An AI agent deployment platform, end to end.
a2a cloud is a closed loop: callers hit a protocol edge, the runtime executes against scoped grants, the control plane mints + verifies + records, durable stores keep the proof. Same primitives across every agent.
Agent API, public /invoke, and standard MCP tools/call executions are signed and persisted by trusted control-plane paths.
Agent identity stays stable; caller assurance follows the Agent API or gateway sealing path.
Receipts + audit log persist independent of the agent image.
Real deployment, real services.
The actual service map a CTO would see in a runbook. Every node is a directory in this repo; every edge is a call path the runtime makes today.
- A2A peer · MCP clientbrowser · agent · Claude/Cursorexternal
- dashboardoperator UI · receipts viewerapps/dashboard
- control-planeauth · registry · grants · deploysapps/control-plane
- giteaagent source · OCI buildruntime-infra/gitea.yaml
- AgentCard/.well-known/agent-card.jsona2a_pack/card.py
- agent runtime/tasks · /mcp · /invoke · SSEa2a_pack/serve
- sandbox-runtimemicrosandbox · FUSE · seccompapps/sandbox-runtime
- workspace storeMinIO · scoped bucketsa2a_pack/workspace.py
- receipts ledgerEd25519-signed · postgresa2a_pack/receipts.py
- control-plane · apps/control-plane
- agent runtime · apps/a2a/a2a_pack/serve
- sandbox-runtime · apps/sandbox-runtime
- receipts ledger · a2a_pack/receipts.py
- dashboard · apps/dashboard
What you'd actually deploy. Real services, real call paths, real audit surface.
Vercel-shaped DX. Production-shaped ops.
Developer gets one command. Platform team gets a reproducible release path, service identity, runtime boundary, protocol surface, health trail.
- 01a2a deploy packages source and metadata.
- 02Control plane builds and releases the agent service.
- 03Packed frontend (if present) is built and mounted at /app.
- 04Identity, permissions, docs, protocol endpoints generated.
- 05Managed runtime exposes the agent through A2A, MCP, HTTPS.
- 06Runs on the API, MCP, and /invoke entry points, evaluations, artifacts, and distribution metadata create distinct records.
Six subsystems. One backend.
The control plane is what makes the runtime trustworthy. Each subsystem owns a narrow slice and emits a structured event trail. No subsystem talks to agent code directly — they talk to the runtime.
What's inside the agent process.
Each deployed agent runs a small set of runtime components wrapping user code. The shape is the same for every agent — so security guarantees don't depend on what the developer remembered to wire up.
Per-agent registry and deployment identity. Caller identity or conservative ingress classification is recorded on receipts.
Ed25519, audience, expiry, bucket, path, and output-prefix checks on grant-backed workspace operations.
Explicit ctx.sandbox commands run in a separate microsandbox. Network is enabled unless the caller requests network_disabled.
Grant-aware access to managed workspace storage. Hosted containers retain their own image and local filesystem.
@a2a.tool decorator → REST endpoint + MCP tool + AgentCard entry. One source of truth.
Streams progress, result, question-required, and status events. Replay history is a separate record, not an automatic copy of every internal event.
Every URL the runtime exposes.
One agent. Many speakers. Each endpoint is the same logical surface in a different protocol. The runtime owns routing, auth, and grant verification at every entry point.
| path | speaker | returns | auth |
|---|---|---|---|
| /.well-known/agent-card.json | discovery · registries · MCP gateways | AgentCard JSON | public |
| /tasks | A2A peer · planner agent | task id · 202 · SSE link | bearer · service |
| /tasks/{id} | A2A peer | task state · artifacts | bearer · service |
| /sse/{task} | A2A peer · /app | stream: events · artifacts | bearer · service |
| /mcp | Claude Code · Cursor · MCP clients | tools/list · tools/call + gateway evidence | bearer · grant · external |
| /invoke/{skill} | curl · webhook · scripts | result JSON or SSE + gateway evidence | bearer · grant · external |
| /app | browser | packed React app | session · inherit |
| /app/config.json | browser · /app | endpoints · schemas | session |
| /auth/session | browser | user · org · scopes | session |
| /runs/{id}/receipt | dashboard · auditor | receipt JSON | owner · approver |
What each subsystem can record.
Execution evidence, protocol state, workspace traces, approval records, evaluations, and billing rows have distinct producers and consumers. Optional activity fields are not presented as though every sealing path populates them.
| trigger | emits | consumed by |
|---|---|---|
| task accepted | audit event · run_id · grant_id | audit log · dashboard |
| file read | workspace result or trace · path policy | workspace history · optional instrumentation |
| file written | workspace result or trace · prefix check | workspace history · optional instrumentation |
| tool progress | SSE event · stage · % · message | /app · A2A peer · MCP |
| scope request | approval event · requested paths · reason | approver inbox · audit |
| scope granted | grant record · prior and new authority | grant audit · later receipt reference |
| task complete | protocol result · task status | A2A task history |
| eval scored | rubric · score · failures | eval record · registry stats |
| review recorded | reviewer id · timestamp · notes | review history · compliance export |
| receipt sealed | canonical payload · signer · signature | evidence API · auditor · optional ledger link |
Built on protocols, not lock-in.
Every callable surface is an open standard. Agents that work here work on other A2A and MCP runtimes — and other A2A and MCP services work here.
Open protocol surface for agent discovery and task state; formal routes remain distinct from skill-execution receipts.
Every agent tool is also an MCP tool. Use any deployed agent from any MCP client.
Agents ship as standard OCI images. Compatible with any conformant registry.
Tool signatures become JSON Schema; clients can codegen.
Standard token model. No bespoke session formats.
Standard transports expose results and progress without claiming a built-in OpenTelemetry exporter.
If you know these, you know this.
a2a cloud borrows shape from infra you already trust — and points it at agents instead of containers, payments, or web workers.
Want to see the rest of the surface?
Architecture pages describe the runtime. Workflows pages describe what teams ship on it. Security explains the trust model. Pick the lens that matches your question.