geap-tour

KO | EN

gitlite — search

#editor #redis #linux #framework #web #github #kubernetes #open-source #dotnet #ai

(★ 9)

GEAP Workshop: Hands-on Gemini Enterprise Agent Platform tour — ADK agents, MCP servers, Agent Armor, evaluation, governance, and optimization on Google Cloud

File Explorer

ZIP Download

- SKILL.md
- - eval_ci.yaml
  - eval_pipeline.yaml
- - router_cost.png
- __init__.py
- agent_executor.py
- cost_model.py
- fast_api_app.py
- ui_builder.py
- - .python-version
  - Procfile
  - requirements.txt
- - 01_multi_agent_topology.txt
  - 02_deployment_architecture.txt
  - 03_eval_pipeline.txt
  - 04_agent_identity_gateway.txt
  - 05_observability_stack.txt
  - 06_ci_cd_flow.txt
  - 07_agent_armor.txt
  - 08_reference_architecture.txt
- - .gitkeep
  - 01_multi_agent_topology.png
  - 02_deployment_architecture.png
  - 03_eval_pipeline.png
  - 04_agent_identity_gateway.png
  - 05_observability_stack.png
  - 06_ci_cd_flow.png
  - 07_agent_armor.png
  - 08_reference_architecture.png
- batch_manifest.yaml
- - evaluation_pipeline.txt
  - geap_architecture_overview.txt
  - manifest.yaml
  - model_armor_security_layers.txt
  - multi_agent_mcp_topology.txt
- - cost_comparison.png
  - eval_batch_results.png
  - eval_batch_scores.png
  - eval_complexity_routing.png
  - eval_console_agent_engines.png
  - eval_console_agent_traces.png
  - eval_console_bigquery.png
  - eval_console_evaluation.png
  - eval_console_metrics_dashboard.png
  - eval_console_metrics_tab.png
  - eval_console_monitoring_alerts.png
  - eval_console_online_monitors.png
  - eval_console_traces.png
  - eval_per_case_scores.png
  - ge_coordinator_agent_direct.png
  - ge_router_agent_console.png
  - ge_router_agent_direct.png
  - ge_router_agent_live.png
  - ge_router_canvas_rendered.png
  - ge_router_canvas_rendered_full.png
  - ge_router_engine_overview.png
  - ge_router_live_canvas_dashboard.png
  - ge_two_agents_published.png
  - geap_architecture.png
  - identity_types.png
  - opus_trace_detail.png
  - router_cost_published_output.png
  - routing_summary.png
  - session1_agent_builder.png
  - session1_agent_engine.png
  - session1_architecture_overview.png
  - session1_cloud_run_mcp_detail.png
  - session1_workload_identity.png
  - session2_agent_gateway.png
  - session2_agent_trace_detail.png
  - session2_agent_trace_spans.png
  - session2_agent_traces.png
  - session2_bigquery.png
  - session2_bigquery_sink.png
  - session2_cloud_logging.png
  - session2_cloud_trace.png
  - session2_evaluation.png
  - session2_evaluation_pipeline.png
  - session2_monitoring_alerts.png
  - session3_agent_registry.png
  - session3_agent_registry_mcp.png
  - session3_business_policies.png
  - session3_policies.png
  - session3_policies_iam.png
  - session4_model_armor.png
  - session5_email_alert.png
  - session5_metrics_explorer_out_of_spec.png
  - session5_monitoring_alert_firing.png
  - session5_pipeline_architecture.jpg
  - trace_waterfall.png
- - cloud_run_services.json
  - logging_sink.json
  - model_armor_geap-workshop-prompt.json
  - model_armor_geap-workshop-response.json
- eval_operations.md
- eval_slides.html
- eval_slides.pdf
- eval_slides.pptx
- evaluation_demo.md
- faq.md
- gateway_test_report.md
- geap_smoke_test_gaps.md
- monitoring_integration_guide.md
- multi_model_cost_comparison.md
- publishing_agents_to_gemini_enterprise.md
- README.md
- router_cost_visualizer.html
- router_cost_visualizer_published.md
- slides.html
- slides.pdf
- slides.pptx
- workshop_guide.md
- dashboard.json
- read_metrics.py
- restart_agents.py
- - booking_toolspec.json
  - expense_toolspec.json
  - search_toolspec.json
- capture_eval_console.py
- capture_monitoring_screenshots.py
- capture_screenshots.py
- cleanup.sh
- deploy_all.sh
- deploy_router.sh
- deploy_router_ui.sh
- generate_diagrams.sh
- generate_pptx.py
- generate_skills.py
- publish_agents_to_ge.py
- publish_agents_to_ge.sh
- register_agent_registry.sh
- register_router_ui_agent.py
- render_router_panel.py
- setup_agent_gateway.sh
- setup_agent_identity.sh
- setup_endpoint_iam.sh
- setup_governance_policies.sh
- setup_logging_sink.sh
- setup_model_armor.sh
- verify_deployment.sh
- vnc_setup.sh
- __init__.py
- agent.py
- - __init__.py
  - _shared.py
  - coordinator_agent.py
  - expense_agent.py
  - travel_agent.py
- - __init__.py
  - config.py
- - __init__.py
  - deploy_agents.py
  - deploy_all.py
  - deploy_mcp_servers.py
- - __init__.py
  - agent_eval_configs.py
  - agents_cli_demo.sh
  - batch_eval.py
  - complexity_metrics.py
  - env_simulation.py
  - manage_monitors.py
  - metric_registry.py
  - multi_agent_batch_eval.py
  - offline_trace_eval.py
  - one_time_eval.py
  - publish_metrics.py
  - quality_alerts.py
  - router_eval.py
  - router_inference.py
  - router_quality_judge.py
  - router_report.py
  - run_all_evals.py
  - run_router_eval.sh
  - run_user_sim.sh
  - sample_traces.jsonl
  - sdk_optimize.py
  - setup_online_evaluators.py
  - setup_online_monitors.py
  - simulated_eval.py
  - verify_monitors.py
- - __init__.py
- - __init__.py
  - expense_sampler_config.json
  - router_sampler_config.json
  - run_optimize.py
  - sampler_config.json
  - travel_sampler_config.json
- - __init__.py
  - agent.py
  - agents.py
  - armor.py
  - complexity.py
  - config.py
  - cost_tracker.py
  - demo.py
  - requirements.txt
  - router_eval_set.evalset.json
  - run_comparison.py
- - __init__.py
  - async_traffic_alerts.py
  - generate_bad_traffic.py
  - generate_traffic.py
- __init__.py
- config.py
- registry.py
- sitecustomize.py
- __init__.py
- test_agents.py
- test_armor.py
- test_deploy_config.py
- test_e2e.py
- test_eval.py
- test_eval_coverage.py
- test_mcp_servers.py
- test_multi_agent_eval.py
- test_router.py
- test_router_ui_logic.py
.env.example
.gitignore
agent.md
agents-cli-manifest.yaml
pyproject.toml
README.md
uv.lock

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

A hands-on workshop demonstrating the full Gemini Enterprise Agent Platform (GEAP) — from building ADK agents with MCP tools through deployment, governance, evaluation, and optimization.

## Reference Architecture

![GEAP Reference Architecture (detailed)](https://raw.githubusercontent.com/jswortz/geap-tour/main/diagrams/outputs/08_reference_architecture.png)

*Detailed reference architecture showing all GEAP platform components: Shared Service Project (Agent Gateway with ingress/egress, Model Armor input/output screening, Cloud Armor), Build & CI/CD (Cloud Build, Artifact Registry, Workload Identity Federation), three project zones (Development with ADK, Evaluation Framework, GEPA Optimization, Observability; Testing/Staging with staged agents and MCP servers; Production with Agent Engine, SPIFFE Identity, Memory Bank, Multi-Model Router, OTel Tracing), Agent Registry fleet catalog spanning all projects, Vertex AI Models (Gemini Flash/Pro, Claude Opus via LiteLLM), and Gemini Enterprise with A2A protocol for business end users.*

## What's Inside

| Area | Description |
|------|-------------|
| **ADK Agents** | Three agents (travel, expense, coordinator) built with Google Agent Development Kit |
| **MCP Servers** | Three FastMCP tool servers deployed to Cloud Run (search, booking, expense) |
| **Deployment** | Agent Runtime deployment with identity, gateway, and OTel tracing |
| **Evaluation** | One-time, continuous (online evaluators with custom rubrics), and simulated evaluation pipelines |
| **Model Armor** | Model Armor templates for input/output screening + client-side guardrails |
| **Governance** | Agent identity (SPIFFE), agent gateway (ingress + egress), agent registry, Semantic Governance Policies (SGP) |
| **Multi-Model Router** | Complexity-based routing across Flash Lite, Flash, and Opus |
| **Optimization** | Agent optimization via GEPA algorithm |
| **CI/CD** | GitHub Actions workflow running simulated evals on PRs |
| **Diagrams** | Architecture diagrams generated with Paper Banana |

## 📓 Interactive Notebooks

Six SDK-first notebooks — flat, L1-SDK-native, with mutating/infra steps guarded behind `GEAP_RUN_*` env flags (they run clean end-to-end with guards off):

| Notebook | What you'll run |
|----------|-----------------|
| ▶ [Build → Deploy → Register](src/deploy/demo/platform_sdk_demo.ipynb) | MCP tools → ADK agents → run → deploy to Agent Engine → register to Gemini Enterprise → routing & cost. **Start here.** |
| ▶ [Evaluation — Quality Flywheel](src/eval/demo/evaluation_sdk_demo.ipynb) | Metrics, rapid/regression/simulated/offline scoring, online monitors, optimization, and quality alerts — all via `client.evals.*`. |
| [Agent Gateway](src/deploy/demo/gateway_sdk_demo.ipynb) | Dual-mode (ingress/egress) config, create gateways, attach at deploy, and the three policy layers (IAM/CEL, Semantic Governance, IAP + Model Armor). |
| [Agent Registry — hub & spoke](src/deploy/demo/registry_sdk_demo.ipynb) | Register/discover, bindings, and **cross-project hub-and-spoke** discovery via App Hub + `agent-registry agents search`. |
| [MCP — create & monitor](src/mcp_servers/demo/mcp_sdk_demo.ipynb) | Author a FastMCP tool, deploy, register, then monitor with Cloud Run metrics, logs, traces, and alerts. |
| [Agent Identity, Memory & Sessions](src/deploy/demo/agent_identity_memory_demo.ipynb) | A simple **Gemini 3.7** agent → deploy with **Agent Identity (SPIFFE)** → **gateway attach config** → **session service** (multi-turn) → **user-scoped Memory Bank** (one user recalls, another can't). |

## Documentation

**Two ways in.** New to the platform? Follow the **[Workshop Guide](docs/workshop_guide.md)** (4 sessions). Prefer to learn by running code? Start with the two **SDK-first notebooks** — first [build & deploy](src/deploy/demo/platform_sdk_demo.ipynb), then [evaluate](src/eval/demo/evaluation_sdk_demo.ipynb) — then go deeper with the **Gateway**, **Registry (hub-and-spoke)**, and **MCP create+monitor** deep-dive notebooks below. A [docs index](docs/README.md) maps everything else.

| Document | Description |
|----------|-------------|
| ▶ **[Build → Deploy → Register Notebook](src/deploy/demo/platform_sdk_demo.ipynb)** | **Start here to build** — SDK-first companion: MCP tools → ADK agents → run → deploy to Agent Engine → register to Gemini Enterprise → multi-model routing & cost. Mutating steps are guarded (`GEAP_RUN_DEPLOY=1` / `GEAP_PUBLISH=1`). |
| ▶ **[Interactive Evaluation Notebook](src/eval/demo/evaluation_sdk_demo.ipynb)** | **Start here for evals** — flat & **SDK-first**: every Quality-Flywheel phase calls `client.evals.*` / `vertexai.types.*` **inline** (custom code is explicitly called out), scored against the deployed agent. Headless: `python -m src.eval.demo.full_eval_demo` |
| **Deep-dive: [Agent Gateway](src/deploy/demo/gateway_sdk_demo.ipynb)** | Govern traffic + attach policies — dual-mode config (live), create gateways, attach at deploy, and the 3 policy layers (IAM/CEL, Semantic Governance, IAP + Model Armor). Guarded via `GEAP_RUN_GATEWAY`. |
| **Deep-dive: [Agent Registry (hub-and-spoke)](src/deploy/demo/registry_sdk_demo.ipynb)** | Register/discover + **cross-project hub-and-spoke** (App Hub boundary → `agent-registry agents search` across a spoke project), bindings, cross-project metrics scoping. Guarded via `GEAP_RUN_REGISTRY`. |
| **Deep-dive: [MCP Server create + monitor](src/mcp_servers/demo/mcp_sdk_demo.ipynb)** | Author a FastMCP server (live), deploy, register, then monitor — Cloud Run request metrics (`monitoring_v3`), logs, trace spans, and a health alert. Guarded via `GEAP_RUN_DEPLOY`. |
| **[Agent Identity, Memory & Sessions](src/deploy/demo/agent_identity_memory_demo.ipynb)** | Platform tour on **Gemini 3.7**: a simple agent deployed to Agent Engine with **Agent Identity (SPIFFE)**, the ingress/egress **gateway attach config** (shown + explained; attach is Private-Preview gated), the **session service** (multi-turn), and **user-scoped Memory Bank** (Alice recalls; Bob sees nothing). Runs e2e; deployed engine `simple_time_agent`. |
| [Workshop Guide](docs/workshop_guide.md) | Full 4-session hands-on walkthrough |
| [Monitoring Guide](docs/monitoring_integration_guide.md) | Quality alerts and custom metrics bridge guide |
| [Component FAQ](docs/faq.md) | What each component does and why it matters |
| [Evaluation Guide](docs/eval_operations.md) | Evaluation pipeline operations + **coverage matrix** for the GEAP Optimize → Evaluation docs |
| [Evaluation Demo Walkthrough](docs/evaluation_demo.md) | End-to-end Quality Flywheel demo (100% doc coverage) — `python -m src.eval.demo.full_eval_demo` |
| [Evaluation Slides](docs/eval_slides.html) ([.pptx](docs/eval_slides.pptx)) | 7-slide Google Cloud–style teach-in on agent evals (real console screenshots + code deep links) |
| [Cost Comparison](docs/multi_model_cost_comparison.md) | Multi-model routing cost analysis |
| [Publish Agents to Gemini Enterprise](docs/publishing_agents_to_gemini_enterprise.md) | How-to: register the **coordinator + router** agents *directly* to a GE app (ADK reasoning-engine registration) — `agents-cli` + repo script, with live console evidence |
| [Agents Overview](agent.md) | Quick reference for the coordinator + router agents (engine IDs, env vars) |
| [Slides](docs/slides.pptx) | Workshop deck (34 slides) |

## Reference Documentation

For official product guides and SDK references:
- [Agent Development Kit (ADK) Overview](https://cloud.google.com/vertex-ai/generative-ai/docs/agent-development-kit/overview)
- [Agent Engine (Agent Runtime)](https://cloud.google.com/vertex-ai/generative-ai/docs/agent-engine/overview)
- [Model Context Protocol (MCP) on Vertex AI](https://cloud.google.com/vertex-ai/generative-ai/docs/agent-development-kit/mcp-tools)
- [Agent Gateway Ingress & Egress](https://cloud.google.com/products/agent-gateway)
- [Model Armor Security Templates](https://cloud.google.com/security/products/model-armor)
- [Cloud Monitoring Alerts](https://cloud.google.com/monitoring/alerts)
- [Cloud Trace Overview](https://cloud.google.com/trace/docs)
- [Vertex AI Agent Evaluation](https://cloud.google.com/vertex-ai/generative-ai/docs/agent-engine/evaluate)
- [Workload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation)
- [Agent Registry Overview](https://cloud.google.com/vertex-ai/generative-ai/docs/agent-registry/overview)

## Quick Start

```bash
# Install dependencies
uv sync

# Copy and configure environment
cp .env.example .env
# Edit .env with your GCP project details

# Run tests
uv run pytest tests/

# Deploy everything in one command
bash scripts/deploy_all.sh

# Setup governance policies (IAM only)
bash scripts/setup_governance_policies.sh

# Setup governance policies with SGP (IAM + Semantic Governance Policies)
bash scripts/setup_governance_policies.sh --sgp
```

## Agent Ingress Routing & Registry

Requests targeting deployed agents flow through a logical client URN mapped in the **Agent Registry** and governed by the **Agent Gateway**:

1. **Logical Endpoint URN:**
   `urn:endpoint:projects-679926387543:projects:679926387543:locations:global:agentregistry:services:coordinator-agent`
   
2. **Registry Mapping:**
   If a Reasoning Engine is redeployed, the service's interface URL in the registry must be updated:
   ```bash
   gcloud alpha agent-registry services update coordinator-agent \
     --location=global \
     --project=wortz-project-352116 \
     --interfaces=protocolBinding=HTTP_JSON,url=https://us-central1-aiplatform.googleapis.com/v1beta1/projects/wortz-project-352116/locations/us-central1/reasoningEngines/<ACTIVE_ENGINE_ID>
   ```

3. **Running the Traffic Simulator & Alert Verification:**
   To test traffic routing, trigger evaluations, and verify Cloud Monitoring alert policies:
   ```bash
   # Generates bad/good traffic, polls logs, publishes custom metrics, checks alerts
   PYTHONPATH=. uv run python src/traffic/async_traffic_alerts.py
   ```

## Gemini Enterprise Agent — Router Cost Visualizer

The **multi-model router** is published to **Gemini Enterprise** as an A2A/A2UI agent. Business users
chat with it in the GE console; every prompt is classified, routed to the cheapest capable model tier,
and executed, while a **Live Cost Dashboard** renders in the side canvas (KPIs, cumulative cost vs an
all-Opus baseline, spend by tier, and per-prompt routing).

![Gemini Enterprise — Router Cost Visualizer live in the GE canvas](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/ge_router_live_canvas_dashboard.png)

**Try it in Gemini Enterprise**
- Open the agent: [GEAP Router Cost Visualizer in GE](https://vertexaisearch.cloud.google.com/home/cid/c4da98d6-1b97-4e31-bb6a-ba979e363c26/r/agent/14432326554756478249)
- Ask a workload prompt (e.g. *"Plan a 5-day Tokyo trip for 4 with a budget"*) and watch the dashboard accrue cost; use **Routing logic & scoring** to see how each prompt is scored and tiered.

**Deploy / (re)register it yourself**
```bash
# Deploys the A2A/A2UI service to Cloud Run and registers/updates the GE agent
set -a; source .env; set +a
bash scripts/deploy_router_ui.sh
```
- A2A agent card: `https://geap-router-cost-ui-679926387543.us-east1.run.app/a2a/app/.well-known/agent-card.json`
- Backend + UI: [`app/`](app/) · registration: [`scripts/register_router_ui_agent.py`](scripts/register_router_ui_agent.py)
- How routing + cost work: [`docs/multi_model_cost_comparison.md`](docs/multi_model_cost_comparison.md)

## Publish the Two Agents Directly to Gemini Enterprise

Beyond the A2A Router Cost Visualizer above, the workshop's two first-class ADK agents —
**`coordinator_agent`** and **`router_agent`** — can be published **directly** to Gemini Enterprise by
registering their Agent Runtime **reasoning engines** (ADK registration via
`adkAgentDefinition` → `provisionedReasoningEngine`). No Cloud Run wrapper is needed; GE invokes the
reasoning engine natively. In the GE Agents table they appear as type **Agent Engine** (contrast the
Router Cost Visualizer's **A2A (Custom)**).

![Coordinator + router published directly to Gemini Enterprise](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/ge_two_agents_published.png)

**Publish both yourself** (idempotent — re-runs update the registration in place):
```bash
set -a; source .env; set +a
uv run python scripts/publish_agents_to_ge.py     # REST publisher (requests + google-auth only)
# ...or the official CLI wrapper:
bash scripts/publish_agents_to_ge.sh              # agents-cli publish gemini-enterprise (ADK mode)
```
- Full how-to: [`docs/publishing_agents_to_gemini_enterprise.md`](docs/publishing_agents_to_gemini_enterprise.md)
- Publisher: [`scripts/publish_agents_to_ge.py`](scripts/publish_agents_to_ge.py) · CLI wrapper: [`scripts/publish_agents_to_ge.sh`](scripts/publish_agents_to_ge.sh)
- Live in GE (engine `gemini-enterprise-17634901_1763490144996`): **GEAP Corporate Travel & Expense Assistant** (`3686131016255017939`) · **GEAP Multi-Model Cost Router** (`13895830063069432068`) — both **Enabled**

## Screenshots

All screenshots are captured from real deployed GCP resources:

| Screenshot | Feature |
|-----------|---------|
| ![Agent Gateway](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/session1_architecture_overview.png) | Agent Gateway ingress detail (geap-workshop-gateway) |
| ![Cloud Run](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/session1_cloud_run_mcp_detail.png) | MCP server on Cloud Run |
| ![Agent Engine](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/session1_agent_engine.png) | Multi-agent deployment |
| ![Agent Gateway](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/session2_agent_gateway.png) | Agent Gateway (ingress + egress) |
| ![Traces](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/session2_agent_traces.png) | Agent traces — session view with model calls and token usage |
| ![Trace Spans](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/session2_agent_trace_spans.png) | Trace spans — individual trace view |
| ![Model Armor](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/session4_model_armor.png) | Input/output screening |
| ![Evaluation](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/session2_evaluation_pipeline.png) | Three-tier eval pipeline |
| ![Evaluation Console](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/eval_console_evaluation.png) | Agent Platform → Agents → Evaluation (Experiments / Metrics / Online monitors) |
| ![Metrics Console](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/eval_console_metrics_tab.png) | Evaluation → Metrics — predefined + registered GEAP custom metrics |
| ![Online Monitors Console](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/eval_console_online_monitors.png) | Evaluation → Online monitors — active continuous evaluators |
| ![Alerting Console](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/eval_console_monitoring_alerts.png) | Cloud Monitoring → Alerting — GEAP quality-drift alert policies |
| ![Agent Registry](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/session3_agent_registry_mcp.png) | MCP servers in Agent Registry |
| ![BigQuery Sink](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/session2_bigquery_sink.png) | Log Router sinks to BigQuery |
| ![Policies](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/session3_policies_iam.png) | IAM Allow governance policies |
| ![Business Policies](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/session3_business_policies.png) | Semantic Governance Policies (SGP) |
| ![Metrics Explorer Out-of-Spec](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/session5_metrics_explorer_out_of_spec.png) | Cloud Monitoring Metrics Explorer showing evaluation scores drop |
| ![Quality Alert Firing](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/session5_monitoring_alert_firing.png) | Cloud Monitoring Alerting Policy in FIRING state |
| ![Two agents in Gemini Enterprise](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/ge_two_agents_published.png) | Coordinator + router published directly to Gemini Enterprise (type **Agent Engine**, Enabled) |

## Workshop Guide

See [docs/workshop_guide.md](docs/workshop_guide.md) for the full workshop organized into 4 sessions. For component-level details, see the [Component FAQ](docs/faq.md).

| Session | Topic | Duration |
|---------|-------|----------|
| **Session 1** | AI Gateway / MCP Gateway | ~90 min |
| **Session 2** | AI Gateway / MCP Gateway (continued) | ~75 min |
| **Session 3** | Agent Registry | ~15 min |
| **Session 4** | Model Security / Model Armor | ~15 min |

## Architecture

![GEAP Architecture](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/geap_architecture.png)

*Agent Platform architecture showing the full request flow: User → Frontend → Agent Gateway → Agent Identity (Agent Platform Runtime) → Agent Gateway → downstream Agents, Tools, Models, and APIs. Governed by Agent Registry, AI Security, and Access Authorization with full AI Observability.*

### Agent Identity Model

![Identities in Agentic Apps](https://raw.githubusercontent.com/jswortz/geap-tour/main/docs/screenshots/identity_types.png)

The platform supports three identity types for secure agent operations:

| Identity | Purpose | Issuing System |
|----------|---------|----------------|
| **ID-1: User Identity** | User accessing the agent or SaaS application | Human IdP (Entra, Cloud Identity, Auth0) |
| **ID-2: Agent Identity** | Agent accessing resources under its own authority | GCP — created when agent is deployed |
| **ID-3: Delegated Identity** | Agent accessing resources on behalf of the user | OAuth server (1P or 3P) via OAuth dance |

In our workshop, agents use SPIFFE-based workload identity (ID-2) with attestation policies, and the Agent Gateway enforces identity at the network boundary.

### Paper Banana Architecture Diagrams

| Diagram | Description |
|---------|-------------|
| ![Multi-Agent Topology](https://raw.githubusercontent.com/jswortz/geap-tour/main/diagrams/outputs/01_multi_agent_topology.png) | Coordinator agent routing to travel and expense sub-agents with MCP tool servers |
| ![Deployment Architecture](https://raw.githubusercontent.com/jswortz/geap-tour/main/diagrams/outputs/02_deployment_architecture.png) | Cloud Run MCP servers + Agent Runtime deployment topology |
| ![Evaluation Pipeline](https://raw.githubusercontent.com/jswortz/geap-tour/main/diagrams/outputs/03_eval_pipeline.png) | Three-tier evaluation: one-time, continuous, and CI/CD simulated |
| ![Agent Identity & Gateway](https://raw.githubusercontent.com/jswortz/geap-tour/main/diagrams/outputs/04_agent_identity_gateway.png) | SPIFFE identity, attestation policies, and Agent Gateway flow |
| ![Observability Stack](https://raw.githubusercontent.com/jswortz/geap-tour/main/diagrams/outputs/05_observability_stack.png) | OTel traces → Cloud Trace → BigQuery pipeline |
| ![CI/CD Flow](https://raw.githubusercontent.com/jswortz/geap-tour/main/diagrams/outputs/06_ci_cd_flow.png) | GitHub Actions simulated eval gate on pull requests |
| ![Model Armor](https://raw.githubusercontent.com/jswortz/geap-tour/main/diagrams/outputs/07_agent_armor.png) | Model Armor input/output screening with guardrail callbacks |
| ![Reference Architecture](https://raw.githubusercontent.com/jswortz/geap-tour/main/diagrams/outputs/08_reference_architecture.png) | Comprehensive reference architecture — all GEAP components in a single diagram |

## Project Structure

```
src/
├── agents/          # ADK agent definitions (coordinator + travel/expense specialists)
├── armor/           # Model Armor config + guardrail callbacks
├── mcp_servers/     # FastMCP tool servers (search, booking, expense)
├── deploy/          # Deploy to Cloud Run + Agent Runtime  (+ demo/platform_sdk_demo.ipynb)
├── eval/            # Evaluation pipeline (one-time, online, simulated)  (+ demo/evaluation_sdk_demo.ipynb)
├── optimize/        # Agent optimization (GEPA algorithm)
├── router/          # Multi-model complexity router (standalone deploy package)
└── traffic/         # Traffic generation for OTel traces
app/                 # Router Cost Visualizer — A2A/A2UI service (Cloud Run → Gemini Enterprise)
scripts/             # Shell scripts: identity, gateway, registry, deploy, publish
diagrams/            # Paper Banana architectural diagrams
docs/                # Workshop guide, evaluation guides, slides, screenshots (see docs/README.md)
tests/               # Unit and integration tests
```

geap-tour

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

geap-tour

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README