Lumen POET is an MCP builder and A2A agent generator. Point it at the API specification of a target system, OpenAPI, Swagger, or RAML, and it builds a precise MCP server and generates a collection of A2A agents for that application, complete with out-of-the-box prompts. Precise means the generated MCP server and agents expose the operations the application owner defines, and nothing else.

Do I need an AI team to use it?

No. POET is no-code for the core path: import the spec, review the generated operations, publish. Where you want control, it is low-code: fine-tune the out-of-the-box prompts, remap the schema for the MCP generation, and adjust agent behavior from the console. Most application teams have their first agents running without writing agent code.

What does POET generate from one API?

A precise MCP server, and a collection of A2A agents grouped by relevant functionality, for example orders, billing, and inventory from one commerce API. An orchestrator AI agent coordinates the collection, interacting with the other A2A agents to complete core functionality end to end. Enterprises can then fine-tune and enhance the out-of-the-box agents for the target API.

Can I change how the MCP server maps to my API?

Yes. Schema remapping is built in: rename operations, reshape parameters and responses, hide fields, and merge or split endpoints so the MCP surface matches how agents should use the application rather than how the API grew. The out-of-the-box prompts are editable the same way, from the console, without code.

Where do the generated MCP servers and agents run?

In your VPC by default, deployed with Helm or Terraform, with automatic scaling. Or export the generated MCP server and A2A agent code to hyperscaler AI environments such as Microsoft Foundry and Amazon Bedrock AgentCore and run it there. Either way the code is yours.

Does POET replace my API gateway?

No. POET coexists with Kong, Apigee, AWS API Gateway, MuleSoft, and Azure API Management, reading the API definitions you already publish there, and it complements their newer AI gateway and MCP proxy features. Your gateway keeps managing API traffic; POET adds orchestrated A2A agents, credential brokering, integrated testing, and lifecycle management on top.

What is the POET Credential Broker?

An add-on service to Lumen POET that front-ends the generated MCP servers and A2A agents, and the policy decision point and policy enforcement point for credentials. The application admin defines the PDP: which user, role, or AI agent can access which features, and which scope of each feature. At runtime an agent arrives with no token, a just-in-time token issued by your IAM, or a user's bearer token when acting on someone's behalf. The broker verifies that token with your IAM, then replaces it with the right NHI credential, OAuth, API key, or Basic Auth, drawn from an external vault compliant with your enterprise security posture, and calls the API gateway with it. The agent never sees the permanent secret: zero standing privileges for agents, by construction. Policy is managed through an integrated MCP layer.

How does the broker relate to the Lumen A2A Gateway?

Two decision points, each with its own PDP and PEP. The POET Credential Broker, an add-on to Lumen POET, decides and enforces credentials: which role, which user, which group, for how long. The Lumen A2A Gateway decides and enforces intent: which agents may talk to which resources, and whether each A2A or agent-to-MCP conversation matches declared purpose. They deploy together or separately.

How do I know the generated agents work and keep working?

Integrated testing runs against the generated MCP server and agents before you publish, and every interaction is logged afterward: the agent, the operation, the user it acts for, and the outcome. Automatic scaling handles load without re-architecture.

Is this a non-human identity or workload IAM product?

The POET Credential Broker addresses the core NHI problem: permanent, overscoped machine credentials embedded in applications. It keeps those NHI credentials, OAuth, API key, or Basic Auth, in an external vault and exchanges verified IAM tokens for them call by call, so agents never hold standing secrets. Pair it with the Lumen A2A Gateway for discovery, PeerGroups, and intent control at the runtime layer.

Backflipt

Lumen POET: Your APIs, Agent-Ready in Minutes.

Enterprises spent a decade turning applications into APIs. Lumen POET puts that investment to work in the agent era: point it at an OpenAPI, Swagger, or RAML spec and it generates precise MCP servers and orchestrated A2A agents, no code required, tested, logged, and auto-scaling. Run them in your VPC, or export the code to Microsoft Foundry and Amazon Bedrock AgentCore.

The Lumen POET Credential Broker ,an add-on service, front-ends those MCP servers and A2A agents. It verifies every caller with your IAM and swaps their token for a vault-held NHI credential, so no agent ever carries a permanent secret, and no audit ever finds one.

Schedule Meeting See the Lumen A2A Gateway

WHO THIS PAGE IS FOR

Built for the People Who Own the Applications

APPLICATION OWNER·primary

"Everyone wants my application in their agent workflow. I have no AI team."

You have the spec. POET does the rest: a precise MCP server and a working agent collection, generated in minutes, exposing only the operations you approve. You stay in control of your application's agent surface.

CHIEF AI OFFICER

"I need every application agent-ready this year, not one pilot per quarter."

POET turns agent enablement into a repeatable pattern: spec in, tested agents out, same governance every time. The roadmap stops depending on scarce AI engineers.

CIO

"We invested a decade turning microservices into APIs. Does that carry over?"

It does. POET builds directly on the API estate you already govern through Kong, Apigee, AWS API Gateway, MuleSoft, or Azure API Management. Nothing gets rebuilt.

CISO

"Every hand-built MCP server is another security review. And another credential."

Generated servers expose owner-defined operations only, every interaction is logged, and the POET Credential Broker add-on front-ends the generated surface and keeps permanent NHI credentials in the external vault, exchanging verified IAM tokens for them call by call. Agents hold nothing standing.

THE LIABILITY ALREADY INSIDE

Permanent, Overscoped NHIs Are Becoming Part of Your Applications

Look inside almost any enterprise application and you will find them: a service account granted admin because scoping it properly would have slipped the release date, an API key pasted into a config file three years ago, a basic-auth password nobody has rotated since go-live. These non-human identities already outnumber your employees many times over, most never appear in your IdP, and each one is scoped for the worst day of its life rather than the job it does.

The exposure is concrete. When an overscoped credential leaks, the blast radius is everything it could reach, not what it was meant for. Auditors write findings against unrotated secrets, insurers now ask how machine credentials are governed, and every agent integration done the old way mints more of them.

This is the pattern Lumen POET is built to break. The generated MCP servers and A2A agents expose owner-defined operations only, and the POET Credential Broker add-on keeps the permanent NHI credentials in an external vault, exchanged for verified IAM tokens call by call. Agents becoming part of your applications does not have to mean more permanent credentials becoming part of them too.

The Challenge

Enterprises Spent a Decade Building APIs. Agents Cannot Use Them Yet.

The hard part is done. Monoliths became microservices, microservices became APIs, and the business runs on them.

Then agents arrived speaking a different language: MCP and A2A. Your APIs offer neither. Bridging by hand takes AI skills most application teams do not have, a security review for a surface nobody scoped, and it usually exposes more of the API than any agent should touch. Multiply by the whole portfolio and the roadmap stalls.

The gap is not your APIs. It is the missing agent-facing layer, and that is exactly what POET generates.

How It Works

Spec In. Tested Agents Out.

Four steps from an API specification to a running, governed agent surface. No agent code written, unless you want to write some.

Point at the Spec

Import the OpenAPI, Swagger, or RAML definition of the target system, straight from the API gateway you already run. POET reads the operations, parameters, and schemas.

Shape the Surface

Start from out-of-the-box prompts and fine-tune them. Remap the schema so the MCP surface matches how agents should use the application. Owner-defined operations only: what you do not approve does not exist.

Generate the Collection

POET builds a precise MCP server and a collection of A2A agents grouped by relevant functionality, coordinated by an orchestrator agent that works with the other agents to complete core tasks end to end.

Test, Run, Scale

Integrated testing validates the generated surface before publishing. Then it runs with full logging and automatic scaling, in your VPC via Helm or Terraform, or exported to Microsoft Foundry or Amazon Bedrock AgentCore.

External AI agents pass the Credential Broker add-on into POET, where the generated MCP servers and A2A agents live; the MCP servers reach the API gateway fronting your applications with a vault-held NHI credential. Tested before publishing, logged in production, exportable as code.

Orchestrated Collections

A Collection of Agents, Not a Monolith

One API rarely means one job. A commerce API handles orders, billing, and inventory; an ITSM API handles tickets, changes, and assets. POET reads that structure and generates a collection of A2A agents to match, each owning its slice, instead of one oversized agent that knows a little about everything.

An orchestrator agent sits at the center and works the others to finish the job: take the order, check inventory, raise the invoice. To the caller it looks like one capable counterpart. Inside, it is a governed division of labor.

And it is a starting point, not a ceiling. The out-of-the-box agents work on day one; your team can sharpen a prompt, extend a scope, or add a step from the console. The decade spent turning microservices into APIs becomes the foundation the agents stand on.

Core Capabilities

What POET Does

MCP Builder

Builds precise MCP servers from the target system's API spec. Precise means owner-defined operations only: callers see what you approve, and nothing the API happens to expose.

A2A Generator with Orchestration

Generates a collection of A2A agents grouped by relevant functionality, called by other AI clients over the A2A Protocol and coordinated by an orchestrator agent that works with the others to complete core tasks end to end.

Out-of-the-Box Prompts

Every generated agent ships with working prompts tuned to its slice of the API. Fine-tune them from the console when you want different behavior, tone, or guardrails.

Schema Remapping and Fine-Tuning

Easily remap the schema for the MCP generation from the target system's API: rename operations, reshape parameters, hide fields, merge or split endpoints. The agent surface matches how the application should be used, not how the API grew.

No-Code, Low-Code Studio

Build and manage agents and MCP servers with no or least expertise. The core path is clicks, not code: import, review, publish. Role-based access keeps changes in the right hands.

Integrated Testing

Generated MCP servers and agents are exercised against the live API before you publish. What ships has already passed its tests, and re-runs guard every change.

Logging and Traceability

Every interaction is logged: the agent, the operation, the user it acts for, and the outcome. The trail your auditors expect exists from the first call, not as a retrofit.

Automatic Scalability

Agent demand is spiky by nature. Generated servers and agents scale automatically with load, in your VPC, without a re-architecture project when adoption takes off.

Export to Hyperscaler AI Environments

The generated MCP server and A2A agent code exports to hyperscaler AI environments such as Microsoft Foundry and Amazon Bedrock AgentCore. Build here, run where your AI platform strategy says.

Gateway Coexistence and Open Standards

Coexists with Kong, Apigee, AWS API Gateway, MuleSoft, and Azure API Management, reading the specs you already publish. Built on the A2A Protocol and MCP, deployed with Helm or Terraform.

Add-On Service

The Lumen POET Credential Broker

Every call still has to authenticate to the application behind it, and this is exactly where most agent projects quietly create their biggest liability: permanent credentials copied into agent configurations. The Lumen POET Credential Broker exists so that never happens. An add-on service to Lumen POET, it front-ends the generated MCP servers and A2A agents: every inbound call passes through it before touching the generated surface. And it is the policy decision point and policy enforcement point for credentials. An AI agent arrives with whatever it has: no token, a just-in-time token issued by your IAM, or a user's bearer token when it acts on someone's behalf. The broker verifies that token with your IAM, applies the access policy, and then makes the call itself, replacing the inbound token with the right NHI credential drawn from the vault. The agent never sees the permanent secret.

A PDP Your Application Admin Defines

The schema mapping of which user, role, or AI agent can access which features, and which scope of each feature, is defined by the application admin as the PDP. The PEP enforces it on every call.

Token Exchange with Your IAM

Whether the agent brings no token, an IAM-issued JIT token, or a user's bearer token, the broker checks it with your IAM, then replaces it: the call to the API gateway goes out with the NHI token instead.

NHI Credentials, Three Types

Each application can use one or more NHI tokens: OAuth, API key, or Basic Auth with username and password. The broker selects the right one for the call, per the admin's policy.

The External Vault Keeps the Secrets

Passwords and certificates are stored in an external vault compliant with your enterprise security posture, drawn at call time and never handed to the agent. Zero standing privileges for agents, by construction.

The broker is the PDP and PEP for credentials. Intent has its own PDP and PEP in the Lumen A2A Gateway, where Smart Policies on each PeerGroup decide and enforce what agents may do. Two decision points, cleanly separated, built to work together.

Clear Lines

Two Decision Points, One Platform

POET Credential Broker

PDP and PEP for credentialsThe application admin defines which user, role, or AI agent reaches which features and scope; the broker enforces it on every call.
Token exchange with your IAMVerifies the inbound bearer or IAM-issued JIT token with your IAM, then calls the API gateway with the vault-held NHI credential instead.
Three NHI credential typesOAuth, API key, or Basic Auth with username and password; one or more per application.
External-vault anchoredPasswords and certificates stay in a vault compliant with your security posture. Agents carry nothing permanent.
Integrated MCP policy layerCredential policy managed the same way agents work: through MCP.

An add-on service to Lumen POET, front-ending the generated MCP servers and A2A agents.

Lumen A2A Gateway

PDP and PEP for intentSmart Policies on each PeerGroup decide and enforce intent in A2A and agent-to-MCP conversations.
Discovery with risk scores Finds AI agents and the resources they call, and ranks both by risk.
PeerGroups Agent-layer microsegmentation: only approved agents reach the resources assigned to their group.
Interaction and access logging Every approval and denial recorded with the applied PeerGroup requirement and evaluating Smart Policy.

Explore the Lumen A2A Gateway for the runtime governance story.

Works With Your API Estate

Your Gateways, Your Specs, Your Clouds

POET reads the API definitions you already publish and coexists with the API management stack you already run. If your gateway team is exploring AI gateway, MCP gateway, or MCP proxy features to expose REST APIs as MCP tools, POET fits right beside them: the gateway keeps managing API traffic while POET generates and operates the full agent surface, orchestrated A2A agents, credential brokering, testing, and logging included. Deploy without disruption, in your VPC or air-gapped.

Kong Gateway

Google Apigee

AWS API Gateway

MuleSoft Anypoint

Azure API Management

Microsoft Foundry (export)

Amazon Bedrock AgentCore (export)

Deployment

Runs Where Your Applications Live

Your VPC, Your Terms

Deploys with Helm or Terraform into your cloud or on-premises Kubernetes, including air-gapped environments. Generated agents and MCP servers scale automatically with demand.

Alongside, Not Instead

POET sits next to your API gateway, not in place of it. Kong, Apigee, AWS API Gateway, MuleSoft, and Azure API Management keep doing their jobs while POET adds the agent-facing layer.

Portable by Design

The generated MCP server and A2A agent code is yours. Run it under POET's management, or export it to hyperscaler AI environments such as Microsoft Foundry and Amazon Bedrock AgentCore.

Why It Pays Off

The Case in Four Cards

Business

An application becomes agent-ready in days, not quarters. The API investment your enterprise made over years starts earning in the agent era immediately.

Security

Owner-defined operations only, tested before publishing, logged from the first call. And zero standing privileges for agents: the broker exchanges verified IAM tokens for vault-held NHI credentials, call by call.

ROI

No dedicated AI team per application. One product generates, tests, and operates the agent surface for the whole portfolio, and the code exports if your platform strategy changes.

No Forklift

No API rewrites, no gateway replacement, no new identity project. POET reads what you publish, deploys beside what you run, and draws on the external vault and IAM you already trust.

FEATURES AT A GLANCE

The Full Feature List, One Table

Feature	What It Does	Why It Matters
MCP Builder	Builds a precise MCP server from the target system's OpenAPI, Swagger, or RAML spec, exposing owner-defined operations only.	Agents get exactly the surface you approve, nothing the API happens to expose.
A2A Agent Generator	Generates a collection of A2A agents grouped by relevant functionality, with an orchestrator agent coordinating the others to complete core tasks end to end.	One API becomes a working division of labor, not one oversized agent.
Out-of-the-Box Prompts	Every generated agent ships with working prompts, editable from the console.	Day-one function, with fine-tuning when you want different behavior.
Schema Remapping	Rename operations, reshape parameters, hide fields, merge or split endpoints for the MCP generation.	The agent surface reflects how the application should be used, not how the API grew.
No-Code, Low-Code Management	Build and manage agents and MCP servers with no or least expertise, from a role-based console.	Application teams ship agents without a dedicated AI team.
Integrated Testing	Exercises generated servers and agents against the live API before publishing, and on every change.	What ships has already passed; changes cannot silently break the surface.
Logging and Traceability	Logs every interaction: agent, operation, the user it acts for, and outcome.	The audit trail exists from the first call, not as a retrofit.
Automatic Scalability	Generated agents and MCP servers scale automatically with demand in your VPC.	Adoption spikes do not become re-architecture projects.
Code Export	Exports generated MCP server and A2A agent code to hyperscaler AI environments such as Microsoft Foundry and Amazon Bedrock AgentCore.	Build here, run anywhere your platform strategy points. The code is yours.
Gateway Coexistence	Reads specs from and deploys alongside Kong, Apigee, AWS API Gateway, MuleSoft, and Azure API Management.	No disruption to the API infrastructure you already govern.
Broker Add-On Credential PDP and PEP	The application admin defines which user, role, or AI agent can access which features and scope; the broker enforces it on every call.	Every credential decision made and enforced in one governed place.
Broker Add-On Token Exchange with IAM	Verifies the caller's bearer or IAM-issued JIT token with your IAM, then calls the API gateway with the right vault-held NHI credential.	The agent never touches the permanent secret; zero standing privileges by construction.
Broker Add-On External Vault	Passwords and certificates stay in an external vault compliant with your enterprise security posture, drawn at call time.	Secrets stay where your security team already governs them.
Broker Add-On MCP Policy Layer	Credential policy managed through the broker's integrated MCP layer.	Governance works the way agents work, through the same protocol.

Bring Us One API Spec

Pick the application everyone wants in their agent workflow. In one session we will generate its MCP server and agent collection, run the tests, and hand you the result. That is usually all the convincing anyone needs.

Schedule Meeting Explore the Lumen A2A Gateway

Also see: Lumen Solutions, the deployment playbook·Trust No Agent, the joint solution with IBM and Fortinet

Topics: #Backflipt · #LumenPOET · #POETCredentialBroker · #MCPBuilder · #MCP · #MCPSecurity · #A2A · #A2AAgents · #OrchestratorAgent · #AgenticAI · #AIAgents · #AgentReady · #OpenAPI · #APIGateway · #APIManagement · #AIGateway · #MCPGateway · #MCPTools · #NoCode · #LowCode · #EnterpriseAI · #AISecurity · #AIGovernance · #ZeroTrust · #ZeroStandingPrivileges · #EphemeralCredentials · #JustInTime · #TokenExchange · #SecretsManagement · #NonHumanIdentity · #NHI · #WorkloadIdentity · #WorkloadIAM · #MachineIdentity · #PAM · #CyberSecurity