code></p></td><td><div><div><p>The base URL of the target system. For <code>llm</code> use these defaults:</p></div><div><ul><li><p>OpenAI: <code>https://api.openai.com/v1</code></p></li><li><p>Gemini: <code>https://generativelanguage.googleapis.com</code></p></li><li><p>Bedrock OpenAI: <code>https://bedrock-mantle.&lt;YOUR_REGION&gt;.api.aws/v1</code></p></li><li><p>Azure OpenAI: <code>https://&lt;YOUR_RESOURCE_NAME&gt;.openai.azure.com/openai/v1</code></p></li></ul></div></div></td><td><p>String</p></td><td><p>No</p></td></tr><tr><td><p><code>authentication</code></p></td><td><p>The authentication method to use when connecting to the target system.</p></td><td><p>Authentication Object</p></td><td><p>No (Yes for <code>llm</code> connections)</p></td></tr><tr><td><p><code>policies</code></p></td><td><p>Policy bindings to apply to this connection, organized by traffic direction.</p></td><td><p>Object</p></td><td><p>No</p></td></tr><tr><td><p><code>policies.inbound</code></p></td><td><p>Policy bindings applied to inbound traffic.</p></td><td><p>Array</p></td><td><p>No</p></td></tr><tr><td><p><code>policies.outbound</code></p></td><td><p>Policy bindings applied to outbound traffic.</p></td><td><p>Array</p></td><td><p>No</p></td></tr><tr><td><p><code>card</code></p></td><td><p>Configuration for fetching the target agent’s agent card. Valid only when <code>kind</code> is <code>a2a</code>. See <a href="#a2a-connection-card">A2A Connection Card</a>.</p></td><td><p>Object</p></td><td><p>No</p></td></tr><tr><td><p><code>interfaces</code></p></td><td><p>The protocol bindings the agent serves, each under a sub-path of <code>url</code>. Valid only when <code>kind</code> is <code>a2a</code>. See <a href="#a2a-connection-interfaces">A2A Connection Interfaces</a>.</p></td><td><p>Object</p></td><td><p>No</p></td></tr></tbody></table>

For `llm` connections, `authentication` is required. LLM connections support `none`, `basic`,
`apiKey`, `apikey-client-credentials`, `oauth2-client-credentials`, and `amazonSigv4`. The
authentication kind must be one that the referenced LLM asset declares in its metadata. LLM
connections don’t support `oauth2-obo`, `in-task-authorization-code`, or `custom` authentication.

For example, to connect to an LLM that uses OAuth 2.0 client credentials authentication:

```yaml
context:
  connections:
    my-llm-connection:
      kind: llm
      ref:
        name: my-llm
      url: https://api.example.com/v1
      authentication:
        kind: oauth2-client-credentials
        clientId: my-client-id
        clientSecret: my-client-secret
        token:
          url: https://auth.example.com/token
        scopes:
          - my.custom.scope
```

You can attach policies to connection objects by referencing their policy identifier or by defining
an inline policy binding. See the [policies object](#policies) for field definitions.

#### A2A Connection Card

Use `card` on an `a2a` connection when the target agent requires different credentials to fetch its
agent card than the connection’s runtime `authentication`.

**Example**

```yaml
context:
   connections:
     hr_system_agent:
       kind: a2a
       ref:
         name: hr-system-agent
        authentication:
          kind: oauth2-client-credentials
          clientId: runtime-client-id
          clientSecret: runtime-client-secret
          token:
            url: https://my-oauth2-provider.com/token
       card:
         authentication:
            kind: apiKey
            apiKey: card-api-key
```

The `card` object has these properties.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Required</th></tr></thead><tbody><tr><td><p><code>authentication</code></p></td><td><p>The authentication to use when fetching the agent’s card. See <a href="#authentication">Authentication</a>.</p></td><td><p>Authentication Object</p></td><td><p>No</p></td></tr></tbody></table>

#### A2A Connection Interfaces

For `a2a` connections, `interfaces` declares which protocol bindings the target agent serves. Each
binding is served under a sub-path of the connection’s `url`.

**Example**

```yaml
context:
  connections:
    hr_system_agent:
      kind: a2a
      ref:
        name: hr-system-agent
      url: https://hr-agent.example.com
      interfaces:
        jsonrpc:
          basePath: /a2a
        http:
          basePath: /rest
```

The `interfaces` object has these properties.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Required</th></tr></thead><tbody><tr><td><p><code>jsonrpc</code></p></td><td><p>The JSON-RPC binding.</p></td><td><p>Object</p></td><td><p>No</p></td></tr><tr><td><p><code>jsonrpc.basePath</code></p></td><td><p>Sub-path of <code>url</code> that serves the JSON-RPC binding.</p></td><td><p>String</p></td><td><p>Yes (if <code>jsonrpc</code> present)</p></td></tr><tr><td><p><code>http</code></p></td><td><p>The HTTP+JSON (REST) binding.</p></td><td><p>Object</p></td><td><p>No</p></td></tr><tr><td><p><code>http.basePath</code></p></td><td><p>Sub-path of <code>url</code> that serves the HTTP+JSON binding.</p></td><td><p>String</p></td><td><p>Yes (if <code>http</code> present)</p></td></tr><tr><td><p><code>grpc</code></p></td><td><p>The gRPC binding.</p></td><td><p>Object</p></td><td><p>No</p></td></tr><tr><td><p><code>grpc.basePath</code></p></td><td><p>Sub-path of <code>url</code> that serves the gRPC binding.</p></td><td><p>String</p></td><td><p>Yes (if <code>grpc</code> present)</p></td></tr></tbody></table>

### Policies

This section describes reusable, composable policy bindings and definitions that govern specific
behaviors or constraints related to connections. You must reference the policy identifier to attach
a policy.

For more information about applying policies via Omni Gateway in Local Mode, see:

- [Securing Agent Interactions with Omni Gateway](https://docs.mulesoft.com/gateway/latest/flex-agent-secure)

- [Applying Policies in Local Mode](https://docs.mulesoft.com/gateway/latest/flex-gateway-secure-local)

**Example**

```yaml
context:
  policies:
    myRateLimitPolicy:
      ref:
        name: myReferenceObject
      configuration:
        - rate: 100
          unit: minute
```

This section has these properties.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Required</th></tr></thead><tbody><tr><td><p>ref</p></td><td><p>Reference to a specific policy definition.</p></td><td><p>Object</p></td><td><p>Yes</p></td></tr><tr><td><p>ref.name</p></td><td><p>Name of the reference definition</p></td><td><p>String</p></td><td><p>Yes</p></td></tr><tr><td><p>configuration</p></td><td><p>Policy-specific configuration (structure defined by the referenced policy definition).</p></td><td><p>Object</p></td><td><p>Yes</p></td></tr></tbody></table>

> [!NOTE] Agent Network uses Omni Gateway. Some policies are available for both Omni Gateway and
> Mule Gateway. For these policies, use these policy definition versions:
>
> - JWT Validation: `0.12.0`. See
>   [JWT Validation Policy](https://docs.mulesoft.com/gateway/latest/policies-included-jwt-validation#agent-network-version).
>
> - OpenID Connect OAuth 2.0 Token Enforcement: `0.11.0`. See
>   [OpenID Connect OAuth 2.0 Token Enforcement Policy](https://docs.mulesoft.com/gateway/latest/policies-included-openid-token-enforcement#agent-network-version).
>
> For these policies only, policy definition versions that start with `1` are for Mule Gateway and
> cause an error.

### Authentication

This section defines the authentication schemes used by the agent network for authenticating when
making outbound requests.

#### No Client Authentication

Use `none` to explicitly declare that a connection doesn’t require authentication. This is different
from omitting the `authentication` object.

**Example**

```yaml
kind: none
```

The no-authentication object has this property.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Valid Values</th><th>Required</th></tr></thead><tbody><tr><td><p>kind</p></td><td><p>The authentication method type.</p></td><td><p>String</p></td><td><p>none</p></td><td><p>Yes</p></td></tr></tbody></table>

#### Basic Client Authentication

HTTP Basic authentication with username and password.

**Example**

```yaml
kind: basic
username: my-username
password: my-password
headerName: Authorization
```

The basic object has these properties.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Valid Values</th><th>Required</th></tr></thead><tbody><tr><td><p>kind</p></td><td><p>The authentication method type.</p></td><td><p>String</p></td><td><p>basic</p></td><td><p>Yes</p></td></tr><tr><td><p>username</p></td><td><p>Username for authentication.</p></td><td><p>String</p></td><td><p>String</p></td><td><p>Yes</p></td></tr><tr><td><p>password</p></td><td><p>Password for authentication.</p></td><td><p>String</p></td><td><p>String</p></td><td><p>Yes</p></td></tr><tr><td><p>headerName</p></td><td><p>The name of the HTTP used for basic credentials. If not specified, Authorization is used.</p></td><td><p>String</p></td><td><p>String. Defaults to Authorization.</p></td><td><p>No</p></td></tr></tbody></table>

#### API Key Client Authentication

Authenticates outbound requests by including an API key in a configurable HTTP header.

**Example**

```yaml
kind: apiKey
apiKey: my-api-key-123
headerName: Authorization
```

An API key passed in a header has these properties.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Valid Values</th><th>Required</th></tr></thead><tbody><tr><td><p>kind</p></td><td><p>The authentication method type.</p></td><td><p>String</p></td><td><p>apiKey</p></td><td><p>Yes</p></td></tr><tr><td><p>headerName</p></td><td><p>The name of the HTTP header that carries the API key. If not specified, Authorization is used.</p></td><td><p>String</p></td><td><p>String. Defaults to Authorization.</p></td><td><p>No</p></td></tr><tr><td><p>apiKey</p></td><td><p>The header or parameter name for the API key.</p></td><td><p>String</p></td><td><p>String</p></td><td><p>No</p></td></tr></tbody></table>

#### API Key Client Credentials Client Authentication

API key client credentials with client ID and client secret objects.

**Example**

```yaml
kind: apikey-client-credentials
clientId:
  value: my-client-id
  name: client_id
clientSecret:
  value: my-client-secret
  name: client_secret
```

The API key client credentials object has these properties.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Valid Values</th><th>Required</th></tr></thead><tbody><tr><td><p>kind</p></td><td><p>The authentication method type.</p></td><td><p>String</p></td><td><p>apikey-client-credentials</p></td><td><p>Yes</p></td></tr><tr><td><p>clientId</p></td><td><p>Description of the client ID to be used.</p></td><td><p>Object</p></td><td><p>Object with value and optional name (default header name is client_id).</p></td><td><p>Yes</p></td></tr><tr><td><p>clientId.value</p></td><td><p>The value for the client ID.</p></td><td><p>String</p></td><td><p>String</p></td><td><p>Yes</p></td></tr><tr><td><p>clientId.name</p></td><td><p>The header or parameter name.</p></td><td><p>String</p></td><td><p>String</p></td><td><p>No</p></td></tr><tr><td><p>clientSecret</p></td><td><p>Description of the client secret to be used.</p></td><td><p>Object</p></td><td><p>Object with value and optional name (default header name is client_secret).</p></td><td><p>No</p></td></tr><tr><td><p>clientSecret.value</p></td><td><p>The value for the client secret.</p></td><td><p>String</p></td><td><p>String</p></td><td><p>Yes</p></td></tr><tr><td><p>clientSecret.name</p></td><td><p>The header or parameter name.</p></td><td><p>String</p></td><td><p>String</p></td><td><p>No</p></td></tr></tbody></table>

#### Amazon Signature Version 4 Client Authentication

Use `amazonSigv4` to sign outbound requests with AWS Signature Version 4. If you don’t provide
static credentials, credentials are resolved from the platform’s AWS credential provider chain.

**Example**

```yaml
kind: amazonSigv4
awsAccessKeyId: my-access-key-id
awsSecretAccessKey: my-secret-access-key
awsSessionToken: my-session-token
awsRegion: us-east-1
serviceName: bedrock
```

The Amazon Signature Version 4 object has these properties.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Valid Values</th><th>Required</th></tr></thead><tbody><tr><td><p>kind</p></td><td><p>The authentication method type.</p></td><td><p>String</p></td><td><p>amazonSigv4</p></td><td><p>Yes</p></td></tr><tr><td><p>awsAccessKeyId</p></td><td><p>Static AWS access key ID for signing requests.</p></td><td><p>String</p></td><td><p>String</p></td><td><p>No</p></td></tr><tr><td><p>awsSecretAccessKey</p></td><td><p>Static AWS secret access key for signing requests.</p></td><td><p>String</p></td><td><p>String</p></td><td><p>No</p></td></tr><tr><td><p>awsSessionToken</p></td><td><p>AWS session token for temporary credentials. When present, it is sent as <code>X-Amz-Security-Token</code>.</p></td><td><p>String</p></td><td><p>String</p></td><td><p>No</p></td></tr><tr><td><p>awsRegion</p></td><td><p>AWS Region in the SigV4 credential scope. It must match the upstream endpoint region.</p></td><td><p>String</p></td><td><p>String. Defaults to <code>us-east-1</code>.</p></td><td><p>No</p></td></tr><tr><td><p>serviceName</p></td><td><p>AWS service name in the SigV4 credential scope.</p></td><td><p>String</p></td><td><p>String. Defaults to <code>bedrock</code>.</p></td><td><p>No</p></td></tr></tbody></table>

#### OAuth 2.0 Client Credentials Grant Client Authentication

OAuth 2.0 authentication using the Client Credentials Grant Type. Allows agents to obtain access
tokens using a client ID and client secret from the token provider.

**Example**

```yaml
kind: oauth2-client-credentials
clientId: my-client-id
clientSecret: my-client-secret
token:
  url: https://my-oauth2-provider.com/token
  timeout: 15
  bodyEncoding: form
scopes:
  - my.custom.scope
  - another.scope
```

The oauth2-client-credentials object has these properties.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Valid Values</th><th>Required</th></tr></thead><tbody><tr><td><p>kind</p></td><td><p>The authentication method type.</p></td><td><p>String</p></td><td><p>oauth2-client-credentials</p></td><td><p>Yes</p></td></tr><tr><td><p>clientId</p></td><td><p>The client ID to authenticate with the OAuth2 provider.</p></td><td><p>String</p></td><td><p>String</p></td><td><p>Yes</p></td></tr><tr><td><p>clientSecret</p></td><td><p>The client secret used with client ID.</p></td><td><p>String</p></td><td><p>String</p></td><td><p>Yes</p></td></tr><tr><td><p>token</p></td><td><p>Configuration for how to fetch the token.</p></td><td><p>Object</p></td><td><p>Token object</p></td><td><p>Yes</p></td></tr><tr><td><p>token.url</p></td><td><p>The URL of the token provider (token endpoint).</p></td><td><p>String</p></td><td><p>Valid URL string</p></td><td><p>Yes</p></td></tr><tr><td><p>token.timeout</p></td><td><p>Time in seconds to wait for the token service to respond.</p></td><td><p>Number</p></td><td><p>Any number</p></td><td><p>No</p></td></tr><tr><td><p>token.bodyEncoding</p></td><td><p>Content encoding for the request body. (<code>form = application/x-www-form-urlencoded</code>, <code>json = application/json</code>)</p></td><td><p>String</p></td><td><p><code>form</code> or <code>json</code></p></td><td><p>No</p></td></tr><tr><td><p>scopes</p></td><td><p>Array of scopes to request during token retrieval.</p></td><td><p>Array</p></td><td><p>Array of scope strings. Defaults to []</p></td><td><p>No</p></td></tr></tbody></table>

#### In-Task Authorization Code

Use in-task authorization code when the connection needs secondary credentials obtained during a
task using the OAuth 2.0 Authorization Code flow. OAuth2 tokens are extracted from message data and
injected into the Authorization header for upstream calls. This supports step-up or in-task
authentication (for example, when a user must re-authenticate for a sensitive action). For more
information about the associated policy, see
[A2A In-Task Authorization Code Policy](https://docs.mulesoft.com/gateway/latest/policies-outbound-a2a-intask-authorization-code).

**Example**

```yaml
authentication:
  kind: in-task-authorization-code
  secondaryAuthProvider: providerName
  authorizationEndpoint: https://oauth.provider.com/authorize
  tokenEndpoint: https://oauth.provider.com/token
  scopes: Read
  redirectUri: https://oauth.provider.com/callback
  responseType: code
  tokenAudience: https://api.example.com/agents/my-agent
  codeChallengeMethod: S256
  bodyEncoding: form
  challengeResponseStatusCode: 200
  tokenTimeout: 300
```

The in-task-authorization-code authentication has these properties.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Valid Values</th><th>Required</th></tr></thead><tbody><tr><td><p>kind</p></td><td><p>Authentication type.</p></td><td><p>String</p></td><td><p>in-task-authorization-code</p></td><td><p>Yes</p></td></tr><tr><td><p>authorizationEndpoint</p></td><td><p>OAuth2 authorization endpoint URL. Used to generate the authentication challenge.</p></td><td><p>String</p></td><td><p>Valid URL</p></td><td><p>Yes</p></td></tr><tr><td><p>tokenEndpoint</p></td><td><p>OAuth2 token endpoint URL. Used to generate the authentication challenge.</p></td><td><p>String</p></td><td><p>Valid URL</p></td><td><p>Yes</p></td></tr><tr><td><p>scopes</p></td><td><p>OAuth2 scopes required for step-up authentication.</p></td><td><p>String</p></td><td><p>Space- or comma-separated scope list (for example, openid profile email)</p></td><td><p>Yes</p></td></tr><tr><td><p>redirectUri</p></td><td><p>OAuth2 redirect URI the client uses in the authorization flow.</p></td><td><p>String</p></td><td><p>Valid URI</p></td><td><p>Yes</p></td></tr><tr><td><p>secondaryAuthProvider</p></td><td><p>Name of the IdP (for example, okta, auth0). Informational only, for the authentication card.</p></td><td><p>String</p></td><td><p>Any string</p></td><td><p>No</p></td></tr><tr><td><p>responseType</p></td><td><p>OAuth2 response type.</p></td><td><p>String</p></td><td><p>Typically code. Default: code</p></td><td><p>No</p></td></tr><tr><td><p>codeChallengeMethod</p></td><td><p>PKCE code challenge method.</p></td><td><p>String</p></td><td><p>Typically S256. Default: S256</p></td><td><p>No</p></td></tr><tr><td><p>tokenAudience</p></td><td><p>Intended recipient of the token (for example, agent1 or API URL).</p></td><td><p>String</p></td><td><p>Any string</p></td><td><p>No</p></td></tr><tr><td><p>bodyEncoding</p></td><td><p>Encoding for the token request body.</p></td><td><p>String</p></td><td><p>form, json. Default: form</p></td><td><p>No</p></td></tr><tr><td><p>tokenTimeout</p></td><td><p>Timeout in seconds for token requests.</p></td><td><p>Integer</p></td><td><p>Positive integer. Default: 300</p></td><td><p>No</p></td></tr><tr><td><p>challengeResponseStatusCode</p></td><td><p>HTTP status code returned for auth-required challenge responses. Typically 200 for JSON-RPC compatibility.</p></td><td><p>Integer</p></td><td><p>HTTP status code. Default: 200</p></td><td><p>No</p></td></tr><tr><td><p>distributed</p></td><td><p>Share token cache across replicas. Required for fully managed gateway or any multi-replica deployment.</p></td><td><p>Boolean</p></td><td><p><code>true</code> or <code>false</code>. Default: <code>false</code></p></td><td><p>No</p></td></tr><tr><td><p>subjectTokenType</p></td><td><p>The token type identifier for the subject token.</p></td><td><p>String</p></td><td><p>Default: <code>urn:ietf:params:oauth:token-type:access_token</code></p></td><td><p>No</p></td></tr><tr><td><p>requestedTokenType</p></td><td><p>The desired token type for the issued token.</p></td><td><p>String</p></td><td><p>Any string</p></td><td><p>No</p></td></tr></tbody></table>

#### OAuth 2.0 OBO Credential Injection

This authentication type supports OAuth 2.0 Token Exchange and Microsoft Entra ID On-Behalf-Of
protocols. For more information about the associated policy, see
[OAuth 2.0 OBO Credential Injection Policy](https://docs.mulesoft.com/gateway/latest/policies-outbound-oauth-obo).

**Using OAuth 2.0 Token Exchange**

```yaml
authentication:
   kind: oauth2-obo
   flow: oauth2-token-exchange
   tokenEndpoint: https://oauth.provider.com/token
   clientId: clientId
   clientSecret: clientSecret
   targetType: audience
    targetValue: https://api.example.com/agents/my-agent
    scope: Read
    timeout: 5000
```

**Using Microsoft Entra ID On-Behalf-Of**

```yaml
authentication:
  kind: oauth2-obo
  flow: microsoft-entra-obo
  tokenEndpoint: https://oauth.provider.com/token
  clientId: clientId
  clientSecret: clientSecret
  scope: api://downstream-client-id/.default
  timeout: 5000
```

The `oauth2-obo` authentication has these properties.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Valid Values</th><th>Required</th></tr></thead><tbody><tr><td><p>kind</p></td><td><p>Authentication type.</p></td><td><p>String</p></td><td><p>oauth2-obo</p></td><td><p>Yes</p></td></tr><tr><td><p>flow</p></td><td><p>Token exchange flow type.</p></td><td><p>String</p></td><td><p>oauth2-token-exchange, microsoft-entra-obo</p></td><td><p>Yes</p></td></tr><tr><td><p>clientId</p></td><td><p>OAuth2 client ID for token exchange.</p></td><td><p>String</p></td><td><p>String</p></td><td><p>Yes</p></td></tr><tr><td><p>clientSecret</p></td><td><p>OAuth2 client secret for token exchange.</p></td><td><p>String</p></td><td><p>String</p></td><td><p>Yes</p></td></tr><tr><td><p>tokenEndpoint</p></td><td><p>OAuth2 token endpoint URL for token exchange.</p></td><td><p>String</p></td><td><p>Valid URL</p></td><td><p>Yes</p></td></tr><tr><td><p>targetType</p></td><td><p>Parameter type for specifying the target service (audience for logical name, resource for physical URI). Used for OAuth 2.0 Token Exchange.</p></td><td><p>String</p></td><td><p>audience, resource. Default: audience</p></td><td><p>No</p></td></tr><tr><td><p>targetValue</p></td><td><p>Target audience URI or resource URI for the exchanged token. Required for OAuth 2.0 Token Exchange.</p></td><td><p>String</p></td><td><p>Valid URI</p></td><td><p>Required when using oauth2-token-exchange with a target</p></td></tr><tr><td><p>scope</p></td><td><p>OAuth scope to request. Required for Microsoft Entra OBO (for example, api://downstream-client-id/.default). Optional for OAuth 2.0 Token Exchange.</p></td><td><p>String</p></td><td><p>String</p></td><td><p>Required for microsoft-entra-obo</p></td></tr><tr><td><p>timeout</p></td><td><p>Timeout for token exchange requests in milliseconds.</p></td><td><p>Integer</p></td><td><p>Positive integer. Default: 10000</p></td><td><p>No</p></td></tr><tr><td><p>cibaEnabled</p></td><td><p>When <code>true</code>, it uses Client Initiated Backchannel Authentication (CIBA) instead of standard OBO token exchange. Only valid when <code>flow</code> is <code>oauth2-token-exchange</code>.</p></td><td><p>Boolean</p></td><td><p><code>true</code> or <code>false</code>. Default: <code>false</code></p></td><td><p>No</p></td></tr><tr><td><p>cibaEndpoint</p></td><td><p>Backchannel authorization (<code>bc-authorize</code>) endpoint URL for CIBA.</p></td><td><p>String</p></td><td><p>Valid URL</p></td><td><p>No</p></td></tr><tr><td><p>cibaLoginHintClaim</p></td><td><p>JWT claim from the subject token to send as the CIBA <code>login_hint</code> (for example, <code>email,</code> <code>sub</code>).</p></td><td><p>String</p></td><td><p>String. Default: <code>email</code></p></td><td><p>No</p></td></tr><tr><td><p>cibaBindingMessage</p></td><td><p>Optional message shown on the user’s authentication device during CIBA approval.</p></td><td><p>String</p></td><td><p>String</p></td><td><p>No</p></td></tr><tr><td><p>distributed</p></td><td><p>Share token cache across replicas. Required for fully managed gateway or any multi-replica deployment.</p></td><td><p>Boolean</p></td><td><p><code>true</code> or <code>false</code>. Default: <code>false</code></p></td><td><p>No</p></td></tr></tbody></table>

## Brokers Section

Use this section to define brokers that orchestrate and control the flow of agent and tool
invocations. Each broker object maps to an `.agent` file. You can have multiple Agent Script files
in your `/brokers` directory.

**Example**

```yaml
brokers:
  customer_service_agent:
    kind: AgentScript
    implementation: ./brokers/customer-service.agent
    interfaces:
      a2a:
        card:
          name: customer-service-agent
          description: Routes customer service requests.
          version: "1.0.0"
        policies:
          inbound:
            - ref:
                name: rate-limit-policy
  billing_agent:
    kind: AgentScript
    implementation: ./brokers/billing-handler.agent
    interfaces:
      a2a:
        card:
          name: billing-agent
          description: Handles billing inquiries.
          version: "1.0.0"
```

The `brokers` section has these properties.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Required</th><th>Values</th></tr></thead><tbody><tr><td><p><code><em>(broker id)</em></code></p></td><td><p>Named broker definition.</p></td><td><p>Object</p></td><td><p>No</p></td><td><p>Keys: identifiers using only lowercase <code>a</code>–<code>z</code>, <code>0</code>–<code>9</code>, and non-trailing underscores (<code>_</code>). Values: broker entity (BrokerEntity in agent_network_v2.json)</p></td></tr><tr><td><p><code>kind</code></p></td><td><p>The type of agent implementation.</p></td><td><p>String</p></td><td><p>Yes</p></td><td><p><code>AgentScript</code></p></td></tr><tr><td><p><code>implementation</code></p></td><td><p>The path to the Agent Script implementation file.</p></td><td><p>String</p></td><td><p>Yes</p></td><td><p> — </p></td></tr><tr><td><p><code>interfaces</code></p></td><td><p>Exposed interfaces for this broker.</p></td><td><p>Object</p></td><td><p>Yes</p></td><td><p><code>a2a</code></p></td></tr></tbody></table>

### interfaces.a2a

The `a2a` interface defines how external clients interact with a broker through the Agent2Agent
protocol. It contains the broker’s agent card and any inbound or outbound policy bindings.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Required</th></tr></thead><tbody><tr><td><p><code>card</code></p></td><td><p>The A2A agent card. See <a href="#a2a-card">A2A Card</a>.</p></td><td><p>AgentCard</p></td><td><p>No</p></td></tr><tr><td><p><code>policies</code></p></td><td><p>Inbound and outbound policy binding lists for this interface.</p></td><td><p>Object</p></td><td><p>No</p></td></tr><tr><td><p><code>policies.inbound</code></p></td><td><p>Policy bindings for inbound traffic.</p></td><td><p>Array</p></td><td><p>No</p></td></tr><tr><td><p><code>policies.outbound</code></p></td><td><p>Policy bindings for outbound traffic.</p></td><td><p>Array</p></td><td><p>No</p></td></tr></tbody></table>

#### User Identity and Task Security

The broker derives a `userId` from the authentication context of the security policy applied at the
broker’s ingress. This `userId` secures
[A2A task management operations](https://docs.mulesoft.com/agent-network/latest/af-agent-script-reference#a2a-trigger), ensuring that only the
authenticated user who owns a task can query or modify it. This includes `SendMessage` and
`SendStreamingMessage` operations that target an existing task.

If no authentication policy is configured at the broker’s ingress, or if a `userId` cannot be
determined from the authentication context, the broker continues to orchestrate normally. However,
A2A task management operations (such as querying task status, canceling a task, or sending messages
to an existing task) are not available for tasks created without an associated `userId`.

#### Policy Binding Reference

Use a policy binding reference to attach a previously declared policy to a broker interface by name.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Required</th></tr></thead><tbody><tr><td><p><code>ref.name</code></p></td><td><p>Name of the declared policy binding. See <a href="#policies">Policies</a>.</p></td><td><p>String</p></td><td><p>Yes</p></td></tr></tbody></table>

#### Inline Policy Binding

Use an inline policy binding to define a policy directly on the broker interface without declaring
it elsewhere first.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Type</th><th>Required</th></tr></thead><tbody><tr><td><p><code>policy</code></p></td><td><p>The policy to be applied.</p></td><td><p>Object</p></td><td><p>Yes</p></td></tr><tr><td><p><code>policy.ref</code></p></td><td><p>Reference to the policy definition.</p></td><td><p>PolicyRef See <a href="#policies">Policies</a>.</p></td><td><p>Yes</p></td></tr><tr><td><p><code>policy.configuration</code></p></td><td><p>Policy-specific configuration.</p></td><td><p>Object</p></td><td><p>Yes</p></td></tr></tbody></table>

## Expressions Format

Use Python expressions to resolve or calculate values that are only available at runtime.

Enclose expressions using the {{}} evaluation wrapper. You can also use multiline statements using
the [appropriate YAML syntax](https://yaml.org/spec/1.2.2/#54-line-break-characters).

**Example**

```yaml
- reasoning:
    id: welcome-message
    description: "Send a welcome message to the candidate."
    llm: my-primary-llm
    prompt:
      "Extract the email from {{input}} and send a greeting email to the user saying their
      onboarding process has started"
    tools:
      - ref: my-email-tool
```

Expressions have these properties.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Variable Name</th><th>Description</th><th>Type</th><th>Required</th></tr></thead><tbody><tr><td><p>input</p></td><td><p>Payload or parameters provided as input to the node.</p></td><td><p>Type defined by Graph</p></td><td><p>Yes</p></td></tr><tr><td><p>variables</p></td><td><p>A mutable key-value store for variables scoped to the execution of the graph instance.</p></td><td><p>Dict[string, any]</p></td><td><p>Yes</p></td></tr><tr><td><p>{node-ids}</p></td><td><p>Read-only mapping of all node definitions available in the current graph, indexed by node id.</p></td><td><p>Dict[string, Object]</p></td><td><p>Yes</p></td></tr></tbody></table>

{node-ids} have these properties.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Variable Name</th><th>Type</th><th>Description</th><th>Required</th></tr></thead><tbody><tr><td><p>input</p></td><td><p>Type defined by Graph</p></td><td><p>Input to the node as it happened.</p></td><td><p>Yes</p></td></tr><tr><td><p>output</p></td><td><p>Type defined by Graph</p></td><td><p>Output provided by the node as it happened</p></td><td><p>Yes</p></td></tr></tbody></table>

## Exchange.JSON File

All agent network projects have an `exchange.json` file. This file contains asset metadata available
in Anypoint Exchange after publishing your agent network assets.

**Example**

```json
{
  "main": "agent-network.yaml",
  "name": "Employee Onboarding Network",
  "classifier": "agentic-network",
  "organizationId": "85de5a54-1f33-4ea4-a1bf-8a65bc409179",
  "descriptorVersion": "1.0.0",
  "tags": [],
  "groupId": "85de5a54-1f33-4ea4-a1bf-8a65bc409179",
  "assetId": "employee-onboarding-network",
  "version": "1.0.5",
  "dependencies": [
    {
      "groupId": "85de5a54-1f33-4ea4-a1bf-8a65bc409179",
      "assetId": "hr-agent",
      "version": "1.0.21",
      "classifier": "agent-metadata",
      "packaging": "zip"
    }
  ],
  "metadata": {
    "variables": {
      "openai": {
        "clientId": {
          "description": "OpenAI LLM Client ID",
          "default": ""
        },
        "clientSecret": {
          "description": "OpenAI LLM Client Secret",
          "default": "",
          "secret": true
        },
        "url": {
          "description": "OpenAI URL",
          "default": "",
          "secret": false
        }
      }
    }
  }
}
```

These key-value pairs are important for your agent network configuration:

- groupId: ID of the Anypoint business group that owns your agent network and all the assets derived
  from it.

- assetId: Unique identifier for the agent network project.

- dependencies: Existing assets that this network needs to reference.

- variables: Nested in the metadata section, defines all the variables whose values shouldn’t be
  hardcoded in the `agent-network.yaml` file. Enter these values when publishing the agent network.
  Each variable has a description value, a default value, and a secret value that indicates whether
  it’s treated as sensitive or not.

For more information about versioning assets in agent network projects, see
[Version Assets](https://docs.mulesoft.com/agent-network/latest/af-publish-agent-network-assets#version-assets).

### Runtime System Limits Configuration

You can configure runtime system limits for your agent network by adding specific variables to the
`metadata.variables` section of your `exchange.json` file. These variables control graph execution
behavior and help prevent infinite loops or excessive resource usage.

**Example**

```json
{
  "main": "agent-network.yaml",
  "name": "it-investigation-GA-version",
  "classifier": "agentic-network",
  "organizationId": "{YOUR ORG ID}",
  "descriptorVersion": "1.0.0",
  "tags": [],
  "metadata": {
    "variables": {
      "openai": {
        "apiKey": {
          "description": "OpenAI API key",
          "default": "",
          "secret": true
        }
      },
      "MODULE_GRAPH_ERROR_SETTINGS_MAX_HANDOFF_ITERATIONS": {
        "description": "max node-to-node transitions per turn",
        "secret": false,
        "default": "30"
      },
      "MODULE_GRAPH_ERROR_SETTINGS_MAX_REASONING_ITERATIONS": {
        "description": "max LLM reasoning loops within a single node",
        "secret": false,
        "default": "20"
      },
      "MODULE_GRAPH_ERROR_SETTINGS_MAX_SUBGRAPH_DEPTH": {
        "description": "max subgraph nesting depth",
        "secret": false,
        "default": "10"
      },
      "MODULE_GRAPH_ERROR_SETTINGS_MAX_NODE_TOOL_CALL_ITERATIONS": {
        "description": "max tool_executor runs per node",
        "secret": false,
        "default": "20"
      },
      "MODULE_GRAPH_ERROR_SETTINGS_MAX_TURN_TOOL_CALL_COUNTS": {
        "description": "total tool invocations across all nodes per turn",
        "secret": false,
        "default": "50"
      },
      "MODULE_GRAPH_ERROR_SETTINGS_MAX_STATE_SIZE_BYTES": {
        "description": "max accumulated state size in bytes (10 MB)",
        "secret": false,
        "default": "10485760"
      }
    }
  },
  "apiVersion": "v1.0",
  "dependencies": [],
  "groupId": "{YOUR ORG ID}",
  "assetId": "it-investigation-GA-version",
  "version": "1.0.0"
}
```

#### Runtime System Limit Variables

The following table describes the runtime system limit variables you can configure:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Variable Name</th><th>Description</th><th>Default Value</th></tr></thead><tbody><tr><td><p><code>MODULE_GRAPH_ERROR_SETTINGS_MAX_HANDOFF_ITERATIONS</code></p></td><td><p>Maximum number of node-to-node transitions allowed per turn. Controls how many times execution can move between nodes in the agent network graph during a single conversation turn.</p></td><td><p>30</p></td></tr><tr><td><p><code>MODULE_GRAPH_ERROR_SETTINGS_MAX_REASONING_ITERATIONS</code></p></td><td><p>Maximum number of LLM reasoning loops allowed within a single node. Limits how many times the LLM can iterate on its reasoning before producing a result.</p></td><td><p>20</p></td></tr><tr><td><p><code>MODULE_GRAPH_ERROR_SETTINGS_MAX_SUBGRAPH_DEPTH</code></p></td><td><p>Maximum nesting depth for subgraphs. Controls how deeply agent networks can be nested within other agent networks.</p></td><td><p>10</p></td></tr><tr><td><p><code>MODULE_GRAPH_ERROR_SETTINGS_MAX_NODE_TOOL_CALL_ITERATIONS</code></p></td><td><p>Maximum number of tool executor runs allowed per node. Limits how many times a node can invoke tool execution during its processing.</p></td><td><p>20</p></td></tr><tr><td><p><code>MODULE_GRAPH_ERROR_SETTINGS_MAX_TURN_TOOL_CALL_COUNTS</code></p></td><td><p>Total number of tool invocations allowed across all nodes per turn. Provides a global limit on tool usage during a single conversation turn.</p></td><td><p>50</p></td></tr><tr><td><p><code>MODULE_GRAPH_ERROR_SETTINGS_MAX_STATE_SIZE_BYTES</code></p></td><td><p>Maximum accumulated state size in bytes. Limits the total amount of state data that can be accumulated during graph execution. Default is 10 MB (10485760 bytes).</p></td><td><p>10485760</p></td></tr><tr><td><p><code>OBJECT_STORE_DEFAULT_TTL_MS</code></p></td><td><p>Maximum amount of time, in milliseconds, for data persistence. The default is 24 hours (86,400,000 ms).</p></td><td><p>30 days (2,592,000,000 ms)</p></td></tr></tbody></table>

Specify all runtime system limit variables as string values in the `exchange.json` file. All
variables are non-sensitive (`secret: false`).