Harness

# =============================================================================
# AgentKit harness configuration (code-free agent).
#
# Configure with `agentkit harness set ...` or by editing this file. For a
# component, uncomment the params under the backend you set as `type`.
# =============================================================================

# Harness / runtime name (also the knowledgebase & long-term-memory index name).
harness_name: "my-harness"

# Deployment cloud selected by `agentkit harness init`.
cloud:
  provider: volcengine
  region: cn-beijing
  # A horizontally scaled OAuth Harness should use a private connection to its
  # shared session database. Keep public network enabled for authenticated APIG
  # ingress, and use a dedicated least-privilege security group.
  # network:
  #   enable_public_network: true
  #   enable_private_network: true
  #   vpc_id: ${HARNESS_RUNTIME_VPC_ID}
  #   subnet_ids: [${HARNESS_RUNTIME_SUBNET_ID}]
  #   security_group_ids: [${HARNESS_RUNTIME_SECURITY_GROUP_ID}]
  #   enable_shared_internet_access: true

# Reasoning model. Direct mode preserves the legacy Runtime-IAM key lookup.
# For a shared OAuth Harness, obo_broker sends a short-lived user+Runtime TIP to
# a fixed APIG model egress; the gateway/Broker replaces it with the hosted
# downstream credential, so the real provider key never enters this process.
model:
  name: ""
  # provider: openai
  # api_base: https://<model-egress-apig>/v1
  # credential_mode: obo_broker
  # target_alias: model
  # target_audience: trn:agentkit:model-gateway
  # workload_discovery_url: https://<workload-issuer>/.well-known/openid-configuration
  # workload_issuer: https://<workload-issuer>
  # workload_pool: default
  # identity_region: cn-beijing

# Runtime and model-call admission capacity. In OAuth mode, max_instance > 1
# requires a shared MySQL/PostgreSQL short-term-memory backend; local/sqlite
# sessions cannot safely span replicas. The model limits are per Runtime
# instance; enforce tenant-wide TPM/TPD again at Model Gateway.
capacity:
  # cpu_milli: 4000
  # memory_mb: 8192
  # min_instance: 4
  # max_instance: 10
  # max_concurrency: 32
  # model_max_inflight: 12
  # model_max_inflight_per_user: 1
  # model_queue_timeout_seconds: 45
  # model_request_timeout_seconds: 120
  # model_max_output_tokens: 1024
  # session_db_pool_size: 5
  # session_db_max_overflow: 3
  # session_db_pool_timeout_seconds: 10
  # session_db_pool_recycle_seconds: 300

# Built-in tool names; configure with --tools (comma-separated)
tools: []
mcp_servers: []

# Skill Hub slugs, ss-... spaces, or ss-...:s-... refs.
skills: []

# Agent instruction (empty = server default).
system_prompt: ""

# Agent description, used by discovery and generated AgentCards.
description: ""

# Agent runtime backend: adk (default) | codex.
runtime: adk

# Per-run defaults. Both can be overridden by `agentkit harness invoke` flags.
# max_llm_calls: 20

# Tool-call behavior.
# structured_tool_calls: false
# include_tools_every_turn: true

# Managed Harness Sidecar optimizations (optional). SQL readonly protection is
# server-owned and is enabled automatically with mcp_resilience.
# sidecar:
#   enabled: true
#   profile: default
#   component_overrides:
#     context_engine: true
#     compressor: false
#     verifier: false
#     long_run_control: false
#     mcp_resilience: false

# --- A2A registry (optional) ------------------------------------------------
# Configure with --registry / --registry-space-id / --registry-space-name.
# registry:
#   type: agentkit_a2a
#   space_id: ""
#   top_k: 3
#   endpoint: https://open.volcengineapi.com/
#   region: cn-beijing

# --- Knowledge base ----------------------------------------------------------
#   type -> env: KNOWLEDGEBASE_TYPE   flag: --knowledgebase-type
#   "" disables it. Supported: viking | opensearch | redis
knowledgebase:
  type: ""
  # -- viking --      flags: --knowledgebase-project / --knowledgebase-region
  # project: my-project
  # region: cn-beijing
  # -- opensearch --  flags: --knowledgebase-host / -port / -username / -password / -use-ssl
  # host: 1.2.3.4
  # port: 9200
  # username: admin
  # password: ""
  # use_ssl: true
  # -- redis --       flags: --knowledgebase-host / -port / -username / -password / -db
  # host: 1.2.3.4
  # port: 6379
  # username: default
  # password: ""
  # db: 0

# --- Long-term memory --------------------------------------------------------
#   type -> env: LONG_TERM_MEMORY_TYPE   flag: --long-term-memory-type
#   "" disables it. Supported: viking | opensearch | redis | mem0
long_term_memory:
  type: ""
  # -- viking --      flags: --long-term-memory-project / --long-term-memory-region
  # project: my-project
  # region: cn-beijing
  # -- opensearch --  flags: --long-term-memory-host / -port / -username / -password
  # host: 1.2.3.4
  # port: 9200
  # username: admin
  # password: ""
  # -- redis --       flags: --long-term-memory-host / -port / -password / -db
  # host: 1.2.3.4
  # port: 6379
  # password: ""
  # db: 0
  # -- mem0 --        flags: --long-term-memory-api-key / -api-key-id / -project-id / -base-url
  # api_key: ""
  # api_key_id: ""
  # project_id: ""
  # base_url: https://api.mem0.ai/v1

# --- Short-term memory (session store) ---------------------------------------
#   type -> env: SHORT_TERM_MEMORY_TYPE   flag: --short-term-memory-type
#   local (default) | sqlite | mysql | postgresql
short_term_memory:
  type: local
  # -- mysql --       flags: --short-term-memory-host / -user / -password / -database / -charset
  # host: 1.2.3.4
  # user: root
  # password: ""
  # database: harness
  # charset: utf8
  # -- postgresql --  flags: --short-term-memory-host / -port / -user / -password / -database / -schema
  # host: 1.2.3.4
  # port: 5432
  # user: postgres
  # password: ""
  # database: harness
  # schema: pdsa_shared_harness

# --- Authentication (optional) -----------------------------------------------
# Omit this block to deploy with the default API-key auth (key_auth). Add it to
# gate the runtime with OAuth2/JWT (custom_jwt): the API gateway then only accepts
# tokens issued by `discovery_url`'s user pool whose audience is one of
# `allowed_ids`. Set up the user pool / client in the selected cloud's Identity console.
#   flags: --discovery-url / --allowed-id
# auth:
#   discovery_url: "https://userpool-<id>.userpool.auth.id.cn-beijing.volces.com/.well-known/openid-configuration"
#   allowed_ids: ["<client-id>"]

mcp_servers:
  - protocol: streamable-http
    endpoint: https://mcp.example.com/mcp
    api_key: ${MCP_API_KEY}

message: Summarize the latest operational report
protocol: run_sse
user_id: report-reader
max_llm_calls: 8
harness:
  system_prompt: Produce a concise report with sources
  tools: [web_search]
  mcp_servers:
    - endpoint: https://mcp.example.com/mcp
      api_key: ${MCP_API_KEY}