config.yaml

@@ -2,7 +2,10 @@ google_cloud_project: bnt-orquestador-cognitivo-dev
 google_cloud_location: us-central1
 
 firestore_db: bnt-orquestador-cognitivo-firestore-bdo-dev
-mcp_remote_url: https://ap01194-orq-cog-rag-connector-1007577023101.us-central1.run.app/sse
+
+mcp_remote_url: "https://ap01194-orq-cog-rag-connector-1007577023101.us-central1.run.app/sse"
+# audience sin la ruta, para emitir el ID Token:
+mcp_audience: "https://ap01194-orq-cog-rag-connector-1007577023101.us-central1.run.app"
 
 agent_name: Vaia
 agent_model: gemini-2.5-flash

pyproject.toml

@@ -12,6 +12,7 @@ dependencies = [
     "google-adk>=1.14.1",
     "google-cloud-firestore>=2.23.0",
     "pydantic-settings[yaml]>=2.13.1",
+    "google-auth>=2.34.0",
 ]
 
 [build-system]

src/va_agent/agent.py

@@ -10,7 +10,33 @@ from google.cloud.firestore_v1.async_client import AsyncClient
 from va_agent.config import settings
 from va_agent.session import FirestoreSessionService
 
-connection_params = SseConnectionParams(url=settings.mcp_remote_url)
+
+
+# --- Autenticación Cloud Run → Cloud Run (ID Token) ---
+from google.oauth2 import id_token
+from google.auth.transport.requests import Request as GAuthRequest
+
+def _fetch_id_token(audience: str) -> str:
+    """Emite un ID Token para invocar un servicio Cloud Run protegido."""
+    return id_token.fetch_id_token(GAuthRequest(), audience)
+
+# Audience = URL del MCP remoto 
+_MCP_URL = settings.mcp_remote_url
+_MCP_AUDIENCE = getattr(settings, "mcp_audience", None) or _MCP_URL
+
+
+
+def _auth_headers_provider() -> dict[str, str]:
+    token = _fetch_id_token(_MCP_AUDIENCE)
+    return {"Authorization": f"Bearer {token}"}
+
+
+connection_params = SseConnectionParams(
+    url=_MCP_URL,
+    headers=_auth_headers_provider()
+)
+
+# connection_params = SseConnectionParams(url=settings.mcp_remote_url)
 toolset = McpToolset(connection_params=connection_params)
 
 agent = Agent(

src/va_agent/config.py

@@ -27,6 +27,9 @@ class AgentSettings(BaseSettings):
     firestore_db: str
 
     # MCP configuration
+    mcp_audience: str
+
+    # MCP configuration audience
     mcp_remote_url: str
 
     model_config = SettingsConfigDict(