Register an agent

Open Gateway › Agents and choose Add agent. Owners and admins can add agents; other members see the registry but cannot change it.

• Agent ID. The agent's path at the gateway, /a2a/<agent-id>. It cannot be changed later.
• Where it runs. An A2A server, a Bedrock AgentCore runtime, or No endpoint.
• URL. For an A2A server, the agent's base URL or its card's URL; the card is read from /.well-known/agent-card.json. For AgentCore, the runtime ARN. CoreValue reaches the agent only over HTTPS at a public address, and checks this on every request.
• A2A version it speaks. 0.3 or 1.0. Callers can use either; CoreValue translates.
• Who may call it. Anyone in the organisation, or only the agents, teams and members you choose. This is decided from the caller's key, never from a header.
• Headers passed through from callers. None by default. Authorization, cookies and Cova-* headers are never passed.
• Require a task trace. Refuse calls that do not carry a Cova-Task-Trace header, so every call can be tied to its task.
• Loop limit. How many times one agent may call this one within a task: the organisation's limit, no limit, or its own.
• Credential the gateway sends. Optional. For an A2A server, a secret sent as Authorization: Bearer <secret> unless you name another header; for AgentCore, IAM (SigV4) keys or an OAuth bearer token. It is stored encrypted, and never returned by the API or shown in the console.

An agent with no endpoint

Most agents call models and tools but are never called by another agent. Register one with No endpoint to give it an identity: bind it to the keys it calls with, and its LLM and MCP traffic is attributed to it and access rules can name it. It takes only an agent ID and a name. CoreValue never calls it: an A2A call addressed to it is answered as if no such agent existed (404). Agents with no endpoint are available on every plan; reaching agents through the gateway needs a plan that includes the agent gateway.

After saving

After saving an A2A server, use Test to read the agent's published card and check its protocol version, whether it streams, its skills and its own authentication scheme.

Use Keys to bind the CoreValue keys the agent itself calls with. LLM, MCP and A2A traffic made with those keys is then attributed to the agent, and access rules that name the agent apply to it. A key can belong to one agent at a time.

Changes reach the gateway within a minute.