reference

agentfile.yaml Schema

Complete schema reference for agentfile.yaml — every field, type, and allowed value.

The full JSON Schema is at schema/v1/agentfile.schema.json. The agents key is required; everything else is optional.

Validate before building
Run ninetrix validate to check your file against the schema before running ninetrix build.

Top-level fields

FieldTypeRequiredDescription
agentsmapyesMap of agent name → AgentDef. First key = entry agent.
governanceobjectnoGlobal budget + approval config (overridable per agent)
triggersarraynoGlobal webhook + schedule triggers (routeable per agent)

AgentDef

FieldTypeRequiredDescription
metadata.rolestringyesShort role description for the system prompt
metadata.goalstringyesWhat the agent is trying to achieve
metadata.instructionsstringnoMulti-line behavior instructions
metadata.constraintsstring[]noHard rules the agent must not violate
runtime.providerenumyesanthropic | openai | google | deepseek | mistral | groq | together_ai | openrouter | cerebras | fireworks_ai | bedrock | azure | minimax
runtime.modelstringyesModel identifier string
runtime.temperaturefloatno0.0–2.0, default 0.2
toolsTool[] | "all"noList of tools. Use plain strings for built-ins (bash, filesystem, etc.), objects for external tools, or tools: all to enable all built-ins.
packagesstring[]noSystem packages to install via apt-get install -y at build time (e.g. git, ffmpeg, chromium)
collaboratorsstring[]noAgent keys this agent can hand off to
executionExecutionnoExecution mode and verification config
governanceGovernancenoAgent-level override
triggersTrigger[]noAgent-level triggers
runtime.resources.cpustringnoDocker --cpus e.g. "1.0"
runtime.resources.memorystringnoDocker memory e.g. "2Gi"
runtime.resources.base_imagestringnoOverride Dockerfile FROM
runtime.resources.warm_poolboolnoKeep container alive after completion

Tool

The tools: field accepts three forms:

YAML
# 1. Plain string — built-in tool name (simplest form)
tools:
  - bash
  - filesystem
  - web_search

# 2. All built-ins at once
tools: all

# 3. Object — required for external tools (MCP, OpenAPI, Composio, hub://)
tools:
  - bash                              # built-in plain string
  - name: github
    source: mcp://github              # MCP tool
  - name: stripe
    source: openapi://https://stripe.com/spec.json
  - name: gh
    source: hub://gh                  # Tool Hub
Built-in nameDescription
bashRun shell commands inside the container (alias: shell)
filesystemRead and write files inside the container
memoryPersistent key-value memory store
schedulerSchedule deferred tasks
web_searchWeb search via the configured search provider
web_browseFetch and read web pages
notifySend notifications to the user
ask_userPause and prompt the user for input
sub_agentSpawn a lightweight LLM sub-agent inside the container
code_interpreterExecute Python code in a sandboxed environment
Deprecated syntax
source: builtin://{name} and the top-level builtin: true flag still work for backward compatibility but are deprecated. Use plain string names (- bash) or tools: all instead.

Object-form fields for external tools:

FieldTypeRequiredDescription
namestringyesLocal name for the tool (used in logs and traces)
sourcestringyesTool URI: mcp://{server}, composio://{APP}, openapi://{url}, hub://{name}, ./path/to/tool.py
actionsstring[]noLimit to specific actions (Composio only)
auth.typestringnoAuth type: bearer, basic, header, query
auth.tokenstringnoBearer token (supports ${ENV_VAR})
dependencies.pipstring[]noPython packages to install at build time
dependencies.aptstring[]noSystem packages to install at build time
base_urlstringnoBase URL override for OpenAPI tools

Governance

FieldTypeDescription
max_budget_per_runfloatUSD spending limit per run
human_approval.enabledboolEnable HITL approval gates
human_approval.actionsstring[]Tool names requiring approval
rate_limitstringRate limit string e.g. "10_requests_per_minute"

Execution

FieldTypeDefaultDescription
modedirect | planneddirectExecution strategy
max_stepsint10Max tool-use iterations
verify_stepsboolfalseVerify each step result (planned mode only)
on_step_failureabort | continue | retry_oncecontinueFailure policy
verifier.providerstringProvider for the verifier LLM
verifier.modelstringModel for the verifier LLM
verifier.max_tokensint128Max tokens for verifier response
thinking.enabledboolfalseEnable pre-run reasoning step
thinking.providerstringProvider for the thinking LLM
thinking.modelstringModel for the thinking LLM
thinking.max_tokensint2048Max tokens for thinking output
thinking.promptstringCustom reasoning instruction
durabilitybooltrueWhen true (default), the agent automatically restarts and resumes from the last API checkpoint if it crashes. Set to false to disable.

Trigger

FieldTypeDescription
typewebhook | schedule | channelTrigger type
endpointstring(webhook) HTTP path, e.g. /run
portint(webhook) Port to expose, default 9100
cronstring(schedule) 5-field cron expression
messagestring(schedule) Message sent to agent on each fire
target_agentstringRoute to a specific agent key (default: entry agent)
channelsstring[](channel) Messaging platforms to accept, e.g. ["telegram", "whatsapp"]. Required when type: channel.
session_modeper_chat | per_message(channel) per_chat maintains a persistent thread per conversation (default); per_message starts a new run for every inbound message.
Channel triggers render as webhooks
A type: channel trigger is compiled into the same webhook handler infrastructure as type: webhook. The agent container exposes an HTTP endpoint; the local API server receives inbound messages from Telegram (and other platforms) and dispatches them to the running agent. Register the webhook URL with the platform via POST /v1/channels/{id}/setup-webhook.
On this page