file state
default
Default in-graph StateBackend — files the model writes disappear into LangGraph state.
on a2a
WorkspaceBackend — the A2A workspace (MinIO/FUSE) is the source of truth. Files land and persist.
deepagents
Run DeepAgents in production.
DeepAgents — planning, subagents, a virtual file system — are built for long, complex tasks. But their default in-graph backend loses the files the model writes and has nowhere separate to run code. a2a cloud hosts DeepAgents with a workspace-backed backend: files land in a real per-agent workspace, each `execute` command uses a separate microsandbox, and governed Agent API, public `/invoke`, and standard MCP `tools/call` executions receive signed evidence.
workspace-backed · sandboxed · signed
0
deploy command
0
files lost to state
signed execution entry points
the problem
DeepAgents' default backend loses your files.
DeepAgents defaults to an in-graph StateBackend. That's fine for scratch state, but it's the wrong default for a hosted agent: files the model writes disappear into LangGraph state instead of landing in the caller's workspace, there's no isolated place to run code, and nothing records what the run actually did. Ship that as a product and you're stitching hosting, storage, a sandbox, and audit around it yourself.
Files written by DeepAgents' file tools vanish into graph state — not durable, not downloadable.
`execute` has no sandboxed runtime by default — arbitrary code runs in your process.
Subagent handoffs reuse the caller's full credentials.
No signed record of inputs, tool calls, or artifacts for a given run.
the a2a way
Hosted DeepAgents, with a real workspace and proof.
a2a_pack.deepagents swaps the backend so the A2A workspace and sandbox — not in-graph state — are the authority. Deploy the graph you already have.
Workspace-backed filesSandboxed executeBuilt-in tools that persistScoped grants for subagentsSigned execution evidenceOne deploy, the whole appDrop-in backend
Workspace-backed files
a2a_pack.deepagents ships a WorkspaceBackend that makes the invocation workspace the source of truth. DeepAgents' built-in file tools write to the caller's MinIO/FUSE workspace instead of vanishing into LangGraph state.
Sandboxed execute
When a sandbox is attached, each DeepAgents `execute` command routes through a separate workspace-mounted libkrun microsandbox. The hosted graph itself remains a Knative or Kubernetes container service.
Built-in tools that persist
read, write, edit, and download map onto the A2A workspace contract, so artifacts a DeepAgents run produces survive the task and are downloadable — not trapped in graph scratch state.
Scoped grants for subagents
DeepAgents spawns subagents and hands off work. Delegation can carry an Ed25519-signed grant with audience, TTL, file, and tool scope instead of passing a shared credential. Formal A2A routes do not automatically mint grants for every exchange.
Signed execution evidence
Agent API, public `/invoke`, and standard MCP `tools/call` executions receive receipts covering caller identity/classification, skill, input evidence, verified grant IDs, outcome/result preview, and timing. Formal A2A routes are protocol state.
One deploy, the whole app
`a2a deploy` gives your DeepAgents agent a hosted A2A + MCP service, an OpenAPI gateway, a managed Postgres database, auth, and TLS. Keep the graph; skip the infra.
Drop-in backend
WorkspaceBackend targets DeepAgents' BackendProtocol, so you keep your existing DeepAgents graph and swap the backend — the authority is A2A's workspace/sandbox contract, not DeepAgents state.
side-by-side
DeepAgents defaults vs. DeepAgents on a2a.
code execution
default
`execute` runs wherever you wired it, if at all — usually the host process.
on a2a
`execute` routes through a workspace-mounted libkrun microVM sandbox.
isolation
default
Subagents and tools share one process and its ambient authority.
on a2a
A separate microsandbox boundary for each explicit `execute` command.
multi-agent auth
default
Subagent handoffs reuse the caller's credentials.
on a2a
Ed25519-signed grants: audience-bound, time-limited, scope-constrained.
audit
default
Mutable application logs you can edit or lose.
on a2a
Signed receipts on authenticated Agent API, public `/invoke`, and standard MCP `tools/call` executions.
deploy
default
Wire hosting, a database, auth, and an API yourself.
on a2a
One `a2a deploy` — hosted A2A + MCP, Postgres, gateway, TLS.
dimension
default
on a2a
file state
Default in-graph StateBackend — files the model writes disappear into LangGraph state.
WorkspaceBackend — the A2A workspace (MinIO/FUSE) is the source of truth. Files land and persist.
code execution
`execute` runs wherever you wired it, if at all — usually the host process.
`execute` routes through a workspace-mounted libkrun microVM sandbox.
isolation
Subagents and tools share one process and its ambient authority.
A separate microsandbox boundary for each explicit `execute` command.
multi-agent auth
Subagent handoffs reuse the caller's credentials.
Ed25519-signed grants: audience-bound, time-limited, scope-constrained.
audit
Mutable application logs you can edit or lose.
Signed receipts on authenticated Agent API, public `/invoke`, and standard MCP `tools/call` executions.
deploy
Wire hosting, a database, auth, and an API yourself.
One `a2a deploy` — hosted A2A + MCP, Postgres, gateway, TLS.
questions
Frequently asked.
What is DeepAgents?
DeepAgents is a framework for long-horizon agents that combines a planning tool, subagents, a virtual file system, and detailed prompting so an agent can tackle complex, multi-step tasks instead of shallow one-shot tool calls.
How do I run DeepAgents in production?
Deploy them on a2a cloud. The a2a_pack.deepagents WorkspaceBackend plugs into DeepAgents' BackendProtocol, and `a2a deploy` turns your DeepAgents graph into a hosted A2A + MCP service with a database, auth, and an API — no infrastructure to wire up.
Why do my DeepAgents files disappear?
DeepAgents defaults to an in-graph StateBackend, so files the model writes live inside LangGraph state and don't land anywhere durable. a2a's WorkspaceBackend makes the invocation workspace (MinIO/FUSE) the source of truth, so file tools write to a real, downloadable workspace.
Can DeepAgents run code safely on a2a?
Yes. When a sandbox is attached, each DeepAgents `execute` command is routed through a separate workspace-mounted libkrun microVM. The hosted graph remains a container service; the VM boundary applies to the explicit sandbox command, and the privileged sandbox daemon remains part of the trusted computing base.
How do DeepAgents subagents authenticate to each other?
Platform-managed subagent delegation can carry an Ed25519-signed grant binding audience, short TTL, and file or tool scope. Formal A2A messages remain protocol state, and separately configured agent secrets are outside that grant boundary.
Does this work with the standard DeepAgents API?
WorkspaceBackend implements DeepAgents' BackendProtocol, so you keep your existing graph and swap the backend. The authority becomes A2A's workspace and sandbox contract instead of DeepAgents' in-graph state.
primary sources
Check the source, not just our summary.
LangChain Deep Agents overview ↗
Official overview of planning, subagents, filesystem backends, sandbox execution, and long-term memory.
Deep Agents backends ↗
Official documentation for pluggable filesystem and sandbox backends.
a2a DeepAgents API reference ↗
Technical reference for a2a_pack.deepagents and the workspace-backed adapter.
Last checked 18 July 2026 · External specifications and policies can change
keep reading
Related guides.
All guides live in the guides index.
deploy deepagents
Ship the graph. Keep the proof.
Point a2a_pack.deepagents at your DeepAgents graph and run `a2a deploy`. You get a container-hosted A2A + MCP service with managed Postgres, a persistent workspace, a separate microsandbox for explicit `execute` commands, scoped grants between subagents, and Ed25519-signed receipts on authenticated Agent API, public `/invoke`, and standard MCP `tools/call` executions.