Enable Hermes A2A for Outbound Calls, Inbound Tasks, or Both

Hermes A2A works in two directions. Outbound tools let Hermes discover and call independent peers. The inbound gateway platform lets other A2A clients send tasks to Hermes over HTTP. These surfaces are related, but enabling one does not imply that the other is active.

Official documentation: https://hermes-agent.nousresearch.com/docs/user-guide/messaging/a2a

Choose the operating role

For an outbound-only caller, enable the a2a toolset through hermes tools. It is off by default. The agent can then discover peers, call them, inspect known connections, review conversation history, and orchestrate by advertised capability.

For an inbound callable agent, run hermes gateway setup and choose A2A, or enable the A2A gateway platform in configuration. The documented default inbound port is 9900. A local setup remains loopback-only unless authentication and an explicit wider host binding are configured.

A bidirectional installation needs both decisions. Keep the initial proof asymmetric: verify outbound calling first or inbound serving first, then add the other direction.

Enablement checklist

Define caller, server, or bidirectional mode.
Enable the outbound toolset only where peer calls are required.
Enable the inbound gateway only where other agents should submit tasks.
Keep the first inbound listener on 127.0.0.1.
Store authentication values outside prompts and public config examples.
Verify the visible tool list and Agent Card separately.

Common pitfalls

Enabling the gateway and expecting outbound tools. The toolset has its own opt-in boundary.
Enabling tools and assuming a server is listening. Outbound capability does not start the inbound platform.
Widening the bind address during the first test. Local proof should come before remote exposure.
Testing both directions at once. A failed round trip becomes harder to isolate.

Verification

For outbound mode, confirm the A2A tools are visible in the intended profile and discover a trusted test peer. For inbound mode, fetch /.well-known/agent-card.json locally and make one synthetic JSON-RPC request. Verify the result, gateway logs, and A2A audit record without publishing credentials or private message content.