vertex-engine-inspector

name	vertex-engine-inspector
description	Inspect and validate Vertex AI Agent Engine deployments including Code Execution Sandbox, Memory Bank, A2A protocol compliance, and security posture. Generates production readiness scores. Use when asked to inspect, validate, or audit an Agent Engine deployment. Trigger with "inspect agent engine", "validate agent engine deployment", "check agent engine config", "audit agent engine security", "agent engine readiness check", "vertex engine health", or "reasoning engine status".
allowed-tools	Read, Grep, Glob, Bash(cmd:*)
version	2.31.0
author	Jeremy Longshore <[e-mail]>
license	MIT
argument-hint	<project-id> <agent-engine-id> [location]
effort	high
tags	["ai","deployment","security","compliance"]
compatibility	Designed for Claude Code

Vertex Engine Inspector

Overview

Inspect and validate Vertex AI Agent Engine deployments across seven categories: runtime configuration, Code Execution Sandbox, Memory Bank, A2A protocol compliance, security posture, performance metrics, and monitoring observability. This skill generates weighted production-readiness scores (0-100%) with actionable recommendations for each deployment.

Prerequisites

• google-cloud-aiplatform[agent_engines]>=1.120.0 Python SDK installed
• gcloud CLI authenticated (for IAM and monitoring queries — not for Agent Engine CRUD)
• IAM roles: roles/aiplatform.user and roles/monitoring.viewer granted on the target project
• Access to the target Google Cloud project hosting the Agent Engine deployment
• curl for A2A protocol endpoint testing (AgentCard, Task API, Status API)
• Cloud Monitoring API enabled for performance metrics retrieval
• Familiarity with Vertex AI Agent Engine concepts: Code Execution Sandbox, Memory Bank, Model Armor

Important: There is no gcloud CLI surface for Agent Engine (no gcloud ai agents, gcloud ai reasoning-engines, or gcloud alpha ai agent-engines commands exist). All Agent Engine operations use the Python SDK via vertexai.Client() or vertexai.preview.reasoning_engines.

Instructions

1. Connect to the Agent Engine deployment by retrieving agent metadata via the Python SDK (client.agent_engines.get(name=...))
2. Parse the runtime configuration: model selection (Gemini 2.5 Pro/Flash), tools enabled, VPC settings, and scaling policies
3. Validate Code Execution Sandbox settings: confirm state TTL is 7-14 days, sandbox type is SECURE_ISOLATED, and IAM permissions are scoped to required GCP services only
4. Check Memory Bank configuration: verify enabled status, retention policy (min 100 memories), Firestore encryption, indexing enabled, and auto-cleanup active
5. Test A2A protocol compliance by probing /.well-known/agent-card, POST /v1/tasks:send, and GET /v1/tasks/<task-id> endpoints for correct responses
6. Audit security posture: validate IAM least-privilege roles, VPC Service Controls perimeter, Model Armor activation, encryption at rest and in transit, and absence of hardcoded credentials
7. Query Cloud Monitoring for performance metrics: request count, error rate (target < 5%), latency percentiles (p50/p95/p99), token usage, and cost estimates over the last 24 hours