MentorAgent.Declarative
1.0.0-rc.6
See the version list below for details.
dotnet add package MentorAgent.Declarative --version 1.0.0-rc.6
NuGet\Install-Package MentorAgent.Declarative -Version 1.0.0-rc.6
<PackageReference Include="MentorAgent.Declarative" Version="1.0.0-rc.6" />
<PackageVersion Include="MentorAgent.Declarative" Version="1.0.0-rc.6" />
<PackageReference Include="MentorAgent.Declarative" />
paket add MentorAgent.Declarative --version 1.0.0-rc.6
#r "nuget: MentorAgent.Declarative, 1.0.0-rc.6"
#:package MentorAgent.Declarative@1.0.0-rc.6
#addin nuget:?package=MentorAgent.Declarative&version=1.0.0-rc.6&prerelease
#tool nuget:?package=MentorAgent.Declarative&version=1.0.0-rc.6&prerelease
MentorAgent.Declarative
Preview Release — MentorAgent is currently in public preview. APIs may change before the stable release.
Optional package. Install it only if you want to define specialist agents in YAML files instead of C# classes. Everything MentorAgent does works without it.
Define a Level-2 specialist in a text file, drop it next to your application, and the assistant can hand off to it — no new class, no [MentorAgent] attribute, no recompile of the agent's behaviour.
Built on the Agent Framework's declarative agent factory (Microsoft.Agents.AI.Declarative).
Package Family
| Package | Install when |
|---|---|
| MentorAgent | Blazor Server app |
| MentorAgent.Server | Web API / headless backend, or Blazor Auto server-side project |
| MentorAgent.Blazor | Blazor WASM / Blazor Auto client project |
| MentorAgent.Abstractions | Never directly — it arrives with any of the above |
| MentorAgent.Declarative ← you are here | You want YAML-defined agents. Add it alongside MentorAgent or MentorAgent.Server |
Table of Contents
- What it does
- Getting started
- The YAML format
- Tools: named, not defined
- Security — a definition file is code
- When to use YAML and when to use C#
- Loading definitions from somewhere else
- Configuration options
- How to test it
- Why a separate package
- Requirements
- Related Packages
- License
What it does
MentorAgent's three-level agent model has a coordinator (L1) that can hand off to specialists (L2). Normally a specialist is a C# class:
[MentorAgent("ShippingAgent", "Answers questions about deliveries")]
public class ShippingAgent
{
[MentorAction("get_tracking", "Looks up a tracking number")]
public string GetTracking(int orderId) => /* … */;
}
This package adds a second way to declare the agent — its name, its instructions, its model settings and which tools it may use — as a file:
kind: Prompt
name: ShippingAgent
description: Answers questions about deliveries and shipping costs
instructions: |
You handle shipping questions only. Use the available tools to look up real orders;
never invent a tracking number. If the question is not about shipping, say so and stop.
model:
options:
temperature: 0.2
tools:
- kind: function
name: get_order_status
- kind: function
name: get_all_orders
Both kinds end up in the same handoff graph, so route_to_specialist reaches them identically and the user cannot tell which is which.
Getting started
Installation
dotnet add package MentorAgent.Declarative
Registration
builder.Services.AddMentorAgentDeclarative(o => o.Directory = "Agents");
builder.Services.AddMentorAgent(o =>
{
o.ChatClient = chatClient;
o.AppName = "ShopFlow";
o.ScanAssemblies = [typeof(Program).Assembly];
});
Order does not matter — MentorAgent asks every registered agent source while it builds the coordinator, which happens on the first message.
Make sure the files reach the output folder
A definition that is not copied is the most common way this feature appears not to work. In your .csproj:
<ItemGroup>
<Content Include="Agents\**\*.agent.yaml" CopyToOutputDirectory="PreserveNewest" />
</ItemGroup>
If the directory is missing at startup you get a warning naming the resolved path — that message exists because the failure is otherwise silent.
The YAML format
The schema comes from the Agent Framework, not from MentorAgent. The fields that matter in practice:
| Field | Meaning |
|---|---|
kind |
Prompt for a prompt-based agent. Required |
name |
The specialist's name. This is what appears in handoff logs — keep it stable |
description |
What this specialist is for. The coordinator reads it to decide when to route here |
instructions |
The agent's system prompt. Use a \| block for multiple lines |
model.options |
temperature, topP, and other per-agent model settings |
tools |
Names of tools this agent may call — each entry needs kind and name, see below |
outputSchema |
Optional JSON-schema-style shape for a typed answer |
description is worth care: it is the coordinator's only basis for choosing this agent over another. "Handles orders" competes badly with "Handles orders, shipping and returns for existing customers".
Two format details that cost an afternoon
Neither is in the Agent Framework guide, and both fail in a way that points somewhere else.
Every tools entry needs kind. Accepted values are codeInterpreter, fileSearch,
function, webSearch and mcp; function is the one that binds to a tool of your application.
Omit it and loading fails with NotSupportedException — not a validation message naming the line.
Folded scalars (>) are not supported by this reader. Use |, or a single line. With > the
parse error reports the end of the file, so you will look everywhere except at the block that
caused it:
description: > # ✗ parse error, blamed on the last line of the file
Handles shipping and delivery.
description: | # ✓
Handles shipping and delivery.
description: Handles shipping. # ✓
Tools: named, not defined
A tools: entry names a tool; it does not create one. The name must match a tool your application already exposes — a [MentorAction] method, or any other Level-1 tool.
tools:
- kind: function # required — see below
name: get_order_status # must exist; a typo simply means the agent never gets that tool
The tool name is the snake_case of the C# member, with a trailing Async dropped:
GetOrderStatusAsync() → get_order_status. Get it wrong and nothing tells you — the agent simply
starts without that tool and then improvises an answer it has no data for.
This is the design point of the whole package. MentorAgent hands the factory the application's real tool list, already wrapped in its gate, so a YAML agent calling create_order still hits:
RequiredRoles— the role check, exactly as a C# specialist does- human approval — the confirmation banner, if the tool requires one
- action feedback, per-tool metrics and tracing
An agent defined in a file therefore has no capability your application did not already have, and no shortcut around the controls on it.
Security — a definition file is code
Read this before pointing Directory anywhere.
A definition chooses the model, writes the system instructions, and names the tools the agent may call. Anyone who can write that file can rewrite the assistant's persona and widen which tools it reaches for. That makes it code, whatever its file extension says.
- Load only from deploy-time locations. An application directory or an embedded resource. Never an upload folder, never a user-writable path, never a path built from request input.
- Review definitions like source. Put them in version control and through the same review as a
.csfile. - The gate still holds. A file cannot invent a tool or bypass a role check — that is enforced, not advisory. But it can instruct the agent to try things, so the controls on your tools remain the thing that actually stops it.
The second point is the one people skip: YAML feels like configuration, and configuration feels safe to let more people edit.
When to use YAML and when to use C#
| YAML | C# [MentorAgent] |
|
|---|---|---|
| Change an agent's instructions | Edit a file | Recompile |
| New tool / new logic | Not possible — tools stay in C# | Where it belongs |
| Compile-time checking | None; a bad tool name is silent | Full |
| Who can author it | Anyone who can edit a reviewed file | Developers |
| Fits when | Wording and routing get tuned often | The agent has real behaviour |
A good rule: behaviour in C#, phrasing in YAML. If you find yourself wanting a loop or a branch in a definition file, that agent wants to be a class.
You can mix freely — both kinds coexist in the same handoff graph.
Loading definitions from somewhere else
Definitions do not have to be files. Pass them as strings for agents stored in a database, a configuration service, or a test:
builder.Services.AddMentorAgentDeclarative(o =>
{
o.Definitions.Add("""
kind: Prompt
name: FaqAgent
description: Answers frequently asked questions about the shop
instructions: Answer briefly, in the user's language. Say so when you do not know.
""");
});
For a fully custom source — one that hits your own store, or refreshes on a schedule — implement IMentorAgentSource from the MentorAgent package directly and register it. AddMentorAgentDeclarative is one implementation of that interface, not a privileged path:
public sealed class DatabaseAgentSource : IMentorAgentSource
{
public async Task<IReadOnlyList<AIAgent>> GetAgentsAsync(
MentorAgentSourceContext context, CancellationToken ct = default)
{
// context.ChatClient — the coordinator's client, so usage lands in the metrics
// context.Tools — the Level-1 tools, already gated
…
}
}
builder.Services.AddSingleton<IMentorAgentSource, DatabaseAgentSource>();
Configuration options
| Option | Type | Default | Description |
|---|---|---|---|
Directory |
string? |
null |
Folder to scan, absolute or relative to the app base directory. Deploy-time paths only |
SearchPattern |
string |
"*.agent.yaml" |
File pattern inside Directory |
Recursive |
bool |
false |
Scan subdirectories too |
Definitions |
IList<string> |
empty | YAML supplied inline, loaded in addition to Directory |
ConfigurationSection |
string? |
null |
Name of the configuration section the YAML may reference. null exposes nothing |
SearchPattern and Recursive — what the scan is allowed to reach
Both defaults are deliberately narrow, and widening them is a decision worth making on purpose rather than by accident:
builder.Services.AddMentorAgentDeclarative(o =>
{
o.Directory = "Agents";
// Default "*.agent.yaml", not "*.yaml". A deployment folder holds other YAML — a CI file,
// a Helm values file — and reading one of those as an agent definition would at best fail
// loudly. Widen it only if your definitions genuinely do not carry the suffix.
o.SearchPattern = "*.agent.yaml";
// Default false. A nested folder is exactly where a definition gets added without review,
// and a definition file is code: it picks the model, writes the instructions and names the
// callable tools. Turn it on when your layout needs it, not "just in case".
o.Recursive = true; // now Agents/support/*.agent.yaml is loaded too
});
Files are loaded in a stable order (sorted by path), so two definitions declaring the same agent
name resolve identically on every machine rather than depending on the file system's enumeration
order. A missing Directory is warned about — almost always a CopyToOutputDirectory miss, where
the assistant otherwise starts fine and is simply missing a specialist nobody thinks to look for.
ConfigurationSection — exposing configuration to a definition
Default null: no configuration reaches the YAML at all, and the definitions are self-contained.
Set it to expose one section, so a definition can reference values instead of hardcoding them:
// appsettings.json
{
"AgentSettings": {
"SupportEmail": "help@contoso.com",
"MaxRefund": "250"
}
}
builder.Services.AddMentorAgentDeclarative(o =>
{
o.Directory = "Agents";
o.ConfigurationSection = "AgentSettings"; // only AgentSettings:* reaches the YAML
});
The values arrive as Power Fx variables named after the keys — SupportEmail, MaxRefund.
How a definition references them is part of the Agent Framework's declarative schema, not something
MentorAgent defines, so check the framework's documentation for the expression syntax before
relying on it.
Name a section. Never hand over the whole IConfiguration. The factory loads whatever
configuration it is given into the Power Fx engine as variables — one per key, in its
constructor. Every key must therefore be a valid Power Fx identifier, and a single one that is not
takes the entire factory down before any definition is read. This is not hypothetical: a key
literally named ${name}, contributed by an unrelated configuration provider, produced
ArgumentException: Invalid name: ${name}
and no agents loaded at all. Naming one section bounds the blast radius to keys you control.
MentorAgent catches that failure and logs the cause rather than letting it surface as a generic startup error, then returns no agents:
[MentorAgent:Declarative] The agent factory rejected the configuration exposed to YAML
(AgentSettings). Every key in it becomes a Power Fx variable and must be a valid identifier.
Narrow MentorDeclarativeOptions.ConfigurationSection, or leave it null.
If you see it, the fix is a narrower section — or null, which is the right setting unless you
actually need substitution.
How to test it
- Put
shipping.agent.yamlin anAgentsfolder, withCopyToOutputDirectory. - Start the app. The log should show, at Information level:
[MentorAgent:Declarative] Agent 'ShippingAgent' loaded from shipping.agent.yaml (12 tool(s) available to it). [MentorAgent] Handoff: declarative agent 'ShippingAgent' added to workflow. - Ask something in that agent's area — "where is order 1001?". The answer should come back through it.
- Negative check — a bad file does not take the app down. Break the YAML deliberately: you get
'shipping.agent.yaml' could not be loaded — skipped, and everything else still starts. - Negative check — the gate holds. Name a tool carrying
RequiredRolesin the YAML and ask the agent to use it while unauthenticated. It must be refused, the same way a C# specialist is, and no action taken.
Why a separate package
Microsoft.Agents.AI.Declarative brings the Power Fx interpreter (YAML expressions are Power Fx), the Agents object model in three assemblies, Microsoft.ML.Tokenizers and several more.
That is a fair price for file-based authoring and pure overhead for everyone else, so it stays out of the MentorAgent core package. Installing this one is an explicit decision to pay it.
The reference is pinned to the 1.6.1 line, matching Microsoft.Agents.AI in the core package, so adding it does not move the rest of the library onto a different Agent Framework version.
Requirements
- .NET 10
MentorAgent(orMentorAgent.Server) configured with aChatClient— declarative agents need one, and are skipped with a warning without it- A provider supporting the model options you use in the definitions
Related Packages
| Package | Purpose |
|---|---|
| MentorAgent | Blazor Server — full AI assistant |
| MentorAgent.Server | Any ASP.NET Core app — headless AI backend |
| MentorAgent.Blazor | Blazor WASM — SignalR client |
| MentorAgent.Abstractions | Shared contracts and UI components |
License
MIT — the full text ships in the repository's LICENSE file.
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
-
net10.0
- MentorAgent (>= 1.0.0-rc.6)
- Microsoft.Agents.AI.Declarative (>= 1.18.0-rc1)
NuGet packages
This package is not used by any NuGet packages.
GitHub repositories
This package is not used by any popular GitHub repositories.
| Version | Downloads | Last Updated |
|---|---|---|
| 1.0.0-rc.7 | 27 | 9/16/2026 |
| 1.0.0-rc.6 | 49 | 9/14/2026 |
| 1.0.0-rc.5 | 52 | 9/13/2026 |
| 1.0.0-rc.4 | 58 | 9/9/2026 |
| 1.0.0-rc.3 | 67 | 9/4/2026 |
| 1.0.0-rc.2 | 75 | 8/24/2026 |
| 1.0.0-rc.1 | 75 | 8/19/2026 |
| 1.0.0-preview.5 | 70 | 8/12/2026 |
1.0.0-rc.6
Four defects found by running the published rc.5 packages against the sample applications - the pass rc.5's own notes implied but had not yet been done. No API change: every fix restores behaviour rc.5 already claimed.
=== FIXED
- BUG-068 (S3): the configuration summary was NOT written once per process, as rc.5's notes said it was. A second browser circuit still reprinted seven Information lines - the skills catalogue, the external agents, the hosted image model, the Azure image-header note, the hosted MCP server, the hosted tool list and the declarative handoff. The sentinel was claimed halfway through the build, after everything above it had already announced itself, and three collaborating builders never consulted it at all. It is now claimed first, and a later build demotes Information to Debug instead of discarding it, so an operator who turns Debug on to investigate one circuit can still see what it was built with. Degradation warnings stay per session, unchanged.
- BUG-069 (S2): an agent supplied by an IMentorAgentSource - a declarative YAML specialist, or a host's own - joined the handoff graph and was never named in the coordinator's instructions. route_to_specialist names no agent either, so nothing the model could see said the specialist existed: asked about it, the assistant answered that there is no such agent, while the log recorded it being added to the workflow. Source-supplied agents are now listed with their descriptions beside the attribute-declared ones.
- BUG-070 (S4): every skill on the published A2A card carried a flattened name ("Getallordersforanalysis"). The friendly-name helper splits on underscores and was being handed the PascalCase method name. That card is the one artefact whose entire audience is another machine's directory.
- BUG-071 (S4): a turn whose input safety check met the first failure printed two stack traces instead of one - the turn's fault log was reset after that check, so its cause was recorded and immediately discarded. The reset now happens before every early return.
1,616 tests green, build 0 warnings / 0 errors.
1.0.0-rc.5
Latency, cost per visitor, and the answers themselves. Measured on a live Blazor Server host before and after: time to the first character on the same question fell from 2.6-3.0 s to 1.6-2.0 s, and a shared MCP server now runs one child process for the whole application instead of one per browser circuit.
=== NEW - options
- ClassifierChatClient: the client MentorAgent uses for its own one-word decisions (input safety, hosted-tool scope, post-turn fact extraction). Point it at a small deployment: those calls sit in front of the reply and were measured at 707-2091 ms on gpt-4.1 for two tokens of answer. Defaults to ChatClient, and is metered under its own model id.
- AnonymousIdentity (PerSession by default): who a signed-out visitor is, for memory and for the rate-limit counter. Every unauthenticated session used to share the literal key "anonymous", so one visitor's facts were recalled for the next and one visitor could spend everybody's allowance. BREAKING for single-user hosts that want the old behaviour: set AnonymousIdentity = Shared (MAUI, desktop, kiosk - it is what makes memory survive a restart).
- RefuseOutOfScope (off by default): refuse a message that is not about this application, using the scope verdict the classifier already produces. Free when EnableSafetyCheck is on, because both questions now travel in one call.
- WarmUpAtStartup (off by default): build one coordinator when the application starts, so the first visitor does not pay for the catalogue embeddings, the shared MCP sessions and the remote agent cards.
- MentorMcpServer.Shared (null by default): one connection per process, or one per session. Unset decides by transport - a server reached over ServerUrl is shared, a server started from Command is not, because a local child process can hold state for the person who started it.
- MapMentorAgentMcp / MapMentorAgentA2A take a configure callback, so the host can finally apply RequireAuthorization() to them. Both endpoints discarded their convention builders before this.
- IMentorQueryEmbedding: the current message's embedding, computed once per turn. Inject it in your IMentorRagSource instead of embedding the query a second time.
=== FASTER
- One embedding per text instead of one per consumer. Routing, tool filtering and memory relevance were each embedding the same sentence - two to four network round trips per turn - and the tool catalogue plus the routing exemplars were re-embedded once per DI scope, i.e. once per browser circuit.
- One classifier call instead of two: the input safety check and the hosted-tool scope check read the same message and now ask both questions in the same call.
- The composer is handed back when the answer is complete, not after the post-turn fact extraction (a second model call, 544-767 ms measured).
- Shared MCP sessions and a process-wide agent-card cache with a failure backoff. Two browser tabs used to mean eight node processes and 580 MB.
=== FIXED
- BUG-062 (S3): text written before a tool call was glued to the text after it ("...i dati.Il catalogo"), and a Markdown table opening the second response stopped being a table.
- BUG-063 (S3): in HitlMode.Native a user without the required role was shown the confirmation banner and refused only after approving it. The role gate now runs first, as it always did in Blocking mode.
- BUG-064 (S1): two anonymous visitors of the same site shared one memory. Now isolated per session by default, with a warning when a host opts back into the shared bucket and a second session reaches it.
- BUG-065 (S4): the RAG "wrong scale" warning fired for thresholds on the source's own scale, once per visitor.
- BUG-066 (S3): the hosted-tool scope classifier was built on the raw ChatClient, so its billed call appeared in no dashboard.
- BUG-067 (S3): the safety classifier was never told what the application is equipped with, and refused three legitimate messages out of forty on a host with an MCP filesystem server and image input. It is now told, and a refused message is logged by fingerprint rather than by its text.
=== CHANGED
- RAG citation chips show the documents the answer actually cited. Documents are numbered in the prompt and the model is asked to cite them; if it cites none, no chips are shown.
- MentorshipLevel.Proactive asks for one sentence before acting instead of a plan, and may only offer next steps the application can actually perform.
- The A2A agent card publishes the application's ungated actions as skills, its input/output modes and its streaming capability. It carried a name and a description and nothing else.
- The coordinator's configuration summary is logged once per process instead of once per session, and one provider failure produces one stack trace instead of one per component that met it.
1,611 tests green, build 0 warnings / 0 errors.
1.0.0-rc.4
No change in this package. Version aligned with MentorAgent 1.0.0-rc.4, which fixes one S3 in the provider error classifier - see that package's notes. The five packages ship as a set and are meant to be upgraded together.
1.0.0-rc.3
No changes to this package's own surface: the YAML dialect, the file scanning rules and the tool-resolution guarantees are exactly as in 1.0.0-rc.2.
=== Why the version moved ==================================================
- All five packages ship together and share one version. rc.3 closes six findings in the core, Blazor and Abstractions packages, including two S1s - see those packages' notes.
- If you reference Microsoft.Extensions.AI.OpenAI or Microsoft.Agents.AI.Foundry directly, note that the core package now FAILS THE BUILD (error MENTOR001) when OpenAI resolves to 2.11.0 or later, rather than letting the application die at startup.
=== Unchanged, and worth restating ========================================
- A tool named in YAML still resolves to a tool the application already registered, already wrapped in MentorAgent's gate, so RequiredRoles and human approval keep working inside a declarative agent's own function-calling loop.
- ConfigurationSection still exposes one named section and nothing else. Null means expose nothing, never expose everything.
- A definition file is code. Load it only from deploy-time locations.