feat: load Agent Plugins in Go runtime

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Author: EItanya

docs/plans/api-v2-execution-plan.md

@@ -196,16 +196,21 @@ Implement lifecycle across the complete member set:
 - Public history remains readable while suspended or failed.
 - Emit lifecycle audit records, traces, and member-level failure details without exposing Actor IDs through ordinary APIs.
 
-### K7 — Agent Plugins skills-only ingestion
+### K7 — Agent Plugins ingestion
 
 Implement the selected Agent Plugins 1.0.0 subset:
 
-- Immutable OCI digest, full Git commit, and versioned S3 ZIP sources.
+- Immutable OCI digest, full Git commit, and versioned S3-compatible ZIP sources.
 - Validate the canonical root `plugin.json`.
 - Materialize only explicitly selected Agent Skills and supporting files.
+- Load standard `mcp.json` entries for stdio, Streamable HTTP, and legacy SSE
+  transports into the runtime configuration.
 - Reject path traversal, escaping symlinks, duplicate skill names, mutable references, and oversized packages.
-- Ignore `mcp.json`, client extensions, hooks, commands, apps, and other non-skill content.
-- Pin contents and digest in the prepared revision.
+- Ignore client extensions and content outside the Agent Plugins 1.0.0 skills
+  and MCP component types.
+- Pin immutable source identities in the prepared revision. Fetch and validate
+  package contents only in the runtime; destinations discovered in `mcp.json`
+  remain blocked unless explicitly allowed by a future API.
 
 Reuse existing artifact and skill materialization code where possible.
 

go/Dockerfile

@@ -33,7 +33,9 @@ RUN --mount=type=cache,target=/root/go/pkg/mod,rw             \
 FROM alpine:3.22
 ARG TARGETPLATFORM
 
-RUN apk add --no-cache bash ca-certificates
+RUN apk add --no-cache bash ca-certificates git && \
+    mkdir -p /skills /plugins /data/plugins && \
+    chown -R 65532:65532 /skills /plugins /data
 
 WORKDIR /
 COPY --from=builder /app /app

go/adk/cmd/main.go

@@ -19,6 +19,7 @@ import (
 	runnerpkg "github.com/kagent-dev/kagent/go/adk/pkg/runner"
 	"github.com/kagent-dev/kagent/go/adk/pkg/session"
 	"github.com/kagent-dev/kagent/go/adk/pkg/telemetry"
+	"github.com/kagent-dev/kagent/go/core/v2/agentplugins"
 	"go.uber.org/zap"
 	"go.uber.org/zap/zapcore"
 )
@@ -91,6 +92,20 @@ func main() {
 		logger.Error(err, "Failed to load agent config (model configuration is required)", "configDir", configDir)
 		os.Exit(1)
 	}
+	pluginConfig, err := agentplugins.MaterializeFromEnv(logr.NewContext(context.Background(), logger))
+	if err != nil {
+		logger.Error(err, "Failed to materialize Agent Plugins")
+		os.Exit(1)
+	}
+	agentConfig.HttpTools = append(agentConfig.HttpTools, pluginConfig.HTTP...)
+	agentConfig.SseTools = append(agentConfig.SseTools, pluginConfig.SSE...)
+	agentConfig.StdioTools = append(agentConfig.StdioTools, pluginConfig.Stdio...)
+	if pluginConfig.HasSkills {
+		if err := os.Setenv("KAGENT_SKILLS_FOLDER", agentplugins.DefaultSkillsRoot); err != nil {
+			logger.Error(err, "Failed to configure Agent Plugins skills directory")
+			os.Exit(1)
+		}
+	}
 	logger.Info("Loaded agent config", "configDir", configDir)
 	logger.Info("Agent configuration",
 		"model", agentConfig.Model.GetType(),

go/adk/pkg/agent/agent.go

@@ -47,7 +47,7 @@ func CreateGoogleADKAgent(ctx context.Context, agentConfig *adk.AgentConfig, age
 	if stsPlugin != nil {
 		dynamicHeaderProvider = stsPlugin.HeaderProvider
 	}
-	toolsets := mcp.CreateToolsets(ctx, agentConfig.HttpTools, agentConfig.SseTools, propagateToken, dynamicHeaderProvider)
+	toolsets := mcp.CreateToolsets(ctx, agentConfig.HttpTools, agentConfig.SseTools, agentConfig.StdioTools, propagateToken, dynamicHeaderProvider)
 	mcpAppToolNames := mcp.MCPAppToolNamesFromToolsets(toolsets)
 
 	var remoteAgentTools []tool.Tool

go/adk/pkg/mcp/registry.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"net/http"
 	"os"
+	"os/exec"
 	"time"
 
 	"github.com/a2aproject/a2a-go/v2/a2asrv"
@@ -71,6 +72,10 @@ type mcpServerParams struct {
 	PropagateToken        bool                  // when true, Authorization is forwarded independently of AllowedHeaders
 	HeaderProvider        DynamicHeaderProvider // optional per-request headers derived from invocation context (e.g., STS exchanged access tokens)
 	ServerType            string                // "http" or "sse"
+	Command               string
+	Args                  []string
+	Env                   map[string]string
+	Dir                   string
 	Timeout               *float64
 	SseReadTimeout        *float64
 	TLSInsecureSkipVerify *bool
@@ -93,12 +98,25 @@ func CreateToolsets(
 	ctx context.Context,
 	httpTools []adk.HttpMcpServerConfig,
 	sseTools []adk.SseMcpServerConfig,
+	stdioTools []adk.StdioMcpServerConfig,
 	propagateToken bool,
 	headerProvider DynamicHeaderProvider,
 ) []tool.Toolset {
 	log := logr.FromContextOrDiscard(ctx)
 	var toolsets []tool.Toolset
 
+	log.Info("Processing stdio MCP tools", "stdioToolsCount", len(stdioTools))
+	for i, stdioTool := range stdioTools {
+		params := mcpServerParams{
+			URL: stdioTool.Command, ServerType: "stdio", Command: stdioTool.Command,
+			Args: stdioTool.Args, Env: stdioTool.Env, Dir: stdioTool.Dir,
+		}
+		ts, err := addToolset(ctx, log, params, nil, "stdio", i+1)
+		if err == nil {
+			toolsets = append(toolsets, ts)
+		}
+	}
+
 	log.Info("Processing HTTP MCP tools", "httpToolsCount", len(httpTools))
 	for i, httpTool := range httpTools {
 		params := mcpServerParams{
@@ -176,6 +194,15 @@ func addToolset(ctx context.Context, log logr.Logger, params mcpServerParams, to
 // Uses the official MCP SDK (github.com/modelcontextprotocol/go-sdk/mcp).
 func createTransport(ctx context.Context, params mcpServerParams) (mcpsdk.Transport, error) {
 	log := logr.FromContextOrDiscard(ctx)
+	if params.ServerType == "stdio" {
+		command := exec.CommandContext(ctx, params.Command, params.Args...)
+		command.Dir = params.Dir
+		command.Env = os.Environ()
+		for key, value := range params.Env {
+			command.Env = append(command.Env, key+"="+value)
+		}
+		return &mcpsdk.CommandTransport{Command: command}, nil
+	}
 
 	operationTimeout := defaultTimeout
 	if params.Timeout != nil && *params.Timeout > 0 {

go/adk/pkg/mcp/registry_test.go

@@ -5,6 +5,7 @@ import (
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"path/filepath"
 	"testing"
 
 	"github.com/a2aproject/a2a-go/v2/a2asrv"
@@ -15,6 +16,20 @@ import (
 	"google.golang.org/genai"
 )
 
+func TestCreateTransportBuildsStdioCommand(t *testing.T) {
+	dir := t.TempDir()
+	transport, err := createTransport(t.Context(), mcpServerParams{
+		ServerType: "stdio", Command: "server", Args: []string{"--stdio"}, Env: map[string]string{"PLUGIN_ROOT": dir}, Dir: dir,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	stdio, ok := transport.(*mcpsdk.CommandTransport)
+	if !ok || filepath.Base(stdio.Command.Path) != "server" || len(stdio.Command.Args) != 2 || stdio.Command.Dir != dir {
+		t.Fatalf("stdio transport = %#v", transport)
+	}
+}
+
 // newTestTransport returns a transport private to the test. These parallel
 // tests must not share newTestTransport(t): httptest.Server.Close (deferred
 // in each test) also closes the default transport's idle connections, which

go/api/adk/types.go

@@ -44,6 +44,14 @@ type SseMcpServerConfig struct {
 	RequireApproval []string            `json:"require_approval,omitempty"`
 }
 
+// StdioMcpServerConfig starts one local MCP server without invoking a shell.
+type StdioMcpServerConfig struct {
+	Command string            `json:"command"`
+	Args    []string          `json:"args,omitempty"`
+	Env     map[string]string `json:"env,omitempty"`
+	Dir     string            `json:"dir,omitempty"`
+}
+
 type Model interface {
 	GetType() string
 }
@@ -584,18 +592,19 @@ func (c *AgentCompressionConfig) UnmarshalJSON(data []byte) error {
 
 // See `python/packages/kagent-adk/src/kagent/adk/types.py` for the python version of this
 type AgentConfig struct {
-	Model         Model                 `json:"model"`
-	Description   string                `json:"description"`
-	Instruction   string                `json:"instruction"`
-	HttpTools     []HttpMcpServerConfig `json:"http_tools,omitempty"`
-	SseTools      []SseMcpServerConfig  `json:"sse_tools,omitempty"`
-	RemoteAgents  []RemoteAgentConfig   `json:"remote_agents,omitempty"`
-	Stream        *bool                 `json:"stream,omitempty"`
-	Memory        *MemoryConfig         `json:"memory,omitempty"`
-	Network       *NetworkConfig        `json:"network,omitempty"`
-	ContextConfig *AgentContextConfig   `json:"context_config,omitempty"`
-	ShareTools    *bool                 `json:"share_tools,omitempty"`
-	SessionDBURL  string                `json:"session_db_url,omitempty"`
+	Model         Model                  `json:"model"`
+	Description   string                 `json:"description"`
+	Instruction   string                 `json:"instruction"`
+	HttpTools     []HttpMcpServerConfig  `json:"http_tools,omitempty"`
+	SseTools      []SseMcpServerConfig   `json:"sse_tools,omitempty"`
+	StdioTools    []StdioMcpServerConfig `json:"stdio_tools,omitempty"`
+	RemoteAgents  []RemoteAgentConfig    `json:"remote_agents,omitempty"`
+	Stream        *bool                  `json:"stream,omitempty"`
+	Memory        *MemoryConfig          `json:"memory,omitempty"`
+	Network       *NetworkConfig         `json:"network,omitempty"`
+	ContextConfig *AgentContextConfig    `json:"context_config,omitempty"`
+	ShareTools    *bool                  `json:"share_tools,omitempty"`
+	SessionDBURL  string                 `json:"session_db_url,omitempty"`
 }
 
 // GetStream returns the stream value or default if not set
@@ -608,18 +617,19 @@ func (a *AgentConfig) GetStream() bool {
 
 func (a *AgentConfig) UnmarshalJSON(data []byte) error {
 	var tmp struct {
-		Model         json.RawMessage       `json:"model"`
-		Description   string                `json:"description"`
-		Instruction   string                `json:"instruction"`
-		HttpTools     []HttpMcpServerConfig `json:"http_tools,omitempty"`
-		SseTools      []SseMcpServerConfig  `json:"sse_tools,omitempty"`
-		RemoteAgents  []RemoteAgentConfig   `json:"remote_agents,omitempty"`
-		Stream        *bool                 `json:"stream,omitempty"`
-		Memory        json.RawMessage       `json:"memory"`
-		Network       *NetworkConfig        `json:"network,omitempty"`
-		ContextConfig *AgentContextConfig   `json:"context_config,omitempty"`
-		ShareTools    *bool                 `json:"share_tools,omitempty"`
-		SessionDBURL  string                `json:"session_db_url,omitempty"`
+		Model         json.RawMessage        `json:"model"`
+		Description   string                 `json:"description"`
+		Instruction   string                 `json:"instruction"`
+		HttpTools     []HttpMcpServerConfig  `json:"http_tools,omitempty"`
+		SseTools      []SseMcpServerConfig   `json:"sse_tools,omitempty"`
+		StdioTools    []StdioMcpServerConfig `json:"stdio_tools,omitempty"`
+		RemoteAgents  []RemoteAgentConfig    `json:"remote_agents,omitempty"`
+		Stream        *bool                  `json:"stream,omitempty"`
+		Memory        json.RawMessage        `json:"memory"`
+		Network       *NetworkConfig         `json:"network,omitempty"`
+		ContextConfig *AgentContextConfig    `json:"context_config,omitempty"`
+		ShareTools    *bool                  `json:"share_tools,omitempty"`
+		SessionDBURL  string                 `json:"session_db_url,omitempty"`
 	}
 	if err := json.Unmarshal(data, &tmp); err != nil {
 		return err
@@ -649,6 +659,7 @@ func (a *AgentConfig) UnmarshalJSON(data []byte) error {
 	a.Instruction = tmp.Instruction
 	a.HttpTools = tmp.HttpTools
 	a.SseTools = tmp.SseTools
+	a.StdioTools = tmp.StdioTools
 	a.RemoteAgents = tmp.RemoteAgents
 	a.Stream = tmp.Stream
 	a.Memory = memory

go/api/adk/types_test.go

@@ -2,9 +2,26 @@ package adk
 
 import (
 	"encoding/json"
+	"reflect"
 	"testing"
 )
 
+func TestAgentConfigStdioToolsRoundTrip(t *testing.T) {
+	want := []StdioMcpServerConfig{{Command: "server", Args: []string{"--stdio"}, Env: map[string]string{"KEY": "value"}, Dir: "/plugin"}}
+	input := AgentConfig{Model: &OpenAI{BaseModel: BaseModel{Model: "test"}}, StdioTools: want}
+	raw, err := json.Marshal(input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var output AgentConfig
+	if err := json.Unmarshal(raw, &output); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(output.StdioTools, want) {
+		t.Fatalf("stdio tools = %#v, want %#v", output.StdioTools, want)
+	}
+}
+
 func TestMarshalJSON_TypeDiscriminator(t *testing.T) {
 	tests := []struct {
 		name     string

go/api/config/crd/bases/kagent.dev_agenttemplates.yaml

@@ -84,14 +84,24 @@ spec:
                                 bucket:
                                   minLength: 1
                                   type: string
+                                endpoint:
+                                  description: Endpoint is the HTTP(S) endpoint of
+                                    an AWS or S3-compatible service.
+                                  pattern: ^https?://[^[:space:]]+$
+                                  type: string
                                 key:
                                   minLength: 1
                                   type: string
+                                region:
+                                  description: Region is used for request signing
+                                    when required by the service.
+                                  type: string
                                 versionId:
                                   minLength: 1
                                   type: string
                               required:
                               - bucket
+                              - endpoint
                               - key
                               - versionId
                               type: object
@@ -184,14 +194,24 @@ spec:
                                 bucket:
                                   minLength: 1
                                   type: string
+                                endpoint:
+                                  description: Endpoint is the HTTP(S) endpoint of
+                                    an AWS or S3-compatible service.
+                                  pattern: ^https?://[^[:space:]]+$
+                                  type: string
                                 key:
                                   minLength: 1
                                   type: string
+                                region:
+                                  description: Region is used for request signing
+                                    when required by the service.
+                                  type: string
                                 versionId:
                                   minLength: 1
                                   type: string
                               required:
                               - bucket
+                              - endpoint
                               - key
                               - versionId
                               type: object

go/api/v1alpha3/agenttemplate_types.go

@@ -137,6 +137,10 @@ type GitArtifact struct {
 
 // S3Object identifies one immutable S3 object version.
 type S3Object struct {
+	// Endpoint is the HTTP(S) endpoint of an AWS or S3-compatible service.
+	// +kubebuilder:validation:Pattern=`^https?://[^[:space:]]+$`
+	// +required
+	Endpoint string `json:"endpoint"`
 	// +kubebuilder:validation:MinLength=1
 	// +required
 	Bucket string `json:"bucket"`
@@ -146,6 +150,9 @@ type S3Object struct {
 	// +kubebuilder:validation:MinLength=1
 	// +required
 	VersionID string `json:"versionId"`
+	// Region is used for request signing when required by the service.
+	// +optional
+	Region string `json:"region,omitempty"`
 }
 
 // BucketArtifact selects the supported object-store provider.