Studio agent workbench

VeADK Studio 1.0.6 uses the same service and complete UI as VeADK Frontend. It enables chat, search, session history, the skill center, and agent creation, testing, deployment, and management, and opens on the chat view by default. In VeADK 1.0.6, custom configuration is the available project-creation flow; intelligent, template, and workflow entries are marked as coming soon and cannot be selected. You can preview and edit generated files, run them in a temporary test process, download a ZIP, or deploy to AgentKit. This version also supports cloud Runtime selection, multiple skill sources, multimodal conversations, and centralized deployment task status and retries.

Start locally

Run the command from the parent directory of your agent applications:

export VOLCENGINE_ACCESS_KEY="your-access-key"
export VOLCENGINE_SECRET_KEY="your-secret-key"

veadk studio --agents-dir ./agents --open

--open opens http://127.0.0.1:8000 after the service is ready. Without it, Studio starts the service without opening a browser. Volcengine credentials are used for models, cloud-resource queries, and AgentKit deployment from the workbench. In production, provide them through environment variables or a secret manager rather than project files.

Create an agent

On Add Agent, select Custom. Intelligent, template, and workflow entries are not available.
Configure the model, instruction, tools, memory, and knowledge base, and add skills from Skill Hub, a local upload, or an AgentKit SkillSpace. Multi-agent projects can also use sequential, parallel, loop, or A2A nodes.
Review the generated files and run them in a restricted temporary process; download a ZIP if you need to work offline.
Select AgentKit deployment and monitor the build-image, deploy, and publish stages.

The temporary test process is retained for 1,800 seconds by default and can be changed with --generated-agent-test-run-ttl. Generated code can call external services or access data available to Studio, so test only trusted projects and give Studio restricted credentials.

Manage agents

Manage Agents lists AgentKit runtimes deployed through this workbench by the signed-in user. The list is filtered by the user identity recorded during deployment and exposes:

Runtime name, ID, status, region, and creation time;
Model, description, project, version, resources, and update time;
Bound Memory, Tool, Knowledge, and MCP Toolset identifiers;
Runtime environment variables and primary-agent information.
Agent topology, remote traces, and global deployment-task state.

The data-plane API key is not stored in the browser. The management page therefore shows primary-agent information available from the control plane and does not use data-plane credentials to load the complete sub-agent tree.

Delete permanently removes the corresponding AgentKit runtime. Confirm that it no longer serves traffic and back up required data and configuration before proceeding.

The management page can display runtime environment-variable values. Restrict Studio to authorized users and avoid storing plaintext secrets in ordinary environment variables; prefer the platform’s secret-management features.

`veadk studio` options

Option	Type	Default	Description
`--agents-dir`	`str`	`.`	Parent directory of agent applications. Each child directory with `agent.py` exposing `root_agent` is an app.
`--frontend-dir`	`str \| None`	Bundled UI, then `./frontend/dist`	Override the built Studio UI directory.
`--host`	`str`	`127.0.0.1`	Bind address.
`--port`	`int`	`8000`	Bind port.
`--dev`	Boolean flag	`false`	Load local agents in the picker instead of cloud AgentKit Runtimes.
`--vite`	Boolean flag	`false`	Serve only the API and allow CORS from the Vite development server at `http://localhost:5173`.
`--oauth2-user-pool`	`str \| None`	`None`	VeIdentity user-pool name. Combine with a client name or UID to enable SSO.
`--oauth2-user-pool-client`	`str \| None`	`None`	VeIdentity user-pool client name.
`--oauth2-user-pool-uid`	`str \| None`	`OAUTH2_USER_POOL_ID`	Select the VeIdentity user pool by UID.
`--oauth2-user-pool-client-uid`	`str \| None`	`OAUTH2_USER_POOL_CLIENT_ID`	Select the user-pool client by UID.
`--oauth2-redirect-uri`	`str \| None`	`OAUTH2_REDIRECT_URI`, otherwise `http://{host}:{port}/oauth2/callback`	OAuth2 callback. Public deployments require an externally reachable URL.
`--oauth2-provider`	`str \| None`	`OAUTH2_PROVIDER`; defaults to `veidentity` with a pool	SSO provider identifier.
`--oauth2-provider-label`	`str \| None`	`OAUTH2_PROVIDER_LABEL`	Login-button label.
`--auth-mode`	`frontend \| gateway`	`frontend`	`frontend` handles login in Studio; `gateway` trusts JWT identity forwarded by an upstream gateway. It also reads `VEADK_FRONTEND_AUTH_MODE`.
`--generated-agent-test-run-ttl`	`int`	`1800`	Lifetime in seconds for temporary generated-agent test processes.
`--open` / `--no-open`	`bool`	`--no-open`	Open the default browser when ready. Ignored with `--vite`.

Deploy to VeFaaS

veadk studio deploy deploys Studio as a VeFaaS application protected by VeIdentity login. It creates or reuses a Serverless API Gateway. Unless you pass an IAM role, it also creates or reuses VeADKFrontendServiceRole and VeADKFrontendPolicy. After deployment, the command registers the public callback with the user-pool client and updates the application configuration.

This operation creates or changes VeFaaS, API Gateway, IAM, and VeIdentity resources. It can incur charges and affect production access. The default role has broad permissions to create and manage AgentKit runtimes and related cloud resources. Have an administrator review the scope before production deployment; pass --iam-role to use a preconfigured, narrower role.

Prepare the user-pool UID, user-pool client UID, and suitable Volcengine credentials, then run:

export VOLCENGINE_ACCESS_KEY="your-access-key"
export VOLCENGINE_SECRET_KEY="your-secret-key"

veadk studio deploy \
  --user-pool-id "your-user-pool-id" \
  --allowed-client-id "your-user-pool-client-id" \
  --vefaas-app-name "veadk-studio" \
  --region "cn-beijing" \
  --project "default" \
  --veadk-version "1.0.6"

On success, the terminal prints the public URL and VeFaaS application ID. Opening the URL redirects the user through VeIdentity login. --region selects the Studio deployment region, defaults to cn-beijing, and also supports cn-shanghai; VeFaaS, API Gateway, and other resources are created in that region. Deployment also locates the VeIdentity user pool and client across the deployment region and the Beijing and Shanghai regions: it queries the deployment region first, then searches the other region on a miss, emitting a warning and continuing when matched cross-region. --project selects the VeFaaS function project and defaults to default. The deployer’s long-lived access and secret keys are not written to the VeFaaS application environment. Deployed Studio uses temporary credentials from its bound IAM role.

Deployment options

Option	Type	Default	Description
`--user-pool-id`	`str`	Required	VeIdentity user-pool UID used for Studio login.
`--allowed-client-id`	`str`	Required	User-pool client UID used for login.
`--client-secret`	`str`	`""`	Supply only if the secret cannot be read from the client UID. Direct arguments can enter shell history, so omit it when lookup is available.
`--vefaas-app-name`	`str`	Required	VeFaaS application name, 4–64 characters containing letters, digits, and hyphens, but no underscores.
`--region`	`cn-beijing \| cn-shanghai`	`cn-beijing`	Studio deployment region; also determines the region for VeFaaS, API Gateway, and related resources. The deploy command searches VeIdentity user pools across Beijing and Shanghai.
`--project`	`str`	`default`	VeFaaS function project.
`--iam-role`	`str \| None`	`None`	Existing IAM role TRN for the function. If omitted, the default role is created or reused.
`--gateway-name`	`str`	`""`	Serverless API Gateway name. If omitted, an existing gateway is reused or a gateway is created when none exists.
`--gateway-service-name`	`str`	`""`	Gateway service name; leave empty for automatic configuration.
`--gateway-upstream-name`	`str`	`""`	Gateway upstream name; leave empty for automatic configuration.
`--volcengine-access-key`	`str \| None`	`VOLCENGINE_ACCESS_KEY`	Access key used during deployment. Prefer the environment variable.
`--volcengine-secret-key`	`str \| None`	`VOLCENGINE_SECRET_KEY`	Secret key used during deployment. Prefer the environment variable.
`--veadk-version`	`str`	Latest release	`veadk-python` version installed in VeFaaS. Set it to `1.0.6` to reproduce this version.
`--from-source`	Boolean flag	`false`	Build and deploy a wheel from the current checkout, including uncommitted changes. Use it for unreleased validation, not together with a pinned release workflow.

Overview

Get started

Core components

Observability

Extensions

Frontend

Security

Deployment

Start locally

Create an agent

Manage agents

`veadk studio` options

Deploy to VeFaaS

Deployment options

​Start locally

​Create an agent

​Manage agents

​veadk studio options

​Deploy to VeFaaS

​Deployment options

Start locally

Create an agent

Manage agents

`veadk studio` options

Deploy to VeFaaS

Deployment options