A2A・MCP・LLM のトラフィックを統合的にプロキシし認可・制限・追跡する agentgateway

./scripts/setup.sh
./scenarios/01-a2a/run.sh

config:
  # 未指定だと agentgateway が鍵を生成してこのファイルに書き込むため、環境変数で渡す
  session:
    key: $SESSION_KEY
  readinessAddr: 127.0.0.1:15021
  statsAddr: 127.0.0.1:15020
gateways:
  a2a:
    port: 3000
    bindAddress: 127.0.0.1

routes:
- name: planner
  gateways: a2a
  matches:
  - path:
      pathPrefix: /planner
  policies:
    urlRewrite:
      path:
        prefix: /
    a2a: {}
  backends:
  - host: 127.0.0.1:9302
- name: worker
  gateways: a2a
  matches:
  - path:
      pathPrefix: /worker
  policies:
    urlRewrite:
      path:
        prefix: /
    a2a: {}
  backends:
  - host: 127.0.0.1:9301

card := &a2a.AgentCard{
	Name:        *name,
	Description: *name + " agent",
	// gateway はこの URL を自分の URL に書き換えて返す (agent card rewrite)
	SupportedInterfaces: []*a2a.AgentInterface{
		a2a.NewAgentInterface("http://"+*addr+"/invoke", a2a.TransportProtocolJSONRPC),
	},
	// ...
}

mux := http.NewServeMux()
mux.Handle("/invoke", a2asrv.NewJSONRPCHandler(a2asrv.NewHandler(exec)))
mux.Handle(a2asrv.WellKnownAgentCardPath, a2asrv.NewStaticAgentCardHandler(card))

$ curl -s http://127.0.0.1:9302/.well-known/agent-card.json | jq '.supportedInterfaces'
[
  {
    "url": "http://127.0.0.1:9302/invoke",
    "protocolBinding": "JSONRPC",
    "protocolVersion": "1.0"
  }
]

$ curl -s http://127.0.0.1:3000/planner/.well-known/agent-card.json | jq '.supportedInterfaces'
[
  {
    "url": "http://127.0.0.1:3000/planner/invoke",
    "protocolBinding": "JSONRPC",
    "protocolVersion": "1.0"
  }
]

$ bin/agent -name client -send http://127.0.0.1:3000/planner "checkout"
[planner] [worker] received "checkout"

route=default/planner http.method=GET http.path=/planner/.well-known/agent-card.json http.status=200 protocol=a2a duration=0ms
route=default/worker http.method=GET http.path=/worker/.well-known/agent-card.json http.status=200 protocol=a2a duration=0ms
route=default/worker http.method=POST http.path=/worker/invoke http.status=200 protocol=a2a a2a.method=SendMessage a2a.response.outcome=success a2a.result.kind=message a2a.context.id=01a1d56f-d37b-7d59-a75a-092092397b75 duration=0ms
route=default/planner http.method=POST http.path=/planner/invoke http.status=200 protocol=a2a a2a.method=SendMessage a2a.response.outcome=success a2a.result.kind=message a2a.context.id=01a1d56f-d37a-7a99-b1f4-4f1d5f1237de duration=1ms

card, err := agentcard.NewResolver(hc).Resolve(ctx, cardURL, agentcard.WithPath(a2asrv.WellKnownAgentCardPath))

mcp:
  gateways: mcp
  policies:
    jwtAuth:
      mode: strict
      providers:
      - issuer: agent-gateway-playground
        audiences: [playground]
        jwks:
          file: ./jwt/jwks.json
    # tool 単位の認可。判定に使えるのは tool 名・target・JWT claim など (引数は見えない)
    mcpAuthorization:
      rules:
      # 有効な JWT があれば読み取り系 tool は使える
      - allow: 'mcp.tool.name in ["search_docs", "get_status"]'
      # restart_service は operator だけ
      - allow: 'jwt.role == "operator" && mcp.tool.name == "restart_service"'
  targets:
  - name: docs
    mcp:
      host: http://127.0.0.1:9201/mcp
  - name: ops
    mcp:
      host: http://127.0.0.1:9202/mcp

## token なし
connect: calling "initialize": sending "initialize": Unauthorized

## viewer: tools/list と restart_service
tool: docs_search_docs
tool: ops_get_status
call: calling "tools/call": sending "tools/call": unknown resource: rejected by transport: Bad Request

## operator: restart_service (checkout)
tool: docs_search_docs
tool: ops_get_status
tool: ops_restart_service
result (isError=false): checkout: restarted

http.status=401 protocol=http error="authentication failure: no bearer token found" reason=JwtAuth
http.status=400 jwt.sub=alice protocol=mcp mcp.method.name=tools/call mcp.target=ops mcp.resource.type=tool gen_ai.tool.name=restart_service error="mcp: authorization denied for tool: ops_restart_service" reason=Authorization
http.status=200 jwt.sub=bob protocol=mcp mcp.method.name=tools/call mcp.target=ops mcp.resource.type=tool gen_ai.tool.name=restart_service

    # 引数を見た制御は guardrail で行う。payments の再起動は operator でも拒否する
    mcpGuardrails:
      processors:
      - kind: expression
        methods: {"tools/call": request}
        condition: >-
          mcp.tool.target == "ops" &&
          mcp.params.name == "restart_service" &&
          has(mcp.params.arguments.service) &&
          mcp.params.arguments.service == "payments"
        reject: "restarting payments requires a change request"

## operator: restart_service (payments) -> guardrail
result (isError=true): restarting payments requires a change request

http.status=200 jwt.sub=bob protocol=mcp mcp.method.name=tools/call mcp.target=ops mcp.resource.type=tool gen_ai.tool.name=restart_service error="mcp: mcpGuardrails rejected: restarting payments requires a change request" reason=MCP

llm:
  gateways: llm
  policies:
    apiKey:
      mode: strict
      location:
        header:
          name: authorization
          prefix: 'Bearer '
      keys:
      - key: $TEAM_A_KEY
        metadata:
          team: team-a
      - key: $TEAM_B_KEY
        metadata:
          team: team-b
    # team ごとに 1 分あたり 40 token まで
    localRateLimit:
    - type: tokens
      maxTokens: 40
      tokensPerFill: 40
      fillInterval: 60s
      key: apiKey.team
  models:
  - name: fake
    provider:
      custom:
        formats:
        - type: completions
    params:
      baseUrl: http://127.0.0.1:9100/v1
      model: fake-1

## key なし
401 authentication failed

## team-a を 5 回 (上限 40 token/分)
200 {"prompt_tokens":5,"completion_tokens":7,"total_tokens":12}
200 {"prompt_tokens":5,"completion_tokens":7,"total_tokens":12}
200 {"prompt_tokens":5,"completion_tokens":7,"total_tokens":12}
200 {"prompt_tokens":5,"completion_tokens":7,"total_tokens":12}
429 rate limit exceeded

## team-b (別 bucket)
200 {"prompt_tokens":5,"completion_tokens":7,"total_tokens":12}

http.status=200 protocol=llm gen_ai.operation.name=chat gen_ai.provider.name=custom gen_ai.request.model=fake-1 gen_ai.response.model=fake-1 agw.ai.original_model=fake gen_ai.usage.input_tokens=5 gen_ai.usage.output_tokens=7
http.status=429 protocol=llm agw.ai.original_model=fake error="rate limit exceeded" reason=RateLimit

agentgateway_gen_ai_client_token_usage_sum{gen_ai_token_type="input",gen_ai_operation_name="chat",gen_ai_system="custom",gen_ai_request_model="fake-1",gen_ai_response_model="fake-1"} 25.0
agentgateway_gen_ai_client_token_usage_sum{gen_ai_token_type="output",gen_ai_operation_name="chat",gen_ai_system="custom",gen_ai_request_model="fake-1",gen_ai_response_model="fake-1"} 35.0

config:
  tracing:
    otlpEndpoint: http://127.0.0.1:4318
    otlpProtocol: http
    randomSampling: "true"

func Client(header, value string) *http.Client {
	var rt http.RoundTripper = otelhttp.NewTransport(http.DefaultTransport)
	if value != "" {
		rt = headerRT{rt, header, value}
	}
	return &http.Client{Transport: rt}
}

trace 060470cb44a14a16e8ec4c68974468c4 (39 spans)
  - [client] send http://127.0.0.1:3000/planner
    - [client] HTTP GET
      - [agentgateway] GET /planner/*
        - [agentgateway] GET
          - [planner] GET /.well-known/agent-card.json
    - [client] HTTP POST
      - [agentgateway] POST /planner/* a2a.method=SendMessage
        - [agentgateway] POST
          - [planner] POST /invoke
            - [planner] HTTP GET
              - [agentgateway] GET /worker/*
                - [agentgateway] GET
                  - [worker] GET /.well-known/agent-card.json
            - [planner] HTTP POST
              - [agentgateway] POST /worker/* a2a.method=SendMessage
                - [agentgateway] POST
                  - [worker] POST /invoke
                    - [worker] HTTP POST
                      - [agentgateway] server/discover
                        - [agentgateway] server/discover docs
                        - [agentgateway] server/discover ops
                    - [worker] HTTP POST
                      - [agentgateway] initialize
                        - [agentgateway] initialize docs
                        - [agentgateway] initialize ops
                    - [worker] HTTP POST
                      - [agentgateway] notifications/initialized
                        - [agentgateway] notifications/initialized docs
                        - [agentgateway] notifications/initialized ops
                    - [worker] HTTP POST
                      - [agentgateway] tools/call gen_ai.tool.name=get_status
                        - [agentgateway] tools/call ops_get_status gen_ai.tool.name=get_status
                    - [worker] HTTP DELETE
                      - [agentgateway] DELETE /mcp/*
                        - [agentgateway] DELETE docs
                        - [agentgateway] DELETE ops
                    - [worker] HTTP POST
                      - [agentgateway] POST /v1/chat/completions gen_ai.operation.name=chat gen_ai.usage.input_tokens=8 gen_ai.usage.output_tokens=10
                        - [agentgateway] POST