Agents under the same decision as your applications.

An operation becomes an agent tool when the contract marks it with x-flexway-tool: exposure is opt-in, and a write is never offered to an agent unless someone decided it. tools/list is derived from the OpenAPI - name (operationId or a declared name), description, input schema built from the declared parameters and body - and filtered by the caller's scopes. A tool that is not a declared operation does not exist.

tools/call builds the operation's request and runs it, in memory, through the same decision as a REST call: scopes, caller quota, validation, policies, budgets, metrics. An operation is therefore callable over REST and via MCP with the same verdict and the same quota bucket. An undeclared argument is refused; the result is returned as text, as structuredContent for a JSON object, with isError for a status of 400 or above, and capped at 1 MiB.

The transport is stateless Streamable HTTP: a session would live on one replica and die on reload. The stdio transport does not cross a network, so it stays outside a gateway's scope. An operation with a streamed response cannot be a tool.

The MCP surface is a full OAuth 2.1 resource server. It publishes its protected resource metadata (RFC 9728) under /.well-known/oauth-protected-resource/<path> and answers 401 with resource_metadata, so the client discovers where to obtain a token rather than guessing. The token must be issued for this surface (RFC 8707): its audience is the public URL declared in agents.mcp.resources, never inferred from the request.

The agent's token is never relayed upstream, which closes the confused deputy path. An MCP token is refused on a REST route, and the surface accepts OAuth tokens only: an API key is not the identity of an agent acting on someone's behalf. The issuer is checked, and its keys validate only its own tokens.

The client is read from the token (client_id, otherwise azp); agents.mcp.clients restricts the surface to declared clients, by metadata document URL or by prefix. An unattended agent - a client acting for itself - is recognised, and x-flexway-tool: { unattended: false } hides and refuses a tool for it.

An upstream that declares token_exchange receives a token issued for it, on behalf of the caller, by the provider that signed the original token (RFC 8693); the gateway consumes identities, it does not issue them. The exchange happens after the whole decision - identity, scopes, quota, validation, policies - and before relaying: a refused call costs no exchange. An anonymous call has nothing to exchange, and the upstream receives no Authorization header.

The exchange only narrows: it requests at most the caller's scopes, and an extra scope granted yields 403 without calling the upstream. The subject (sub) remains the human, the actors (nested act) are the agents, read and traced. A provider refusal gives 403; an unreachable provider or a missing secret gives 503 with Retry-After. There is never a fallback to the original token.

The client secret is a reference re-read on every exchange, which allows rotation without a reload. An exchanged token is reused until its expiry minus 30 s, with a single exchange in flight per original token and audience.

A real chain looks like "human -> agent A -> agent B -> service". agents.delegation bounds its depth (max_depth) and its age (max_age, counted from auth_time, otherwise iat); an operation can tighten these bounds with x-flexway-delegation, never widen them, and the lower of the two applies. Beyond them, the answer is 403; a delegated token whose age cannot be established is refused.

Revocation goes through RFC 7662 introspection at the issuer, with a short cache: a revoked token gives 401, an unverifiable one 503 with Retry-After. Revoking the human thus cuts the whole chain. These rules apply over REST, when connecting to the MCP surface, and for both projected and federated tools.

The trace carries delegation.depth and delegation.actors, the flexway.delegation.refused metric counts refusals by reason, and the decision audit line carries the full chain of actors. Knowing which human, which agents and which scopes stand behind a write helps you meet traceability requirements for agent actions.

Existing MCP servers move behind Flexway without rewriting: an upstream with protocol: mcp and an agents.mcp.servers entry are enough. Exposure uses a declared list of tools, closed by default - a tool added on the server side does not appear without a decision - or "*", chosen explicitly. Tools keep their original names, which can be renamed; a collision on the same host refuses the load with a declared list, and with "*" the colliding tool is not served, and this is reported.

Discovery runs in the background (initialize, then tools/list), retried with increasing delay and refreshed at a regular interval; neither start-up nor /readyz waits for a server. Each call requires an identity and scopes (tool_scopes, otherwise scopes) and uses the caller's bucket; the rate class is declared, otherwise read for a tool announced as read-only, write otherwise. The server receives a token exchanged for it if it declares token_exchange, never the agent's token.

Each call benefits from the upstream's bulkhead, circuit breaker and budget, with results capped at 1 MiB. A single surface serves contract tools and federated tools in one list sorted by name.

Governance of agent-to-agent traffic (A2A v1.0) is not delivered as a whole; its state in this release is shown below. The chosen approach: relay A2A under the same decision as everything else - route, authenticate, authorise, count, observe - without terminating the protocol, that is without holding task state or delivering push notifications. An agent is declared by its agent card, treated as a versioned contract, and the upstream agent always receives an exchanged token, never the caller's.

The approach provides for a tenant held equal to the identity's tenant, a rate class per method, a stream cap and a bounded task duration, push notification targets restricted to a list of declared hosts, and an audit without content. Verification of signed upstream cards, re-signing of the published card and agent-to-agent delegation are still to be done.