Google Agents Cli PublishSAFE

The CLI and skills that turn any coding assistant into an expert at creating, evaluating, and deploying AI agents on Google Cloud.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: google-agents-cli-publish
description: >
  This skill should be used when the user wants to "publish an agent",
  "publish my ADK agent", "register an agent with Gemini",
  "publish to Gemini" (formerly Gemini Enterprise), or needs guidance on
  the agents-cli publish gemini command.
  Also use when the user wants to "manage agents in Agent Registry",
  "list/update/delete registered agents", or "register an MCP server".
  Covers ADK vs A2A registration modes, programmatic and interactive usage,
  flag reference, auto-detection from deployment metadata, Agent Registry
  fleet management, and troubleshooting.
  Part of the agents-cli skills suite.
  Do NOT use for deployment (use google-agents-cli-deploy).
metadata:
  author: Google
  license: Apache-2.0
  version: 1.11.0
  requires:
    bins:
      - agents-cli
    install: "uv tool install google-agents-cli"
---

# Gemini Registration

> **Requires:** A deployed agent. For Agent Runtime in Gemini platform, `deployment_metadata.json` (created by `agents-cli deploy`) enables auto-detection. For Cloud Run or GKE, provide the agent card URL and flags directly.

## Prerequisites

1. **Agent must be deployed** — the agent must be running and reachable
2. **Gemini app must exist** — Create one in the Google Cloud console before registering
3. **`deployment_metadata.json`** (Agent Runtime only) — Created automatically by `agents-cli deploy`; contains the Agent Runtime ID, deployment target, the A2A flag, and the agent directory
4. **Text-based agent** — Live/voice (bidi) agents are **not supported** by the Gemini app, which has no `/run_live` transport. Register a text-based agent instead.

## Required Permissions for A2A on Cloud Run

- **`roles/run.servicesInvoker`** granted to the Discovery Engine service account (`service-<PROJECT_NUMBER>@gcp-sa-discoveryengine.iam.gserviceaccount.com`) on the Cloud Run service.

---

## Registration Modes

### A2A Registration

Every scaffolded agent serves the Agent-to-Agent protocol. A2A is the default — and only — registration type on **Cloud Run** and **GKE** (no reasoning engine to invoke natively). It also works on **Agent Runtime** via `--registration-type a2a`. For an ADK agent there the CLI warns against it, because the Gemini app can invoke Agent Runtime natively via `:streamQuery` — prefer ADK registration in that case. For an agent built on another framework there is no ADK app to invoke natively, so A2A is the right mode on every target and the warning is expected. Pass the agent card URL and the command fetches the card and registers it; display name and description default to the card's `name`/`description`.

```bash
# A2A on Cloud Run / GKE. The card path depends on the project's language:
#   Python -> /a2a/{app_name}/.well-known/agent-card.json
#   Go     -> /.well-known/agent-card.json
agents-cli publish gemini \
  --agent-card-url https://my-service-abc123.us-east1.run.app/a2a/app/.well-known/agent-card.json \
  --gemini-app-id projects/123456/locations/global/collections/default_collection/engines/my-app
```

Pass `--display-name` / `--description` to override the card defaults. On Agent Runtime, the card URL auto-builds from `deployment_metadata.json` if you omit `--agent-card-url`.

### ADK Registration (default on Agent Runtime)

> **ADK projects only.** The agent must be deployed to Agent Runtime as an ADK app, since
> registration invokes it through `:streamQuery`. An agent on another framework registers over
> A2A, so deploy it to Cloud Run or GKE and publish from there.

This is the **default and recommended registration for ADK agents on Agent Runtime**: the Gemini app invokes the agent natively via `:streamQuery` on its reasoning engine resource, authenticating end-to-end. Under the hood, `:streamQuery` dispatches to the `AdkApp`'s `streaming_agent_run_with_events` method — when debugging an ADK invocation, search the runtime's `reasoning_engine_stderr` logs for that method name to trace the failure. It's also the path to use when the agent needs an OAuth authorization (`--authorization-id`). The agent is registered directly via its reasoning engine resource name; no agent card URL is needed.

```bash
agents-cli publish gemini \
  --registration-type adk \
  --agent-runtime-id projects/123456/locations/us-east1/reasoningEngines/789 \
  --gemini-app-id projects/123456/locations/global/collections/default_collection/engines/my-app \
  --display-name "My Agent" \
  --description "Handles customer queries" \
  --tool-description "Answers questions about products"
```

---

## Programmatic Mode (CI/CD)

The command is non-interactive by default — pass all required values via flags or environment variables. This makes it safe for CI/CD pipelines.

### Via flags

```bash
agents-cli publish gemini \
  --agent-runtime-id "$AGENT_RUNTIME_ID" \
  --gemini-app-id "$GEMINI_APP_ID" \
  --display-name "Production Agent" \
  --registration-type adk
```

### Via environment variables

Most flags have an env var alternative (`--metadata-file`, `--interactive`, and `--list` do not):

```bash
export AGENT_RUNTIME_ID="projects/123456/locations/us-east1/reasoningEngines/789"
export GEMINI_APP_ID="projects/123456/locations/global/collections/default_collection/engines/my-app"
export GEMINI_DISPLAY_NAME="Production Agent"
export GEMINI_DESCRIPTION="Handles customer queries"

agents-cli publish gemini
```

---

## Interactive Mode (`--interactive`)

Pass `--interactive` (or `-i`) to be guided through any missing values with interactive prompts. The command will list available Gemini apps, offer to auto-detect the Agent Runtime ID from metadata, and prompt for display name and description.

```bash
agents-cli publish gemini --interactive
```

---

## Complete Flag Reference

| Flag | Env Var | Description |
|------|---------|-------------|
| `--agent-runtime-id` | `AGENT_RUNTIME_ID` | Agent Runtime resource name (auto-detected from `deployment_metadata.json`) |
| `--gemini-app-id` | `GEMINI_A

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: Google Agents Cli Publish](https://modelsatlas.com/skills/google/google-agents-cli-publish/badge.svg)](https://modelsatlas.com/skills/google/google-agents-cli-publish/)

Not your listing, or something out of date? Claim or update your listing.