The card will not fetch
Check the full card URL from Bifrost’s network. A URL reachable from your laptop may not be reachable from a container or cluster node. The card must be an A2A card, not an HTML login page. If it requires authentication, configure Card fetch options. Request authentication is used after discovery and cannot fix a protected card fetch. For a private certificate authority or mutual TLS, configure the card connection’s TLS settings. If the card fetch succeeds but calls fail, inspect the interfaces it advertises. Bifrost must reach those addresses too.A caller is denied
Check that the agent is enabled and the caller’s credential is valid. For restricted agents, grant the virtual key access to that registration. In Enterprise, check the user’s access profile and any project named on the request. Project membership alone does not guarantee an agent grant, and Allow any virtual key does not override project restrictions. If the agent is reached but its LLM or MCP call is denied, grant those resources separately. An agent grant does not grant model or tool access. See access control for the configuration and scope rules.The card selects the wrong authentication
Use Configure manually under request authentication. Supply the credential your server actually accepts, or choose no runtime authentication if the server intentionally accepts the forwarded Bifrost identity instead. If forwarding and runtime authentication use the same header, choose which value should win. See header collisions.The task failed but the request succeeded
An A2A task’s state and a gateway operation’s status describe different outcomes. Open the conversation, read the failed or rejected task’s status message, then inspect its correlated LLM and MCP logs. Task-state filters apply where the row records a state; a SendMessage operation can expose the state only in its returned task payload.A stream disconnected
Retrieve the task to see whether it is still working. Reconnect withSubscribeToTask if the agent supports it. Disconnecting a client stream does not cancel the task. Use CancelTask if you intend to stop the work.
An agent can reject cancellation or subscription. Read the protocol error and its advertised capabilities rather than treating every disconnect as a gateway failure.
gRPC cannot find the agent
Check the dialed authority. It must contain the registration name as the first DNS label, such aslibrary-research.a2a.example.com:443. A generic load-balancer hostname does not identify an agent.
Check wildcard DNS, TLS termination, HTTP/2 forwarding, the public-to-local port mapping, and whether both gRPC server settings were present at startup. With Helm, expose the listener through an additional Service or deployment-specific routing. See gRPC setup.