Infrastructure for Agent Workloads: Our HashiCorp Stack

Why Agent Traffic Is Different

Traditional web applications have predictable traffic patterns—request comes in, response goes out, maybe a few database queries in between. Agent workloads are nothing like this. A single agent decision can trigger cascading tool calls, spin up parallel workflows, and generate bursts of internal traffic that look nothing like human usage patterns.

This means your infrastructure needs to handle sudden spikes without pre-provisioning for peak, scale services independently based on real-time demand, and maintain security boundaries when agents are making autonomous decisions. Our HashiCorp stack is built for exactly this.

Terraform — Agent Infrastructure as Code

Every piece of our infrastructure is defined in Terraform. When we deploy a new agent service or MCP server, the infrastructure it needs—compute, networking, secrets access—is provisioned declaratively alongside the application code.

job "mcp-invoice-server" {
  type = "service"

  group "mcp" {
    count = 3

    scaling {
      min = 1
      max = 10

      policy {
        source = "prometheus"
        query  = "avg(mcp_tool_call_queue_depth)"
      }
    }

    task "server" {
      driver = "docker"
      config {
        image = "registry.kodecraft.dev/mcp-invoice:latest"
      }
    }
  }
}

This Nomad job definition, managed through Terraform, auto-scales MCP servers based on tool call queue depth—the metric that actually matters for agent workloads.

Nomad — Orchestrating Agent Services

We chose Nomad over Kubernetes for its operational simplicity. Agent architectures already have enough moving parts—orchestration, MCP servers, monitoring, guardrails—without adding Kubernetes complexity on top. Nomad handles containers, raw binaries, and Wasm workloads with a single scheduler and a fraction of the operational overhead.

Vault — Secrets at Agent Speed

When agents make autonomous tool calls, they need credentials—database access, API keys, service tokens. Vault provides dynamic secrets with automatic TTLs, so agent services get short-lived credentials generated on demand. No hardcoded secrets. No long-lived tokens sitting in environment variables waiting to be leaked.

Consul — Service Discovery for Dynamic Topologies

Agent architectures are inherently dynamic. Services scale up and down based on workload, new MCP servers come online as capabilities are added, and agents need to discover available tools at runtime. Consul provides service discovery and health checking that keeps pace with this dynamism, plus Consul Connect for mutual TLS between services without application changes.

The Result

This stack gives us reproducible infrastructure that scales with agent demand, zero-trust security for autonomous agent operations, operational simplicity that lets us focus on the product rather than the platform, and the flexibility to run on any infrastructure without cloud lock-in.