diff --git a/api/grpc/mpi/v1/command.pb.go b/api/grpc/mpi/v1/command.pb.go
index c84baaea1..b39457738 100644
--- a/api/grpc/mpi/v1/command.pb.go
+++ b/api/grpc/mpi/v1/command.pb.go
@@ -2436,8 +2436,10 @@ type AgentConfig struct {
 	Features []string `protobuf:"bytes,5,rep,name=features,proto3" json:"features,omitempty"`
 	// Message buffer size, maximum not acknowledged messages from the subscribe perspective
 	MessageBufferSize string `protobuf:"bytes,6,opt,name=message_buffer_size,json=messageBufferSize,proto3" json:"message_buffer_size,omitempty"`
-	unknownFields     protoimpl.UnknownFields
-	sizeCache         protoimpl.SizeCache
+	// Auxiliary Command server settings
+	AuxiliaryCommand *AuxiliaryCommandServer `protobuf:"bytes,7,opt,name=auxiliary_command,json=auxiliaryCommand,proto3" json:"auxiliary_command,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
 }
 
 func (x *AgentConfig) Reset() {
@@ -2512,6 +2514,13 @@ func (x *AgentConfig) GetMessageBufferSize() string {
 	return ""
 }
 
+func (x *AgentConfig) GetAuxiliaryCommand() *AuxiliaryCommandServer {
+	if x != nil {
+		return x.AuxiliaryCommand
+	}
+	return nil
+}
+
 // The command server settings, associated with messaging from an external source
 type CommandServer struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -2576,6 +2585,70 @@ func (x *CommandServer) GetTls() *TLSSettings {
 	return nil
 }
 
+// The auxiliary server settings, associated with messaging from an external source
+type AuxiliaryCommandServer struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Server configuration (e.g., host, port, type)
+	Server *ServerSettings `protobuf:"bytes,1,opt,name=server,proto3" json:"server,omitempty"`
+	// Authentication configuration (e.g., token)
+	Auth *AuthSettings `protobuf:"bytes,2,opt,name=auth,proto3" json:"auth,omitempty"`
+	// TLS configuration for secure communication
+	Tls           *TLSSettings `protobuf:"bytes,3,opt,name=tls,proto3" json:"tls,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AuxiliaryCommandServer) Reset() {
+	*x = AuxiliaryCommandServer{}
+	mi := &file_mpi_v1_command_proto_msgTypes[37]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AuxiliaryCommandServer) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuxiliaryCommandServer) ProtoMessage() {}
+
+func (x *AuxiliaryCommandServer) ProtoReflect() protoreflect.Message {
+	mi := &file_mpi_v1_command_proto_msgTypes[37]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuxiliaryCommandServer.ProtoReflect.Descriptor instead.
+func (*AuxiliaryCommandServer) Descriptor() ([]byte, []int) {
+	return file_mpi_v1_command_proto_rawDescGZIP(), []int{37}
+}
+
+func (x *AuxiliaryCommandServer) GetServer() *ServerSettings {
+	if x != nil {
+		return x.Server
+	}
+	return nil
+}
+
+func (x *AuxiliaryCommandServer) GetAuth() *AuthSettings {
+	if x != nil {
+		return x.Auth
+	}
+	return nil
+}
+
+func (x *AuxiliaryCommandServer) GetTls() *TLSSettings {
+	if x != nil {
+		return x.Tls
+	}
+	return nil
+}
+
 // The metrics settings associated with origins (sources) of the metrics and destinations (exporter)
 type MetricsServer struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
@@ -2585,7 +2658,7 @@ type MetricsServer struct {
 
 func (x *MetricsServer) Reset() {
 	*x = MetricsServer{}
-	mi := &file_mpi_v1_command_proto_msgTypes[37]
+	mi := &file_mpi_v1_command_proto_msgTypes[38]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2597,7 +2670,7 @@ func (x *MetricsServer) String() string {
 func (*MetricsServer) ProtoMessage() {}
 
 func (x *MetricsServer) ProtoReflect() protoreflect.Message {
-	mi := &file_mpi_v1_command_proto_msgTypes[37]
+	mi := &file_mpi_v1_command_proto_msgTypes[38]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2610,7 +2683,7 @@ func (x *MetricsServer) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MetricsServer.ProtoReflect.Descriptor instead.
 func (*MetricsServer) Descriptor() ([]byte, []int) {
-	return file_mpi_v1_command_proto_rawDescGZIP(), []int{37}
+	return file_mpi_v1_command_proto_rawDescGZIP(), []int{38}
 }
 
 // The file settings associated with file server for configurations
@@ -2622,7 +2695,7 @@ type FileServer struct {
 
 func (x *FileServer) Reset() {
 	*x = FileServer{}
-	mi := &file_mpi_v1_command_proto_msgTypes[38]
+	mi := &file_mpi_v1_command_proto_msgTypes[39]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2634,7 +2707,7 @@ func (x *FileServer) String() string {
 func (*FileServer) ProtoMessage() {}
 
 func (x *FileServer) ProtoReflect() protoreflect.Message {
-	mi := &file_mpi_v1_command_proto_msgTypes[38]
+	mi := &file_mpi_v1_command_proto_msgTypes[39]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2647,7 +2720,7 @@ func (x *FileServer) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FileServer.ProtoReflect.Descriptor instead.
 func (*FileServer) Descriptor() ([]byte, []int) {
-	return file_mpi_v1_command_proto_rawDescGZIP(), []int{38}
+	return file_mpi_v1_command_proto_rawDescGZIP(), []int{39}
 }
 
 var File_mpi_v1_command_proto protoreflect.FileDescriptor
@@ -2809,17 +2882,22 @@ const file_mpi_v1_command_proto_rawDesc = "" +
 	"\x18attack_signature_version\x18\x02 \x01(\tR\x16attackSignatureVersion\x126\n" +
 	"\x17threat_campaign_version\x18\x03 \x01(\tR\x15threatCampaignVersion\x126\n" +
 	"\x17enforcer_engine_version\x18\x04 \x01(\tR\x15enforcerEngineVersion\"\x10\n" +
-	"\x0eInstanceAction\"\x94\x02\n" +
+	"\x0eInstanceAction\"\xe1\x02\n" +
 	"\vAgentConfig\x12/\n" +
 	"\acommand\x18\x01 \x01(\v2\x15.mpi.v1.CommandServerR\acommand\x12/\n" +
 	"\ametrics\x18\x02 \x01(\v2\x15.mpi.v1.MetricsServerR\ametrics\x12&\n" +
 	"\x04file\x18\x03 \x01(\v2\x12.mpi.v1.FileServerR\x04file\x12/\n" +
 	"\x06labels\x18\x04 \x03(\v2\x17.google.protobuf.StructR\x06labels\x12\x1a\n" +
 	"\bfeatures\x18\x05 \x03(\tR\bfeatures\x12.\n" +
-	"\x13message_buffer_size\x18\x06 \x01(\tR\x11messageBufferSize\"\x90\x01\n" +
+	"\x13message_buffer_size\x18\x06 \x01(\tR\x11messageBufferSize\x12K\n" +
+	"\x11auxiliary_command\x18\a \x01(\v2\x1e.mpi.v1.AuxiliaryCommandServerR\x10auxiliaryCommand\"\x90\x01\n" +
 	"\rCommandServer\x12.\n" +
 	"\x06server\x18\x01 \x01(\v2\x16.mpi.v1.ServerSettingsR\x06server\x12(\n" +
 	"\x04auth\x18\x02 \x01(\v2\x14.mpi.v1.AuthSettingsR\x04auth\x12%\n" +
+	"\x03tls\x18\x03 \x01(\v2\x13.mpi.v1.TLSSettingsR\x03tls\"\x99\x01\n" +
+	"\x16AuxiliaryCommandServer\x12.\n" +
+	"\x06server\x18\x01 \x01(\v2\x16.mpi.v1.ServerSettingsR\x06server\x12(\n" +
+	"\x04auth\x18\x02 \x01(\v2\x14.mpi.v1.AuthSettingsR\x04auth\x12%\n" +
 	"\x03tls\x18\x03 \x01(\v2\x13.mpi.v1.TLSSettingsR\x03tls\"\x0f\n" +
 	"\rMetricsServer\"\f\n" +
 	"\n" +
@@ -2843,7 +2921,7 @@ func file_mpi_v1_command_proto_rawDescGZIP() []byte {
 }
 
 var file_mpi_v1_command_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_mpi_v1_command_proto_msgTypes = make([]protoimpl.MessageInfo, 39)
+var file_mpi_v1_command_proto_msgTypes = make([]protoimpl.MessageInfo, 40)
 var file_mpi_v1_command_proto_goTypes = []any{
 	(InstanceHealth_InstanceHealthStatus)(0), // 0: mpi.v1.InstanceHealth.InstanceHealthStatus
 	(InstanceMeta_InstanceType)(0),           // 1: mpi.v1.InstanceMeta.InstanceType
@@ -2884,50 +2962,51 @@ var file_mpi_v1_command_proto_goTypes = []any{
 	(*InstanceAction)(nil),                   // 36: mpi.v1.InstanceAction
 	(*AgentConfig)(nil),                      // 37: mpi.v1.AgentConfig
 	(*CommandServer)(nil),                    // 38: mpi.v1.CommandServer
-	(*MetricsServer)(nil),                    // 39: mpi.v1.MetricsServer
-	(*FileServer)(nil),                       // 40: mpi.v1.FileServer
-	(*MessageMeta)(nil),                      // 41: mpi.v1.MessageMeta
-	(*CommandResponse)(nil),                  // 42: mpi.v1.CommandResponse
-	(*FileOverview)(nil),                     // 43: mpi.v1.FileOverview
-	(*structpb.Struct)(nil),                  // 44: google.protobuf.Struct
-	(*ServerSettings)(nil),                   // 45: mpi.v1.ServerSettings
-	(*AuthSettings)(nil),                     // 46: mpi.v1.AuthSettings
-	(*TLSSettings)(nil),                      // 47: mpi.v1.TLSSettings
+	(*AuxiliaryCommandServer)(nil),           // 39: mpi.v1.AuxiliaryCommandServer
+	(*MetricsServer)(nil),                    // 40: mpi.v1.MetricsServer
+	(*FileServer)(nil),                       // 41: mpi.v1.FileServer
+	(*MessageMeta)(nil),                      // 42: mpi.v1.MessageMeta
+	(*CommandResponse)(nil),                  // 43: mpi.v1.CommandResponse
+	(*FileOverview)(nil),                     // 44: mpi.v1.FileOverview
+	(*structpb.Struct)(nil),                  // 45: google.protobuf.Struct
+	(*ServerSettings)(nil),                   // 46: mpi.v1.ServerSettings
+	(*AuthSettings)(nil),                     // 47: mpi.v1.AuthSettings
+	(*TLSSettings)(nil),                      // 48: mpi.v1.TLSSettings
 }
 var file_mpi_v1_command_proto_depIdxs = []int32{
-	41, // 0: mpi.v1.CreateConnectionRequest.message_meta:type_name -> mpi.v1.MessageMeta
+	42, // 0: mpi.v1.CreateConnectionRequest.message_meta:type_name -> mpi.v1.MessageMeta
 	3,  // 1: mpi.v1.CreateConnectionRequest.resource:type_name -> mpi.v1.Resource
 	27, // 2: mpi.v1.Resource.instances:type_name -> mpi.v1.Instance
 	4,  // 3: mpi.v1.Resource.host_info:type_name -> mpi.v1.HostInfo
 	6,  // 4: mpi.v1.Resource.container_info:type_name -> mpi.v1.ContainerInfo
 	5,  // 5: mpi.v1.HostInfo.release_info:type_name -> mpi.v1.ReleaseInfo
 	5,  // 6: mpi.v1.ContainerInfo.release_info:type_name -> mpi.v1.ReleaseInfo
-	42, // 7: mpi.v1.CreateConnectionResponse.response:type_name -> mpi.v1.CommandResponse
+	43, // 7: mpi.v1.CreateConnectionResponse.response:type_name -> mpi.v1.CommandResponse
 	37, // 8: mpi.v1.CreateConnectionResponse.agent_config:type_name -> mpi.v1.AgentConfig
-	41, // 9: mpi.v1.UpdateDataPlaneStatusRequest.message_meta:type_name -> mpi.v1.MessageMeta
+	42, // 9: mpi.v1.UpdateDataPlaneStatusRequest.message_meta:type_name -> mpi.v1.MessageMeta
 	3,  // 10: mpi.v1.UpdateDataPlaneStatusRequest.resource:type_name -> mpi.v1.Resource
 	0,  // 11: mpi.v1.InstanceHealth.instance_health_status:type_name -> mpi.v1.InstanceHealth.InstanceHealthStatus
-	41, // 12: mpi.v1.UpdateDataPlaneHealthRequest.message_meta:type_name -> mpi.v1.MessageMeta
+	42, // 12: mpi.v1.UpdateDataPlaneHealthRequest.message_meta:type_name -> mpi.v1.MessageMeta
 	10, // 13: mpi.v1.UpdateDataPlaneHealthRequest.instance_healths:type_name -> mpi.v1.InstanceHealth
-	41, // 14: mpi.v1.DataPlaneResponse.message_meta:type_name -> mpi.v1.MessageMeta
-	42, // 15: mpi.v1.DataPlaneResponse.command_response:type_name -> mpi.v1.CommandResponse
-	41, // 16: mpi.v1.ManagementPlaneRequest.message_meta:type_name -> mpi.v1.MessageMeta
+	42, // 14: mpi.v1.DataPlaneResponse.message_meta:type_name -> mpi.v1.MessageMeta
+	43, // 15: mpi.v1.DataPlaneResponse.command_response:type_name -> mpi.v1.CommandResponse
+	42, // 16: mpi.v1.ManagementPlaneRequest.message_meta:type_name -> mpi.v1.MessageMeta
 	15, // 17: mpi.v1.ManagementPlaneRequest.status_request:type_name -> mpi.v1.StatusRequest
 	16, // 18: mpi.v1.ManagementPlaneRequest.health_request:type_name -> mpi.v1.HealthRequest
 	17, // 19: mpi.v1.ManagementPlaneRequest.config_apply_request:type_name -> mpi.v1.ConfigApplyRequest
 	18, // 20: mpi.v1.ManagementPlaneRequest.config_upload_request:type_name -> mpi.v1.ConfigUploadRequest
 	19, // 21: mpi.v1.ManagementPlaneRequest.action_request:type_name -> mpi.v1.APIActionRequest
 	26, // 22: mpi.v1.ManagementPlaneRequest.command_status_request:type_name -> mpi.v1.CommandStatusRequest
-	43, // 23: mpi.v1.ConfigApplyRequest.overview:type_name -> mpi.v1.FileOverview
-	43, // 24: mpi.v1.ConfigUploadRequest.overview:type_name -> mpi.v1.FileOverview
+	44, // 23: mpi.v1.ConfigApplyRequest.overview:type_name -> mpi.v1.FileOverview
+	44, // 24: mpi.v1.ConfigUploadRequest.overview:type_name -> mpi.v1.FileOverview
 	20, // 25: mpi.v1.APIActionRequest.nginx_plus_action:type_name -> mpi.v1.NGINXPlusAction
 	21, // 26: mpi.v1.NGINXPlusAction.update_http_upstream_servers:type_name -> mpi.v1.UpdateHTTPUpstreamServers
 	22, // 27: mpi.v1.NGINXPlusAction.get_http_upstream_servers:type_name -> mpi.v1.GetHTTPUpstreamServers
 	23, // 28: mpi.v1.NGINXPlusAction.update_stream_servers:type_name -> mpi.v1.UpdateStreamServers
 	24, // 29: mpi.v1.NGINXPlusAction.get_upstreams:type_name -> mpi.v1.GetUpstreams
 	25, // 30: mpi.v1.NGINXPlusAction.get_stream_upstreams:type_name -> mpi.v1.GetStreamUpstreams
-	44, // 31: mpi.v1.UpdateHTTPUpstreamServers.servers:type_name -> google.protobuf.Struct
-	44, // 32: mpi.v1.UpdateStreamServers.servers:type_name -> google.protobuf.Struct
+	45, // 31: mpi.v1.UpdateHTTPUpstreamServers.servers:type_name -> google.protobuf.Struct
+	45, // 32: mpi.v1.UpdateStreamServers.servers:type_name -> google.protobuf.Struct
 	28, // 33: mpi.v1.Instance.instance_meta:type_name -> mpi.v1.InstanceMeta
 	29, // 34: mpi.v1.Instance.instance_config:type_name -> mpi.v1.InstanceConfig
 	30, // 35: mpi.v1.Instance.instance_runtime:type_name -> mpi.v1.InstanceRuntime
@@ -2942,25 +3021,29 @@ var file_mpi_v1_command_proto_depIdxs = []int32{
 	34, // 44: mpi.v1.NGINXPlusRuntimeInfo.stub_status:type_name -> mpi.v1.APIDetails
 	34, // 45: mpi.v1.NGINXPlusRuntimeInfo.plus_api:type_name -> mpi.v1.APIDetails
 	38, // 46: mpi.v1.AgentConfig.command:type_name -> mpi.v1.CommandServer
-	39, // 47: mpi.v1.AgentConfig.metrics:type_name -> mpi.v1.MetricsServer
-	40, // 48: mpi.v1.AgentConfig.file:type_name -> mpi.v1.FileServer
-	44, // 49: mpi.v1.AgentConfig.labels:type_name -> google.protobuf.Struct
-	45, // 50: mpi.v1.CommandServer.server:type_name -> mpi.v1.ServerSettings
-	46, // 51: mpi.v1.CommandServer.auth:type_name -> mpi.v1.AuthSettings
-	47, // 52: mpi.v1.CommandServer.tls:type_name -> mpi.v1.TLSSettings
-	2,  // 53: mpi.v1.CommandService.CreateConnection:input_type -> mpi.v1.CreateConnectionRequest
-	8,  // 54: mpi.v1.CommandService.UpdateDataPlaneStatus:input_type -> mpi.v1.UpdateDataPlaneStatusRequest
-	11, // 55: mpi.v1.CommandService.UpdateDataPlaneHealth:input_type -> mpi.v1.UpdateDataPlaneHealthRequest
-	13, // 56: mpi.v1.CommandService.Subscribe:input_type -> mpi.v1.DataPlaneResponse
-	7,  // 57: mpi.v1.CommandService.CreateConnection:output_type -> mpi.v1.CreateConnectionResponse
-	9,  // 58: mpi.v1.CommandService.UpdateDataPlaneStatus:output_type -> mpi.v1.UpdateDataPlaneStatusResponse
-	12, // 59: mpi.v1.CommandService.UpdateDataPlaneHealth:output_type -> mpi.v1.UpdateDataPlaneHealthResponse
-	14, // 60: mpi.v1.CommandService.Subscribe:output_type -> mpi.v1.ManagementPlaneRequest
-	57, // [57:61] is the sub-list for method output_type
-	53, // [53:57] is the sub-list for method input_type
-	53, // [53:53] is the sub-list for extension type_name
-	53, // [53:53] is the sub-list for extension extendee
-	0,  // [0:53] is the sub-list for field type_name
+	40, // 47: mpi.v1.AgentConfig.metrics:type_name -> mpi.v1.MetricsServer
+	41, // 48: mpi.v1.AgentConfig.file:type_name -> mpi.v1.FileServer
+	45, // 49: mpi.v1.AgentConfig.labels:type_name -> google.protobuf.Struct
+	39, // 50: mpi.v1.AgentConfig.auxiliary_command:type_name -> mpi.v1.AuxiliaryCommandServer
+	46, // 51: mpi.v1.CommandServer.server:type_name -> mpi.v1.ServerSettings
+	47, // 52: mpi.v1.CommandServer.auth:type_name -> mpi.v1.AuthSettings
+	48, // 53: mpi.v1.CommandServer.tls:type_name -> mpi.v1.TLSSettings
+	46, // 54: mpi.v1.AuxiliaryCommandServer.server:type_name -> mpi.v1.ServerSettings
+	47, // 55: mpi.v1.AuxiliaryCommandServer.auth:type_name -> mpi.v1.AuthSettings
+	48, // 56: mpi.v1.AuxiliaryCommandServer.tls:type_name -> mpi.v1.TLSSettings
+	2,  // 57: mpi.v1.CommandService.CreateConnection:input_type -> mpi.v1.CreateConnectionRequest
+	8,  // 58: mpi.v1.CommandService.UpdateDataPlaneStatus:input_type -> mpi.v1.UpdateDataPlaneStatusRequest
+	11, // 59: mpi.v1.CommandService.UpdateDataPlaneHealth:input_type -> mpi.v1.UpdateDataPlaneHealthRequest
+	13, // 60: mpi.v1.CommandService.Subscribe:input_type -> mpi.v1.DataPlaneResponse
+	7,  // 61: mpi.v1.CommandService.CreateConnection:output_type -> mpi.v1.CreateConnectionResponse
+	9,  // 62: mpi.v1.CommandService.UpdateDataPlaneStatus:output_type -> mpi.v1.UpdateDataPlaneStatusResponse
+	12, // 63: mpi.v1.CommandService.UpdateDataPlaneHealth:output_type -> mpi.v1.UpdateDataPlaneHealthResponse
+	14, // 64: mpi.v1.CommandService.Subscribe:output_type -> mpi.v1.ManagementPlaneRequest
+	61, // [61:65] is the sub-list for method output_type
+	57, // [57:61] is the sub-list for method input_type
+	57, // [57:57] is the sub-list for extension type_name
+	57, // [57:57] is the sub-list for extension extendee
+	0,  // [0:57] is the sub-list for field type_name
 }
 
 func init() { file_mpi_v1_command_proto_init() }
@@ -3006,7 +3089,7 @@ func file_mpi_v1_command_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_mpi_v1_command_proto_rawDesc), len(file_mpi_v1_command_proto_rawDesc)),
 			NumEnums:      2,
-			NumMessages:   39,
+			NumMessages:   40,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/api/grpc/mpi/v1/command.pb.validate.go b/api/grpc/mpi/v1/command.pb.validate.go
index a6e195ac9..194284c7e 100644
--- a/api/grpc/mpi/v1/command.pb.validate.go
+++ b/api/grpc/mpi/v1/command.pb.validate.go
@@ -5325,6 +5325,35 @@ func (m *AgentConfig) validate(all bool) error {
 
 	// no validation rules for MessageBufferSize
 
+	if all {
+		switch v := interface{}(m.GetAuxiliaryCommand()).(type) {
+		case interface{ ValidateAll() error }:
+			if err := v.ValidateAll(); err != nil {
+				errors = append(errors, AgentConfigValidationError{
+					field:  "AuxiliaryCommand",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		case interface{ Validate() error }:
+			if err := v.Validate(); err != nil {
+				errors = append(errors, AgentConfigValidationError{
+					field:  "AuxiliaryCommand",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		}
+	} else if v, ok := interface{}(m.GetAuxiliaryCommand()).(interface{ Validate() error }); ok {
+		if err := v.Validate(); err != nil {
+			return AgentConfigValidationError{
+				field:  "AuxiliaryCommand",
+				reason: "embedded message failed validation",
+				cause:  err,
+			}
+		}
+	}
+
 	if len(errors) > 0 {
 		return AgentConfigMultiError(errors)
 	}
@@ -5589,6 +5618,195 @@ var _ interface {
 	ErrorName() string
 } = CommandServerValidationError{}
 
+// Validate checks the field values on AuxiliaryCommandServer with the rules
+// defined in the proto definition for this message. If any rules are
+// violated, the first error encountered is returned, or nil if there are no violations.
+func (m *AuxiliaryCommandServer) Validate() error {
+	return m.validate(false)
+}
+
+// ValidateAll checks the field values on AuxiliaryCommandServer with the rules
+// defined in the proto definition for this message. If any rules are
+// violated, the result is a list of violation errors wrapped in
+// AuxiliaryCommandServerMultiError, or nil if none found.
+func (m *AuxiliaryCommandServer) ValidateAll() error {
+	return m.validate(true)
+}
+
+func (m *AuxiliaryCommandServer) validate(all bool) error {
+	if m == nil {
+		return nil
+	}
+
+	var errors []error
+
+	if all {
+		switch v := interface{}(m.GetServer()).(type) {
+		case interface{ ValidateAll() error }:
+			if err := v.ValidateAll(); err != nil {
+				errors = append(errors, AuxiliaryCommandServerValidationError{
+					field:  "Server",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		case interface{ Validate() error }:
+			if err := v.Validate(); err != nil {
+				errors = append(errors, AuxiliaryCommandServerValidationError{
+					field:  "Server",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		}
+	} else if v, ok := interface{}(m.GetServer()).(interface{ Validate() error }); ok {
+		if err := v.Validate(); err != nil {
+			return AuxiliaryCommandServerValidationError{
+				field:  "Server",
+				reason: "embedded message failed validation",
+				cause:  err,
+			}
+		}
+	}
+
+	if all {
+		switch v := interface{}(m.GetAuth()).(type) {
+		case interface{ ValidateAll() error }:
+			if err := v.ValidateAll(); err != nil {
+				errors = append(errors, AuxiliaryCommandServerValidationError{
+					field:  "Auth",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		case interface{ Validate() error }:
+			if err := v.Validate(); err != nil {
+				errors = append(errors, AuxiliaryCommandServerValidationError{
+					field:  "Auth",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		}
+	} else if v, ok := interface{}(m.GetAuth()).(interface{ Validate() error }); ok {
+		if err := v.Validate(); err != nil {
+			return AuxiliaryCommandServerValidationError{
+				field:  "Auth",
+				reason: "embedded message failed validation",
+				cause:  err,
+			}
+		}
+	}
+
+	if all {
+		switch v := interface{}(m.GetTls()).(type) {
+		case interface{ ValidateAll() error }:
+			if err := v.ValidateAll(); err != nil {
+				errors = append(errors, AuxiliaryCommandServerValidationError{
+					field:  "Tls",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		case interface{ Validate() error }:
+			if err := v.Validate(); err != nil {
+				errors = append(errors, AuxiliaryCommandServerValidationError{
+					field:  "Tls",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		}
+	} else if v, ok := interface{}(m.GetTls()).(interface{ Validate() error }); ok {
+		if err := v.Validate(); err != nil {
+			return AuxiliaryCommandServerValidationError{
+				field:  "Tls",
+				reason: "embedded message failed validation",
+				cause:  err,
+			}
+		}
+	}
+
+	if len(errors) > 0 {
+		return AuxiliaryCommandServerMultiError(errors)
+	}
+
+	return nil
+}
+
+// AuxiliaryCommandServerMultiError is an error wrapping multiple validation
+// errors returned by AuxiliaryCommandServer.ValidateAll() if the designated
+// constraints aren't met.
+type AuxiliaryCommandServerMultiError []error
+
+// Error returns a concatenation of all the error messages it wraps.
+func (m AuxiliaryCommandServerMultiError) Error() string {
+	msgs := make([]string, 0, len(m))
+	for _, err := range m {
+		msgs = append(msgs, err.Error())
+	}
+	return strings.Join(msgs, "; ")
+}
+
+// AllErrors returns a list of validation violation errors.
+func (m AuxiliaryCommandServerMultiError) AllErrors() []error { return m }
+
+// AuxiliaryCommandServerValidationError is the validation error returned by
+// AuxiliaryCommandServer.Validate if the designated constraints aren't met.
+type AuxiliaryCommandServerValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e AuxiliaryCommandServerValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e AuxiliaryCommandServerValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e AuxiliaryCommandServerValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e AuxiliaryCommandServerValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e AuxiliaryCommandServerValidationError) ErrorName() string {
+	return "AuxiliaryCommandServerValidationError"
+}
+
+// Error satisfies the builtin error interface
+func (e AuxiliaryCommandServerValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sAuxiliaryCommandServer.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = AuxiliaryCommandServerValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = AuxiliaryCommandServerValidationError{}
+
 // Validate checks the field values on MetricsServer with the rules defined in
 // the proto definition for this message. If any rules are violated, the first
 // error encountered is returned, or nil if there are no violations.
diff --git a/api/grpc/mpi/v1/command.proto b/api/grpc/mpi/v1/command.proto
index 63a7f785f..cdf3232da 100644
--- a/api/grpc/mpi/v1/command.proto
+++ b/api/grpc/mpi/v1/command.proto
@@ -322,7 +322,7 @@ message NGINXRuntimeInfo {
     // the stub status API details
     APIDetails stub_status = 1;
     // a list of access_logs
-    repeated string access_logs = 2; 
+    repeated string access_logs = 2;
     // a list of error_logs
     repeated string error_logs = 3;
     // List of NGINX potentially loadable modules (installed but not loaded).
@@ -370,7 +370,7 @@ message NGINXAppProtectRuntimeInfo {
 message InstanceAction {}
 
 // This contains a series of NGINX Agent configurations
-message AgentConfig { 
+message AgentConfig {
     // Command server settings
     CommandServer command = 1;
     // Metrics server settings
@@ -383,6 +383,8 @@ message AgentConfig {
     repeated string features = 5;
     // Message buffer size, maximum not acknowledged messages from the subscribe perspective
     string message_buffer_size = 6;
+    // Auxiliary Command server settings
+    AuxiliaryCommandServer auxiliary_command = 7;
 }
 
 // The command server settings, associated with messaging from an external source
@@ -395,6 +397,16 @@ message CommandServer {
     mpi.v1.TLSSettings tls = 3;
 }
 
+// The auxiliary server settings, associated with messaging from an external source
+message AuxiliaryCommandServer {
+    // Server configuration (e.g., host, port, type)
+    mpi.v1.ServerSettings server = 1;
+    // Authentication configuration (e.g., token)
+    mpi.v1.AuthSettings auth = 2;
+    // TLS configuration for secure communication
+    mpi.v1.TLSSettings tls = 3;
+}
+
 // The metrics settings associated with origins (sources) of the metrics and destinations (exporter)
 message MetricsServer {}
 
diff --git a/docs/proto/protos.md b/docs/proto/protos.md
index 2905bf767..b0e567fc2 100644
--- a/docs/proto/protos.md
+++ b/docs/proto/protos.md
@@ -44,6 +44,7 @@
     - [APIActionRequest](#mpi-v1-APIActionRequest)
     - [APIDetails](#mpi-v1-APIDetails)
     - [AgentConfig](#mpi-v1-AgentConfig)
+    - [AuxiliaryCommandServer](#mpi-v1-AuxiliaryCommandServer)
     - [CommandServer](#mpi-v1-CommandServer)
     - [CommandStatusRequest](#mpi-v1-CommandStatusRequest)
     - [ConfigApplyRequest](#mpi-v1-ConfigApplyRequest)
@@ -697,6 +698,24 @@ This contains a series of NGINX Agent configurations
 | labels | [google.protobuf.Struct](#google-protobuf-Struct) | repeated | A series of key/value pairs to add more data to the NGINX Agent instance |
 | features | [string](#string) | repeated | A list of features that the NGINX Agent has |
 | message_buffer_size | [string](#string) |  | Message buffer size, maximum not acknowledged messages from the subscribe perspective |
+| auxiliary_command | [AuxiliaryCommandServer](#mpi-v1-AuxiliaryCommandServer) |  | Auxiliary Command server settings |
+
+
+
+
+
+
+<a name="mpi-v1-AuxiliaryCommandServer"></a>
+
+### AuxiliaryCommandServer
+The auxiliary server settings, associated with messaging from an external source
+
+
+| Field | Type | Label | Description |
+| ----- | ---- | ----- | ----------- |
+| server | [ServerSettings](#mpi-v1-ServerSettings) |  | Server configuration (e.g., host, port, type) |
+| auth | [AuthSettings](#mpi-v1-AuthSettings) |  | Authentication configuration (e.g., token) |
+| tls | [TLSSettings](#mpi-v1-TLSSettings) |  | TLS configuration for secure communication |
 
 
 
diff --git a/go.mod b/go.mod
index 434b15a13..e84730f75 100644
--- a/go.mod
+++ b/go.mod
@@ -66,6 +66,7 @@ require (
 	go.opentelemetry.io/collector/processor v1.30.0
 	go.opentelemetry.io/collector/processor/batchprocessor v0.124.0
 	go.opentelemetry.io/collector/processor/memorylimiterprocessor v0.124.0
+	go.opentelemetry.io/collector/processor/processortest v0.124.0
 	go.opentelemetry.io/collector/receiver v1.30.0
 	go.opentelemetry.io/collector/receiver/otlpreceiver v0.124.0
 	go.opentelemetry.io/collector/receiver/receivertest v0.124.0
@@ -74,6 +75,7 @@ require (
 	go.opentelemetry.io/collector/scraper/scrapertest v0.124.0
 	go.opentelemetry.io/otel v1.35.0
 	go.uber.org/goleak v1.3.0
+	go.uber.org/multierr v1.11.0
 	go.uber.org/zap v1.27.0
 	golang.org/x/mod v0.23.0
 	golang.org/x/sync v0.13.0
@@ -260,7 +262,6 @@ require (
 	go.opentelemetry.io/collector/pipeline/xpipeline v0.124.0 // indirect
 	go.opentelemetry.io/collector/processor/processorhelper v0.124.0 // indirect
 	go.opentelemetry.io/collector/processor/processorhelper/xprocessorhelper v0.124.0 // indirect
-	go.opentelemetry.io/collector/processor/processortest v0.124.0 // indirect
 	go.opentelemetry.io/collector/processor/xprocessor v0.124.0 // indirect
 	go.opentelemetry.io/collector/receiver/receiverhelper v0.124.0 // indirect
 	go.opentelemetry.io/collector/receiver/xreceiver v0.124.0 // indirect
@@ -289,7 +290,6 @@ require (
 	go.opentelemetry.io/otel/sdk/log v0.11.0 // indirect
 	go.opentelemetry.io/otel/trace v1.35.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
-	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/arch v0.12.0 // indirect
 	golang.org/x/exp v0.0.0-20250210185358-939b2ce775ac // indirect
 	golang.org/x/tools v0.30.0 // indirect