Lattice Hub Docs
Best practices

Agent capability discovery

Register MCP servers and A2A agents as control-plane resources with cache, auth, and human-gated Pole Agent writes.

Agent discovery treats MCP servers, tools, A2A agents, and skills as first-class control-plane resources—not prompt-time service lists.

Target architecture

  1. Register MCP servers or A2A agent cards in Console/API.
  2. Persist to store and refresh CacheManager views.
  3. Agents discover via Registry / MCP interfaces.
  4. Policies limit who can read which servers, tools, or agents.
  5. Changes stay auditable with stable revision semantics.

Register MCP servers

  1. Pick the correct Namespace (environment).
  2. Create the MCP server with name, protocol, and metadata.
  3. Maintain tools and backend bindings.
  4. Confirm cache refresh and list visibility.
  5. Grant least-privilege read access.

Pole Agent only calls allowlisted tools such as list_namespaces, list_mcp_servers, list_mcp_server_tools, get_config_file, and search_config_files.

Register A2A agents

A2A currently covers agent cards, skills, protocol interfaces, and capability metadata. It does not run tasks or host an agent runtime. Treat it as a discoverable capability card.

Pole Agent boundaries

Suitable for authorized reads and human-confirmed configuration drafts. Not allowed to auto-publish, roll back, or delete as an autonomous publisher.

Write path: read → proposal → preview → concurrency checks → confirm → draft only → human publish in the config center.

Actual configuration

Community e2e payloads (pole-control-plane/test/e2e/internal/e2e/fixtures.go):

MCP server

{
  "name": "demo-mcp",
  "namespace": "default",
  "protocol": "MCP_PROTOCOL_SSE",
  "backend_type": "service",
  "backend_service": { "namespace": "default", "name": "gateway" },
  "tools": [{
    "name": "orders.query",
    "description": "query orders",
    "input_schema": {
      "type": "object",
      "properties": { "id": { "type": "string" } }
    }
  }]
}

A2A agent (registry card only — does not run tasks)

{
  "name": "demo-a2a",
  "namespace": "default",
  "source_type": "custom",
  "backend": { "type": "service", "namespace": "default", "service": "gateway" },
  "agent_card": {
    "name": "demo-a2a",
    "description": "demo card",
    "version": "1.0.0",
    "url": "http://127.0.0.1/a2a",
    "skills": [{ "id": "order-query", "name": "Order Query", "description": "query orders" }]
  },
  "skills": [{ "id": "order-query", "name": "Order Query", "description": "query orders" }]
}

APIs: /ai/mcp/v1/servers, /ai/a2a/v1/agents, /ai/a2a/v1/agents/{id}/card, /ai/mcp/v1/server/tools. SSE baseline: /ai/mcp/v1/sse.

Community demo

EntryWhat it does
e2etest/e2e/console_api — MCP/A2A CRUD + card/skills
Agent smokeconsole/web/scripts/smoke-agent-workbench.mjs — confirm writes draft only
Auth contractconsole/web/scripts/verify-ai-resource-authorization.mjs
ConsoleMCP, A2A, Pole Agent
CGO_ENABLED=0 go test -tags=e2e ./test/e2e/console_api/... -count=1 -run MCP
POLE_BASE_URL=http://127.0.0.1:8080 node console/web/scripts/smoke-agent-workbench.mjs

How to verify

curl -sS -X POST "$BASE/ai/mcp/v1/servers" -H 'Content-Type: application/json' \
  -H "Authorization: $TOKEN" \
  -d @mcp-server.json | jq '{code,info}'

curl -sS "$BASE/ai/mcp/v1/servers?namespace=default&offset=0&limit=20" \
  -H "Authorization: $TOKEN" \
  | jq '.data[]? | {name,namespace,protocol}'

Console: /ai/mcps, /ai/a2a → create → inspect tools/skills/card.
Pole Agent: after confirm, config center shows a draft; active release must not change by itself.

Expected effects

StepEffect
Create MCPServer listed; tools API returns orders.query
Create A2AAgent listed; card endpoint returns skills
Tighten authUnauthorized principals fail reads (MCPServerResources / A2AAgentResources)
Agent confirm writeDraft only; human publish required for clients
Delete resourceCatalog/cache stop returning it

Checklist

  • MCP/A2A resources land in the correct Namespace
  • Tool/skill descriptions explain boundaries
  • Cache and Console lists agree
  • Read permissions are narrowed
  • LLM gateway/allowlist enabled only when needed
  • Docs never claim A2A executes task orchestration

Deeper reading

On this page