Most teams building LLM agents start the same way: one repo, one agent, a hand-rolled deploy script, tool connections wired inline. The second agent copies the first. By the fifth, five deploy scripts have drifted and no two agents fail the same way. That is exactly the problem an internal developer platform solves for services, and agents need one just as badly.
A paved road for agents is a framework plus a CLI sitting on top of a vendor Agent Development Kit (ADK). On one recent build the golden path was a single CLI: scaffold a new agent from a template, run it locally (terminal REPL, browser, or local HTTP), then deploy it to a managed agent-hosting platform with a smoke test. The deploy boilerplate, packaging, find-or-create the hosted engine, telemetry stamping, the platform’s pickling gotchas, is written once, in the CLI. A new agent adds a small [tool.agent] metadata block to its pyproject.toml, naming its runtime service account and the secrets it needs, and carries zero deploy code. Build, deploy, secret resolution, and tracing are all inherited. That is the point: every team ships the same way, and a fix to the deploy path propagates to all of them instead of being copy-pasted into the next drift.
The second idea worth stealing is resilient tool connections. ADK-style toolsets connect lazily; the network call happens inside get_tools(), which the framework invokes fresh on every model turn. If a hosted MCP server is unreachable (a real case: its URL resolved to an internal-only DNS name the hosting platform could not reach), that call raises past the framework’s built-in retry and takes the whole turn down as an unhandled TaskGroup exception. The model returns nothing. One flaky integration silently kills every agent that carries it.
The fix is a wrapper that turns a dead connection into missing tools, not a dead turn:
class ResilientToolset(BaseToolset):
async def get_tools(self, ctx=None):
try:
return await self._inner.get_tools(ctx)
except Exception as exc: # must not crash the turn
log.error("%s unreachable; 0 tools this turn: %s", self._key, exc)
return []Subclassing the real base class matters: the framework’s dispatch only reaches your override if self is the wrapper. Each turn re-attempts the connection, so the agent self-heals when the integration recovers; nothing caches the failure.
Wiring belongs in one place, too. Connection factories live in a shared package; an agent attaches one with a single import. Tool filtering is a drop-in: put an mcp_config.yaml beside the agent and the loader walks up the package tree to find the nearest one. A missing, malformed, or mistyped config fails open to the full tool surface with a warning rather than crashing the agent at import. That fail-open is deliberate, but it cuts against you on a typo, since a misspelled filter key would quietly re-expose the whole surface you meant to trim. So the config schema forbids unknown fields: a mistyped tool_filter is logged as invalid instead of being silently swallowed as a no-op.
Secrets and identity finish it. Each agent gets its own runtime service account; secrets resolve at runtime from a secret manager under an <agent>-<env>-<name> convention, never baked into the deploy artifact. One detail that bites in regulated orgs: create the secret with regional replication pinned to the deploy region; an org policy constraining resource locations rejects the default global replication with FAILED_PRECONDITION.
Agentic systems are production systems. They earn the same platform discipline: a golden path so every agent ships identically, integrations that degrade instead of crash, and boring, repeatable deploys.