Register with `enterprise-agent-platform-registry` ¶

Once your agent repo has real AGENTS.md, skills, and a documented MCP inventory, the next step is to register the project in enterprise-agent-platform-registry. The Registry YAML is the single source of truth for what EAP exposes for your project at runtime.

The registry plane is reviewed independently from your agent repo. Even perfectly written agents cannot run on EAP without an approved Registry entry.

File Location ¶

enterprise-agent-platform-registry/
└── registry/
    └── <team>/
        └── <project>.yaml

team defaults to the parent directory name
project defaults to the YAML file stem

You can leave both implicit unless you need to override them.

Schema ¶

version: 1

# Runtime used to serve this project.
agent_runtime: codex

repo:
  # Git repository URL for the agent code.
  #
  # Cross-org note: if your agent repo is NOT in the same GitHub org as
  # enterprise-agent-platform-registry (e.g., not under github.com/WebexCloudPlatform), confirm with
  # the EAP platform team BEFORE submitting that EAP has read access and
  # can `git clone` the repo. Cross-org access is not automatic.
  url: https://sqbu-github.cisco.com/stap/<your-project-repo>.git

  # Production branch — what EAP loads in the prod environment.
  branch: main


# Cisco LLM Proxy machine account used by this project. Values ending in
# `_env` are environment-variable names, not secret values.
llm_proxy:
  app_name: <registered-app-name>
  auth:
    type: machine_account
    org_id_env: EAP_LLM_ORG_ID
    machine_account_env: EAP_LLM_MACHINE_ACCOUNT
    machine_account_password_env: EAP_LLM_MACHINE_PASSWORD

# Approved MCP servers — the ONLY external systems your agents can reach.
# Anything not listed here is unreachable from inside the runtime.
mcp:
  emsapi:
    type: remote
    url: https://aiops-mcp.webex.com/emsapi/mcp/
    auth:
      type: client_credentials
      token_url: https://idbroker.webex.com/idb/oauth2/v1/access_token
      client_id_env: AIOPS_MCP_CLIENT_ID
      client_secret_env: AIOPS_MCP_CLIENT_SEC
      scope: openid
  service_info:
    type: remote
    url: https://aiops-mcp.webex.com/service_info/mcp/
    auth:
      type: client_credentials
      token_url: https://idbroker.webex.com/idb/oauth2/v1/access_token
      client_id_env: AIOPS_MCP_CLIENT_ID
      client_secret_env: AIOPS_MCP_CLIENT_SEC
      scope: openid

# Human access — only members of these Cisco MyID groups can invoke the agents.
authorized_myid_groups:
  - my-project-operators

# Machine access — only these Cisco CI OAuth client_ids can call via the
# client_credentials flow.
authorized_client_ids:
  - C0123456789exampleclientid

# Environment-specific overrides. Staging normally loads the `dev` branch.
env_overrides:
  stage:
    repo:
      branch: dev

Field Rules ¶

version must be 1.
agent_runtime must be codex.
repo.url is required.
- If the agent repo is not in the same org as enterprise-agent-platform-registry, confirm cross-org clone access with the EAP platform team before opening the PR.
repo.branch is the production branch EAP loads.
llm_proxy identifies the project's approved Cisco LLM Proxy machine account. Use *_env fields for injected credentials; never commit the values.
env_overrides.<env>.repo.branch overrides the branch for a named environment (typically stage → dev).
env_overrides.<env>.repo.url can override the repo URL per environment when required.
env_overrides.<env> can also override LLM Proxy, MCP, and caller authorization fields for that environment.
mcp is required. Use an empty mapping (mcp: {}) only if your agents truly call no MCP servers.
authorized_myid_groups and authorized_client_ids are optional but default to empty — if you leave both empty, nobody can call your agent.
team and project usually don't need to be written in YAML; they default from the file path.

Secrets ¶

Credentials never live in the Registry YAML or the agent repo. They live in Keeper Vault and are injected by Kubed at runtime; the YAML references environment variable names, not values. If a new credential is needed, file that with the platform team — don't commit.

Submit The PR ¶

Open a PR against enterprise-agent-platform-registry/registry/<team>/<project>.yaml and include in the description:

a link to the matching PR on your agent repo
the per-skill MCP inventory you compiled in the MCP planning step
the MyID group(s) and CI client_id(s) you're authorizing
the smoke-test record from staging validation

Reviewers usually split:

project owners / domain maintainers review correctness and operational usefulness on the agent-repo plane
EAP platform team reviews runtime exposure, MCP scope, access lists, and runtime safety on the Registry plane

Both must approve before activation.

After merge, notify the EAP platform team to deploy the change to the target environment. EAP does not auto-pull from registered repos on merge — deployment to staging or production is an explicit platform-team action. See Test and promote for the full deploy-request flow.

Common Mistakes ¶

submitting Registry changes before the agent repo is real — register only once content has been validated
omitting agent_runtime: codex
requesting MCPs your skills don't actually use
leaving both authorized_myid_groups and authorized_client_ids empty
forgetting env_overrides.stage.repo.branch and then wondering why staging mirrors prod
assuming a repo in a different org will be cloneable by EAP without confirmation
putting any kind of secret in the YAML

Next ¶

Test and promote — validate in local Codex, then in staging, then merge to prod.

Register with enterprise-agent-platform-registry ¶