Agent Gateway Core functional Architecture

Agent Gateway Main Framework The overall architecture of the Agent Gateway consists of four logical sub-gateways. They may be deployed on the same physical node or distributed across multiple nodes. Each sub-gateway has clearly defined responsibilities and standardized interfaces, collectively providing unified ingress and egress control. The following subsections describe the functions of each sub-gateway.

A2A Gateway: Inter-Agent Communication The A2A Gateway is the core of the Agent Gateway. It is responsible for handling inter-agent connectivity, discovery, task routing, and security management. It exposes standardized A2A protocol endpoints externally (e.g., /.well-known/agent.jsonand POST /a2a/tasks) and connects internally to sub-agents or upstream Supervisor Agents. The A2A Gateway comprises the following five core capabilities:

Protocol Translation

Description: Translates external A2A requests (HTTP/HTTPS, WebSocket, gRPC, etc.) into commands understandable by internal agents (e.g., local MQTT, DDS, soft bus messages), and vice versa;
Applicable Scenarios: Bridging external protocols with internal proprietary protocols during cross-domain agent communication; unifying protocols across different subsystems (ZigBee, BLE, Wi-Fi) within a single domain;
Design Considerations: Support plugin-based protocol adapters to allow dynamic loading of new transport protocols and serialization formats (JSON, Protobuf, CBOR).

Authentication and Security

Description: Performs identity verification and authorization checks on all incoming requests to the A2A Gateway. Supports OAuth 2.0 Device Flow, JWT issuance and verification, and Scope whitelisting. For cross-domain requests, mutual TLS (mTLS) or Federation-based trust relationships must be established;
Applicable Scenarios: Mandatory identity verification for cross-domain calls; optional within a single domain to prevent malicious nodes from impersonating legitimate agents;
Design Considerations: Built-in Certificate Revocation List (CRL) caching; support for Human-in-the-Loop (HITL) triggering of secondary confirmation for highly sensitive operations (e.g., unlocking a door).

Asynchronous Task Management

Description: Manages the lifecycle of all tasks passing through the A2A Gateway, including task creation, status tracking, result delivery, and timeout handling. Follows the Task object model defined in the Google A2A protocol (task_id, status, artifacts, messages);
Applicable Scenarios: Long-running agent collaboration tasks (e.g., "whole-house cleaning" requiring sequential execution by multiple agents); cross-domain tasks that may require asynchronous waiting due to network latency;
Design Considerations: Support persistent task queues (SQLite/LevelDB); provide two result notification methods: callback URL or WebSocket push; support task cancellation and pause/resume.

Peer-to-Peer Network Management

Description: Manages peer connections with other domain Agent Gateways. Includes NAT traversal (STUN/TURN/ICE), reverse channel maintenance (WebSocket/MQTT long-lived connections), heartbeat keep-alive, and reconnection strategies;
Applicable Scenarios: Between a home domain Gateway and a cloud Relay Gateway; between a home domain Gateway and a vehicle domain Gateway;
Design Considerations: Support both active connection initiation and passive acceptance modes; provide connection quality monitoring and automatic switchover to backup paths.

Agent Routing Capabilities Agent routing capabilities form the intelligent scheduling module within the A2A Gateway, comprising the following sub-functions:

Agent Registry: Receives registration information (Agent ID, Skill list, address, protocol type) from all agents within the domain, forming a domain-wide agent directory. Supports dynamic registration/deregistration and automatic removal upon heartbeat timeout.
Agent Capability Discovery: Exposes an aggregated Agent Card externally (/.well-known/agent.json), hiding internal topology; provides capability query interfaces internally for other agents or upper-layer orchestration engines to search for available Skills.
Agent Task Routing: Distributes tasks to the correct agent instance based on the target Skill ID or intent matching. Supports content-based routing (e.g., by device type or zone) and weight-based routing.
Load Balancing: When multiple agent instances provide the same Skill (e.g., redundant backups), distributes tasks according to predefined policies (round-robin, least connections, consistent hashing) to improve availability.

MCP Gateway: Tool Invocation The MCP (Model Context Protocol) Gateway is responsible for managing the registration, discovery, and invocation of external tools. It provides a unified way for agents to invoke non-agent services or device capabilities, such as:

Calling a weather API to retrieve real-time data;
Controlling IoT devices that do not possess full agent capabilities (via device SDKs);
Accessing databases or file systems.

Core Functions:

Tool Registration and Metadata Management: Receives tool provider Schema registrations (compliant with MCP Tool Schema specification), including input parameters, output format, and authentication requirements.
Tool Invocation Proxy: Forwards tool invocation requests initiated by agents to the corresponding tool backend and returns results to the agent. Supports both synchronous and asynchronous modes.
Security Sandbox: Performs permission checks (whether the caller is authorized to use the tool), rate limiting, and input filtering for tool invocations to prevent malicious injection.
Tool Chaining: Supports composing multiple tools into composite tools, simplifying orchestration logic on the agent side.

Relationship between the MCP Gateway and the A2A Gateway: The A2A Gateway handles agent-to-agent communication; the MCP Gateway handles agent-to-tool communication. Both may share common infrastructure services such as authentication and logging within the Agent Gateway.

Model Routing Gateway: Large Language Model Invocation The Model Routing Gateway provides a unified entry point for agents to invoke large language models (LLMs), enabling model selection, load balancing, and cost control. Core Functions:

Model Registration and Routing: Maintains a list of available models (e.g., Hunyuan, DeepSeek, GPT-4o, etc.) and routes requests to the most suitable model instance based on model preference, task type (reasoning, generation, translation), token budget, and other factors.
Unified API Adaptation: Converts vendor-specific APIs (OpenAI-compatible format, Hunyuan API, Claude API, etc.) into a standard interface (e.g., OpenAI Chat Completion format), reducing integration complexity for agents.
Context Management and Caching: Implements semantic caching for frequently occurring requests (e.g., common knowledge queries) to reduce duplicate invocations; supports sliding window context truncation to control token consumption.
Security and Compliance: Performs content filtering on model outputs (sensitive word detection, privacy leakage detection); records audit logs for compliance purposes.

The Model Routing Gateway is typically deployed in the cloud or at the edge. It works in conjunction with the A2A Gateway: agents delegate inference tasks to the Model Routing Gateway via the A2A Gateway, which then invokes the specific LLM.

Network Gateway: Network Connectivity The Network Gateway provides underlying network connection management capabilities, ensuring that the Agent Gateway can stably access the internet and communicate with external entities. Core Functions:

Connection Management: Manages the connection state of multiple network links (Ethernet, Wi-Fi, cellular), supporting primary/backup switching and failover.
NAT Traversal: Integrates STUN/TURN/ICE clients to provide underlying P2P capabilities for peer-to-peer network management; relays traffic via TURN when no public IP is available.
Firewall and Port Mapping: Automatically configures UPnP or manual port forwarding rules so that external A2A requests can reach the Gateway's listening ports.
Quality of Service (QoS): Assigns priority levels to different types of traffic (control commands, media streams, bulk data) to ensure low latency for critical tasks.
Network Diagnostics: Provides diagnostic tools such as connectivity testing, bandwidth measurement, and packet loss statistics to assist operations and maintenance.

The Network Gateway typically runs on home routers, edge servers, or cloud hosts, serving as the bridge between the Agent Gateway and the physical network.