| agent | Agent identifier (e.g., docker/code-analyzer from Docker Hub, or path to .yaml file) | yes | — |
| prompt | Prompt to pass to the agent. If not provided, uses a default based on the agent type | no | — |
| mcp-gateway | Install mcp-gateway (true/false) | no | false |
| mcp-gateway-version | Version of mcp-gateway to use (specifying this will enable mcp-gateway installation) | no | v0.22.0 |
| anthropic-api-key | Anthropic API key for Claude models (at least one API key required) | no | — |
| openai-api-key | OpenAI API key (at least one API key required) | no | — |
| google-api-key | Google API key for Gemini models (at least one API key required) | no | — |
| aws-bearer-token-bedrock | AWS Bearer token for Bedrock models (at least one API key required) | no | — |
| xai-api-key | xAI API key for Grok models (at least one API key required) | no | — |
| nebius-api-key | Nebius API key (at least one API key required) | no | — |
| mistral-api-key | Mistral API key (at least one API key required) | no | — |
| github-token | GitHub token for API access (defaults to GITHUB_TOKEN) | no | — |
| timeout | Timeout in seconds for agent execution (0 for no timeout) | no | 0 |
| debug | Enable debug mode with verbose logging (true/false) | no | false |
| working-directory | Working directory to run the agent in | no | . |
| yolo | Enable yolo mode - auto-approve all prompts (true/false) | no | true |
| max-retries | Maximum number of retries on failure (0 = no retries) | no | 2 |
| retry-delay | Base delay in seconds between retries (doubles each attempt) | no | 5 |
| retry-on-timeout | Number of additional retry attempts when the agent times out (exit code 124). Independent of max-retries — both budgets can be consumed in the same run. Default 0 = no timeout retries. | no | 0 |
| extra-args | Additional arguments to pass to docker agent run | no | "" |
| add-prompt-files | Comma-separated list of files to append to the prompt (e.g., 'AGENTS.md,CLAUDE.md') | no | "" |
| skip-summary | Skip writing agent output to the job summary (useful when callers write their own summary) | no | false |
| org-membership-token | PAT with read:org scope for org membership authorization checks (preferred over author_association) | no | "" |
| auth-org | GitHub organization to check membership against (used with org-membership-token) | no | "" |
| skip-auth | Skip the built-in authorization check (use when the calling workflow already performed its own auth) | no | false |