How Agent Factory works

Models run in Azure AI Foundry in UAE North, or on DDA's own GPUs behind any OpenAI compatible server. Tools are MCP servers, such as the tools services of the two agents CYBERAIQ AG ships, and plain HTTP APIs that Agent Factory calls as API tools.

People sign in to the web app to:

• see every agent, its state and its last heartbeat;
• grant each agent the models, MCP servers and API tools it may use, and nothing else;
• block a model, a server, a tool or a connector, switch on read only mode, or suspend an agent, so the next call is refused;
• see what every call cost in USD and AED, and stop an agent at its monthly budget;
• read the audit log of every change people made.

For people

Web app

The pages people use. It passes /api on to Agent Factory, so the browser only ever talks to one origin, and gives every page a content security policy with a new nonce on each request.

Sign in

Microsoft Entra ID, or local accounts. Each person has one of four roles: viewer, developer, operator or admin.

Library

The packages CYBERAIQ AG signs, with the state of each signature, and the form that deploys a package as an agent.

Fleet

Every agent with its state, factory key, grants, environment, classification and budget.

Governance and costs

Blocks, read only mode, budgets, the classification rule, model prices, spend, and the audit log.

For agents

Model gateway /gateway/v1

OpenAI compatible. It checks each call, adds the provider's key, and records the tokens and the cost.

MCP gateway /mcp/{slug}

One address for each registered MCP server. It checks each tool call, adds the server's key, and records the call.

API tools server /mcp/api-tools

One MCP server made of the API tools granted to the agent. Agent Factory makes each HTTP call itself.

Runtime /api/runtime

The config tells the agent what it may use; the heartbeat tells Agent Factory the agent is alive and healthy.

Jobs inside the process

• Every 30 seconds, agents silent for 3 minutes go offline.
• Every 5 minutes, each MCP server that is not blocked is asked for its tools.
• Every 15 minutes, each model provider is tested.
• Once a day, model calls, tool calls and status events older than the retention period are deleted (90 days unless an admin changes it). Audit events are kept at least 365 days.

What Agent Factory calls

• Azure AI Foundry in UAE North, on its OpenAI v1 address, with an API key or a Microsoft Entra ID token.
• DDA's GPUs through any OpenAI compatible server, with a key when the server needs one.
• MCP servers over streamable HTTP: the tools services of the two agents, which reach FortiGate, Microsoft Sentinel, ServiceNow and more, and any other MCP server people register.
• HTTP APIs, as API tools.
• Microsoft Entra ID, to sign people in when an admin turns it on.

An agent has one factory key, an environment (production, staging or development), a classification (public, internal, confidential or secret) and, if someone sets one, a monthly budget in USD. It comes from a package in the Library, or a developer registers one of their own.

A model alias such as gpt-5.4-mini names one model at one provider. A provider is hosted in the cloud or on premises, and that is what the classification rule looks at. Each agent has a default model and may be granted more.

An MCP server holds tools. Each tool is a read tool, which only looks, or a change tool, which can change something. A tool uses connectors, such as FortiGate or ServiceNow, so blocking one connector stops every tool that uses it. An API tool is one HTTP call that Agent Factory makes for the agent; it is read or change too, and may use secrets and connectors.

1. Publish and sign. CYBERAIQ AG signs package.yaml with Ed25519. The Library shows each package as verified, unsigned or invalid. An invalid package cannot be deployed (409 package_signature_invalid); an unsigned one can, and says so.
2. Deploy. An operator fills in the deploy form: name, environment, location, target, classification, default model and, if wanted, a monthly budget. Agent Factory creates the agent, awaiting first contact, and shows its factory key once. It keeps only a hash of the key.
3. Bundle. The operator downloads a bundle for Docker Compose or Kubernetes: the package templates filled in, a README.txt with the steps, and in secrets/ the key of each MCP server Agent Factory holds for it. The factory key goes in only when the request proves it holds the current key; otherwise the operator puts it in secrets/ by hand.
4. First contact. The first call with the new key, usually the config read at start, turns the agent online.
5. Heartbeat. The agent sends one every 60 seconds. One that says unhealthy makes it degraded; 3 minutes of silence make it offline.
6. Rotate. A new key is shown once and the old one stops at once.
7. Suspend. An operator suspends the agent with a reason, and every model and tool call it makes is refused. On resume it is online if it was heard from in the last 3 minutes, else offline.
8. Delete. The agent, its key and its grants are removed, with the MCP servers it brought that no other agent uses.

A model call

If no model is named, or the agent is not granted the one it asks for, the agent's default model runs. The answer names the model that ran in the x-agent-factory-model header. Agent Factory builds the headers it sends upstream from scratch, so the factory key never leaves it.

A tool call

A refused request, such as an unknown key or a server the agent is not granted, is a JSON RPC error with an HTTP status. A refused tool is an ordinary tool result with isError: true, so the agent and its model can read why and carry on. Blocked tools are also left out of tools/list. When read only mode is on, a tool the server never listed is refused too, because Agent Factory cannot know that it only reads.

What is recorded

• Blocks. An operator blocks a model, an MCP server, one tool, a connector or an API tool, with a reason. The refusal carries the reason.
• Read only mode. One switch for every agent. While it is on, only read tools run; every change tool call is refused with read_only_mode. Model calls go on.
• Budgets. A monthly budget in USD per agent. Spend is added up per calendar month in UTC. Once this month's spend reaches the budget, model calls are refused with 429 budget_exceeded until the month turns or someone raises the budget. Tool calls are not priced and go on.
• Classification rule. Confidential and secret agents may only use models hosted on premises. The rule is on from the start; an admin can switch it off.
• Grants. An agent reaches only the MCP servers and API tools it is granted.

The refusal line, as the agent sees it:

Blocked by Agent Factory: read only mode is on, and add_address_to_group can change things.

The four roles

cost = ( (prompt - cached) x input price
       + cached            x cached input price
       + completion        x output price ) / 1,000,000

rounded to 6 decimals; reasoning tokens are part of completion

• Prices are in USD per million tokens. An operator refreshes them from the Azure Retail Prices API, which looks for Global, then Data Zone, then Regional prices and changes nothing unless it finds all three prices, or types them in.
• Pages show money in AED at 3.6725 per USD. An admin can change the currency and the rate.
• Each agent's spend counts from the first day of the month in UTC. The forecast carries this month's pace on in a straight line to the month's end.
• A refused call costs nothing and is still recorded.

Firewall Management

• In chat, a change tool never runs until a person presses Approve. The agent can require an app role for that.
• On top, a firewall write needs a change that a change approver approved in the change register, inside its window, for the exact address and group, within a daily limit of 20 writes unless set otherwise.
• Its daily check is off by default. When it is on, each change tool of a scheduled run waits for a person, unless the operator sets FW_SCHEDULE_CHANGES=auto.

Network Device Lifecycle

• It reads 9 management platforms, such as FortiManager, Panorama and Catalyst Center, 6 sources of vendor life cycle data, such as Cisco EoX and endoflife.date, and the NVD and CISA KEV vulnerability lists.
• It writes only to the CMDB and ITSM tool: ServiceNow, Jira Service Management, Freshservice or BMC Helix.
• In chat, a change tool runs only after the person confirms it. The agent writes to the CMDB only the values of a change a person approved in the ITSM tool.
• With Agent Factory its weekly schedule is off by default.

Both agents read their config every 5 minutes and send a heartbeat every 60 seconds, and Agent Factory governs them exactly like any other agent: an operator can block either server, any tool or connector, switch on read only mode, set a budget or suspend them.

1. A developer registers the agent in Agent Factory with its name, environment, classification and default model, and copies its factory key. It is shown once.
2. The developer, or an operator, grants it any further models, MCP servers and API tools it needs.
3. The program reads the key from a file or the environment and sends it as Authorization: Bearer, x-api-key or api-key on every request. It never prints it.

Both samples below use only what ships with the language. They read the config, send a heartbeat, ask the default model one question and list the tools of every MCP server the agent is granted. Any OpenAI client works for the model gateway, with the base URL from the config and the factory key as its API key, and any MCP client that speaks streamable HTTP works for the tools.

export AGENT_FACTORY_URL=https://agentfactory.dda.example
export AGENT_FACTORY_KEY_FILE=/run/secrets/factory-key

python3 agent.py "What does read only mode stop?"   # Python 3.9 or later
node agent.mts "What does read only mode stop?"     # Node.js 22.18 or later

#!/usr/bin/env python3
"""
A small agent of your own for Agent Factory, with nothing but the Python standard library (3.9 or later).

    export AGENT_FACTORY_URL=https://agentfactory.dda.example
    export AGENT_FACTORY_KEY_FILE=/run/secrets/factory-key   # or AGENT_FACTORY_KEY; never print it
    python3 agent.py "What does read only mode stop?"

It uses the four addresses of Agent Factory, each with its factory key:
  1. GET  /api/runtime/config     who it is, its models, its MCP servers and API tools
  2. POST /api/runtime/heartbeat  its version and health; the answer says whether it is suspended
  3. /gateway/v1                  OpenAI compatible: it asks its default model one question
  4. /mcp/{slug}, /mcp/api-tools  MCP over streamable HTTP: it lists the tools it may call

A real agent sends the heartbeat every heartbeatSeconds and reads the config again every few minutes.
A refusal comes back as an answer with a code; it will not change until a person changes a setting,
so the agent reports it and does not retry.
"""
import json
import os
import sys
import urllib.error
import urllib.request

FACTORY = os.environ["AGENT_FACTORY_URL"].rstrip("/")
KEY_FILE = os.environ.get("AGENT_FACTORY_KEY_FILE")
KEY = open(KEY_FILE).read().strip() if KEY_FILE else os.environ["AGENT_FACTORY_KEY"]
VERSION = "0.1.0"
MCP_VERSION = "2025-06-18"


def send(method, url, body=None, headers=None):
    """One request with the factory key. Returns (status, headers, text). A refusal is an answer too."""
    request = urllib.request.Request(
        url if url.startswith("http") else FACTORY + url,
        data=None if body is None else json.dumps(body).encode(),
        method=method,
        headers={
            "Authorization": "Bearer " + KEY,
            "Content-Type": "application/json",
            "Accept": "application/json, text/event-stream",
            **(headers or {}),
        },
    )
    try:
        with urllib.request.urlopen(request, timeout=300) as response:
            return response.status, response.headers, response.read().decode()
    except urllib.error.HTTPError as error:
        return error.code, error.headers, error.read().decode()


def rpc(url, method, params, session=None, notify=False):
    """One MCP message. The answer is JSON or an event stream; returns (status, session, message)."""
    headers = {"MCP-Protocol-Version": MCP_VERSION}
    if session:
        headers["Mcp-Session-Id"] = session
    body = {"jsonrpc": "2.0", "method": method, "params": params}
    if not notify:
        body["id"] = 1
    status, answer_headers, text = send("POST", url, body, headers)
    session = answer_headers.get("Mcp-Session-Id") or session
    message = None
    if "text/event-stream" in (answer_headers.get("Content-Type") or ""):
        for line in text.splitlines():
            if line.startswith("data:"):
                data = json.loads(line[5:])
                if data.get("id") == 1:
                    message = data
    elif text.strip():
        message = json.loads(text)
    return status, session, message


def list_tools(name, url):
    """initialize, notifications/initialized, tools/list: the tools this agent may call there."""
    status, session, message = rpc(
        url,
        "initialize",
        {"protocolVersion": MCP_VERSION, "capabilities": {}, "clientInfo": {"name": "my-agent", "version": VERSION}},
    )
    if not message or "error" in message:
        error = (message or {}).get("error", {})
        print(f"  {name}: refused, HTTP {status}, {error.get('code')}: {error.get('message')}")
        return
    rpc(url, "notifications/initialized", {}, session, notify=True)
    status, session, message = rpc(url, "tools/list", {}, session)
    tools = [tool["name"] for tool in message["result"]["tools"]]
    print(f"  {name}: {len(tools)} tools: {', '.join(tools)}")


def main():
    question = " ".join(sys.argv[1:]) or "Say hello in five words."

    # 1. Config: who the agent is, the models it may use, its MCP servers and its API tools.
    status, _, text = send("GET", "/api/runtime/config")
    if status != 200:
        sys.exit(f"config: HTTP {status}: {text}")
    config = json.loads(text)
    agent = config["agent"]
    print(f"{agent['name']}, {agent['environment']}, {agent['classification']}, suspended: {agent['suspended']}")

    # 2. Heartbeat: its version and health. The first call with a new key brings the agent online.
    status, _, text = send("POST", "/api/runtime/heartbeat", {"version": VERSION, "healthy": True, "detail": "sample"})
    beat = json.loads(text)
    print(f"heartbeat: HTTP {status}, suspended: {beat.get('suspended')}, configVersion: {beat.get('configVersion')}")

    # 3. A model call through the gateway. Any OpenAI client works the same way:
    #    base_url = config["gateway"]["baseUrl"], api_key = the factory key.
    gateway = config["gateway"]
    status, _, text = send(
        "POST",
        gateway["baseUrl"] + "/chat/completions",
        {"model": gateway["defaultModel"], "messages": [{"role": "user", "content": question}]},
    )
    answer = json.loads(text)
    if status == 200:
        usage = answer["usage"]
        print(f"model {answer['model']}: {answer['choices'][0]['message']['content']}")
        print(f"tokens: {usage['prompt_tokens']} prompt, {usage['completion_tokens']} completion")
    else:
        error = answer["error"]
        print(f"model refused: HTTP {status}, {error['code']}: {error['message']}")

    # 4. Tools: every MCP server it is granted, then its API tools. Any MCP client that speaks
    #    streamable HTTP works too, with the factory key in the Authorization header.
    print("tools:")
    for server in config["mcpServers"]:
        list_tools(server["name"], server["url"])
    if config["apiTools"]:
        list_tools("API tools", config["apiTools"]["url"])


if __name__ == "__main__":
    main()

/**
 * A small agent of your own for Agent Factory, in TypeScript with nothing but Node.js 22.18 or later
 * (it runs this .mts file as it is, with fetch built in).
 *
 *   export AGENT_FACTORY_URL=https://agentfactory.dda.example
 *   export AGENT_FACTORY_KEY_FILE=/run/secrets/factory-key   # or AGENT_FACTORY_KEY; never print it
 *   node agent.mts "What does read only mode stop?"
 *
 * It uses the four addresses of Agent Factory, each with its factory key:
 *   1. GET  /api/runtime/config     who it is, its models, its MCP servers and API tools
 *   2. POST /api/runtime/heartbeat  its version and health; the answer says whether it is suspended
 *   3. /gateway/v1                  OpenAI compatible: it asks its default model one question
 *   4. /mcp/{slug}, /mcp/api-tools  MCP over streamable HTTP: it lists the tools it may call
 *
 * A real agent sends the heartbeat every heartbeatSeconds and reads the config again every few minutes.
 * A refusal comes back as an answer with a code; it will not change until a person changes a setting,
 * so the agent reports it and does not retry.
 */
import { readFileSync } from 'node:fs'

const FACTORY = (process.env.AGENT_FACTORY_URL ?? '').replace(/\/+$/, '')
const KEY_FILE = process.env.AGENT_FACTORY_KEY_FILE
const KEY = KEY_FILE ? readFileSync(KEY_FILE, 'utf8').trim() : (process.env.AGENT_FACTORY_KEY ?? '')
const VERSION = '0.1.0'
const MCP_VERSION = '2025-06-18'

type RuntimeConfig = {
  agent: { id: string; name: string; environment: string; classification: string; suspended: boolean }
  gateway: { baseUrl: string; defaultModel: string; models: string[] }
  mcpServers: { slug: string; name: string; url: string; readOnlyTools: string[]; writeTools: string[] }[]
  apiTools: { url: string; tools: string[] } | null
  heartbeatSeconds: number
}

type RpcMessage = { id?: number; result?: any; error?: { code: number; message: string; data?: { reason?: string } } }

/** One request with the factory key. A refusal is an answer too, so the status is returned, not thrown. */
async function send(method: string, url: string, body?: unknown, headers: Record<string, string> = {}) {
  const res = await fetch(url.startsWith('http') ? url : FACTORY + url, {
    method,
    headers: {
      Authorization: `Bearer ${KEY}`,
      'Content-Type': 'application/json',
      Accept: 'application/json, text/event-stream',
      ...headers,
    },
    body: body === undefined ? undefined : JSON.stringify(body),
    signal: AbortSignal.timeout(300_000),
  })
  return { status: res.status, headers: res.headers, text: await res.text() }
}

/** One MCP message. The answer is JSON or an event stream. */
async function rpc(url: string, method: string, params: object, session?: string, notify = false) {
  const headers: Record<string, string> = { 'MCP-Protocol-Version': MCP_VERSION }
  if (session) headers['Mcp-Session-Id'] = session
  const res = await send('POST', url, { jsonrpc: '2.0', method, params, ...(notify ? {} : { id: 1 }) }, headers)
  let message: RpcMessage | null = null
  if ((res.headers.get('content-type') ?? '').includes('text/event-stream')) {
    for (const line of res.text.split('\n')) {
      if (!line.startsWith('data:')) continue
      const data = JSON.parse(line.slice(5)) as RpcMessage
      if (data.id === 1) message = data
    }
  } else if (res.text.trim()) {
    message = JSON.parse(res.text) as RpcMessage
  }
  return { status: res.status, session: res.headers.get('mcp-session-id') ?? session, message }
}

/** initialize, notifications/initialized, tools/list: the tools this agent may call there. */
async function listTools(name: string, url: string) {
  const init = await rpc(url, 'initialize', { protocolVersion: MCP_VERSION, capabilities: {}, clientInfo: { name: 'my-agent', version: VERSION } })
  if (!init.message || init.message.error) {
    const error = init.message?.error
    console.log(`  ${name}: refused, HTTP ${init.status}, ${error?.code}: ${error?.message}`)
    return
  }
  await rpc(url, 'notifications/initialized', {}, init.session, true)
  const list = await rpc(url, 'tools/list', {}, init.session)
  const tools: string[] = (list.message?.result?.tools ?? []).map((tool: { name: string }) => tool.name)
  console.log(`  ${name}: ${tools.length} tools: ${tools.join(', ')}`)
}

async function main() {
  const question = process.argv.slice(2).join(' ') || 'Say hello in five words.'

  // 1. Config: who the agent is, the models it may use, its MCP servers and its API tools.
  const configRes = await send('GET', '/api/runtime/config')
  if (configRes.status !== 200) throw new Error(`config: HTTP ${configRes.status}: ${configRes.text}`)
  const config = JSON.parse(configRes.text) as RuntimeConfig
  const { agent } = config
  console.log(`${agent.name}, ${agent.environment}, ${agent.classification}, suspended: ${agent.suspended}`)

  // 2. Heartbeat: its version and health. The first call with a new key brings the agent online.
  const beatRes = await send('POST', '/api/runtime/heartbeat', { version: VERSION, healthy: true, detail: 'sample' })
  const beat = JSON.parse(beatRes.text)
  console.log(`heartbeat: HTTP ${beatRes.status}, suspended: ${beat.suspended}, configVersion: ${beat.configVersion}`)

  // 3. A model call through the gateway. Any OpenAI client works the same way:
  //    new OpenAI({ baseURL: config.gateway.baseUrl, apiKey: the factory key })
  const chat = await send('POST', `${config.gateway.baseUrl}/chat/completions`, {
    model: config.gateway.defaultModel,
    messages: [{ role: 'user', content: question }],
  })
  const answer = JSON.parse(chat.text)
  if (chat.status === 200) {
    console.log(`model ${answer.model}: ${answer.choices[0].message.content}`)
    console.log(`tokens: ${answer.usage.prompt_tokens} prompt, ${answer.usage.completion_tokens} completion`)
  } else {
    console.log(`model refused: HTTP ${chat.status}, ${answer.error.code}: ${answer.error.message}`)
  }

  // 4. Tools: every MCP server it is granted, then its API tools. Any MCP client that speaks
  //    streamable HTTP works too, with the factory key in the Authorization header.
  console.log('tools:')
  for (const server of config.mcpServers) await listTools(server.name, server.url)
  if (config.apiTools) await listTools('API tools', config.apiTools.url)
}

main().catch((err: unknown) => {
  console.error(err instanceof Error ? err.message : err)
  process.exitCode = 1
})

What refusals look like

A refusal will not change until a person changes a setting, so an agent reports it and does not retry. Past the key check, the model gateway says so in the x-should-retry: false header.

{
  "error": {
    "message": "This agent has reached its monthly budget of 50.00 USD (spent 50.02 USD this month).",
    "type": "insufficient_quota",
    "code": "budget_exceeded"
  }
}

{
  "jsonrpc": "2.0",
  "id": 1,
  "error": {
    "code": -32003,
    "message": "Blocked by Agent Factory: this agent has not been granted the MCP server Firewall change.",
    "data": {
      "reason": "server_not_granted"
    }
  }
}

{
  "jsonrpc": "2.0",
  "id": 3,
  "result": {
    "content": [
      {
        "type": "text",
        "text": "Blocked by Agent Factory: the tool tighten_rule is blocked (under review)."
      }
    ],
    "isError": true
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or unknown hub key."
  }
}

Every address, header and field is in docs/developer-guide.md. How the two agents are installed is in docs/admin-guide.md.

Keys and secrets

• A factory key is afk_ and 52 random characters. Agent Factory stores only its sha256 and shows the key once.
• Provider keys, MCP server keys, API tool secrets and the Microsoft Entra ID client secret are encrypted with aes-256-gcm and never sent back by the API. An API tool can use only secrets saved for API tools, as {{secret:name}}.
• Upstream headers are built from scratch, so the factory key never travels to a model, an MCP server or an API.

Addresses Agent Factory will not call

Every address people type for an MCP server, a model provider or an API tool goes through one guard, when it is saved and again on every connection:

• Always refused: link local 169.254.0.0/16 and fe80::/10 (169.254.169.254 is the metadata service on Azure, AWS, Google and Oracle), this host 0.0.0.0/8 and ::, the Azure platform address 168.63.129.16, the metadata addresses fd00:ec2::254 (AWS), fd20:ce::254 (Google) and 100.100.100.200 (Alibaba), and each of these IPv4 addresses written as IPv6 (mapped, compatible, translated and NAT64).
• Refused unless AGENT_FACTORY_ALLOW_LOCAL_UPSTREAMS=1, which is for development and tests only: loopback 127.0.0.0/8 and ::1, in every form above.
• Allowed: the private ranges and IPv6 unique local addresses where on premises tool servers, GPU servers and Kubernetes pods live. API tools also refuse fd00::/8.
• Only http and https. A name is checked inside the DNS lookup of each connection, so the address checked is the address connected to, and a name that later points somewhere forbidden cannot slip through. Redirects are never followed.

A refused address is 400 address_not_allowed when it is saved, and 403 upstream_address_not_allowed on a call.

People

• A session is a random token in an httpOnly, SameSite Lax cookie, Secure when the web app is on https. Agent Factory stores only its sha256, and it lasts 8 hours.
• Every request that changes something must carry a fixed X-Requested-With header, and an Origin header, when present, must be the web app or Agent Factory itself.
• Local passwords are hashed with argon2. Sign in allows 30 attempts in 15 minutes per address and 8 per email.
• Every page has a content security policy: scripts and styles run only with that request's nonce, and no page may frame it.

Records

• Prompts and answers are never stored. Tool arguments are stored only when an admin turns on capture, cut to 400 characters with anything that looks like a key removed.
• Logs hold the method, path, status and time of each request, never headers, bodies or keys.

Known limits

• Private ranges are allowed for every upstream, so a developer can register a server or API tool at any private address Agent Factory can reach. Keep network policies tight and review new servers in the audit log.
• Any developer may name any API tool secret. Scoping secrets to their owner is not built yet.
• The encryption key cannot be rotated yet.
• Sign in limits are counted in each process, so two replicas allow twice as many attempts.
• The signature covers package.yaml only.
• Agent Factory serves plain HTTP; TLS ends at the ingress or a proxy.

The full threat model is in docs/security.md.

Agent

A program that calls models and tools through Agent Factory with one factory key.

Agent Factory

The service that checks, prices and records every call an agent makes, and the web app people govern it with.

API tool

One HTTP call, described once, that agents call as an MCP tool at /mcp/api-tools.

Audit log

Every change people made, who made it and when. Kept at least 365 days.

Budget

The most an agent may spend on models in a calendar month, in USD.

Bundle

The files that start an agent with Docker Compose or Kubernetes, downloaded after a deploy.

Change tool

A tool that can change something. Read only mode refuses it.

Classification

How sensitive an agent's work is: public, internal, confidential or secret.

Classification rule

Confidential and secret agents may only use models hosted on premises.

Config

What GET /api/runtime/config returns: the agent, its models, its MCP servers and its API tools.

Connector

A system a tool reaches, such as FortiGate or ServiceNow. Blocking it stops every tool that uses it.

Factory key

The one key an agent holds. It starts with afk_.

Grant

Permission for one agent to use one model, MCP server or API tool.

Heartbeat

The message an agent sends every 60 seconds with its version and health.

Library

The signed packages that can be deployed as agents.

MCP server

A server of tools that speaks the Model Context Protocol. Agents reach it at /mcp/{slug}.

Model alias

The name an agent asks for, such as gpt-5.4-mini, mapped to one model at one provider.

Package

A package.yaml that describes an agent, its tools services and its settings, signed with Ed25519.

Provider

Where models run: Azure AI Foundry, or an OpenAI compatible server on premises.

Read only mode

One switch that lets only read tools run, for every agent.

Read tool

A tool that only looks.

Refusal

A call Agent Factory stopped, with its reason. It is recorded like any other call.

Role

What a person may do: viewer, developer, operator or admin.

States

Awaiting first contact, online, degraded, offline and suspended.

Suspend

Stop every call of one agent until an operator resumes it.