diff --git a/.gitignore b/.gitignore
index d78cda1..15ad075 100644
--- a/.gitignore
+++ b/.gitignore
@@ -191,3 +191,6 @@ AGENTKIT_CODEBASE_GUIDE.md
 .opencode/
 .specify/
 .claude/
+openspec/
+.sisyphus
+
diff --git a/agentkit/sdk/knowledge/types.py b/agentkit/sdk/knowledge/types.py
index 0c8382f..9a885ff 100644
--- a/agentkit/sdk/knowledge/types.py
+++ b/agentkit/sdk/knowledge/types.py
@@ -100,6 +100,9 @@ class VpcConfigForGetKnowledgeBase(KnowledgeBaseModel):
 
 
 class VpcConfigurationForListKnowledgeBases(KnowledgeBaseModel):
+    enable_shared_internet_access: Optional[bool] = Field(
+        default=None, alias="EnableSharedInternetAccess"
+    )
     security_group_ids: Optional[list[str]] = Field(
         default=None, alias="SecurityGroupIds"
     )
diff --git a/agentkit/sdk/mcp/types.py b/agentkit/sdk/mcp/types.py
index 1ddb36b..5d8ddf0 100644
--- a/agentkit/sdk/mcp/types.py
+++ b/agentkit/sdk/mcp/types.py
@@ -63,10 +63,22 @@ class AuthorizerConfigurationForListMCPToolsets(MCPBaseModel):
 
 
 class AuthorizerForGetMCPServiceForInboundAuthorizerConfiguration(MCPBaseModel):
+    custom_jwt_authorizer: Optional[CustomJwtAuthorizerForGetMCPService] = Field(
+        default=None, alias="CustomJwtAuthorizer"
+    )
+    identity_authorizer: Optional[IdentityAuthorizerForGetMCPService] = Field(
+        default=None, alias="IdentityAuthorizer"
+    )
     key_auth: Optional[KeyAuthForGetMCPService] = Field(default=None, alias="KeyAuth")
 
 
 class AuthorizerForGetMCPServiceForOutboundAuthorizerConfiguration(MCPBaseModel):
+    custom_jwt_authorizer: Optional[CustomJwtAuthorizerForGetMCPService] = Field(
+        default=None, alias="CustomJwtAuthorizer"
+    )
+    identity_authorizer: Optional[IdentityAuthorizerForGetMCPService] = Field(
+        default=None, alias="IdentityAuthorizer"
+    )
     key_auth: Optional[KeyAuthForGetMCPService] = Field(default=None, alias="KeyAuth")
 
 
@@ -91,9 +103,15 @@ class BackendConfigurationForGetMCPService(MCPBaseModel):
     custom_mcp_configuration: Optional[CustomMcpConfigurationForGetMCPService] = Field(
         default=None, alias="CustomMcpConfiguration"
     )
+    ecs_configuration: Optional[EcsConfigurationForGetMCPService] = Field(
+        default=None, alias="EcsConfiguration"
+    )
     function_configuration: Optional[FunctionConfigurationForGetMCPService] = Field(
         default=None, alias="FunctionConfiguration"
     )
+    vke_configuration: Optional[VkeConfigurationForGetMCPService] = Field(
+        default=None, alias="VkeConfiguration"
+    )
 
 
 class CustomConfigurationForGetMCPService(MCPBaseModel):
@@ -102,6 +120,11 @@ class CustomConfigurationForGetMCPService(MCPBaseModel):
     protocol_type: Optional[str] = Field(default=None, alias="ProtocolType")
 
 
+class CustomJwtAuthorizerForGetMCPService(MCPBaseModel):
+    allowed_clients: Optional[list[str]] = Field(default=None, alias="AllowedClients")
+    discovery_url: Optional[str] = Field(default=None, alias="DiscoveryUrl")
+
+
 class CustomJwtAuthorizerForGetMCPToolset(MCPBaseModel):
     allowed_clients: Optional[list[str]] = Field(default=None, alias="AllowedClients")
     discovery_url: Optional[str] = Field(default=None, alias="DiscoveryUrl")
@@ -124,6 +147,12 @@ class CustomMcpConfigurationForGetMCPService(MCPBaseModel):
     )
 
 
+class EcsConfigurationForGetMCPService(MCPBaseModel):
+    instances: Optional[list[InstancesForGetMCPService]] = Field(
+        default=None, alias="Instances"
+    )
+
+
 class EnvsForGetMCPService(MCPBaseModel):
     key: Optional[str] = Field(default=None, alias="Key")
     value: Optional[str] = Field(default=None, alias="Value")
@@ -134,6 +163,13 @@ class FunctionConfigurationForGetMCPService(MCPBaseModel):
     function_name: Optional[str] = Field(default=None, alias="FunctionName")
 
 
+class IdentityAuthorizerForGetMCPService(MCPBaseModel):
+    credential_provider_name: Optional[str] = Field(
+        default=None, alias="CredentialProviderName"
+    )
+    provider_type: Optional[str] = Field(default=None, alias="ProviderType")
+
+
 class InboundAuthorizerConfigurationForGetMCPService(MCPBaseModel):
     authorizer: Optional[
         AuthorizerForGetMCPServiceForInboundAuthorizerConfiguration
@@ -141,6 +177,12 @@ class InboundAuthorizerConfigurationForGetMCPService(MCPBaseModel):
     authorizer_type: Optional[str] = Field(default=None, alias="AuthorizerType")
 
 
+class InstancesForGetMCPService(MCPBaseModel):
+    instance_id: Optional[str] = Field(default=None, alias="InstanceId")
+    ip: Optional[str] = Field(default=None, alias="Ip")
+    port: Optional[int] = Field(default=None, alias="Port")
+
+
 class KeyAuthForGetMCPService(MCPBaseModel):
     api_key_location: Optional[str] = Field(default=None, alias="ApiKeyLocation")
     api_keys: Optional[list[ApiKeysForGetMCPService]] = Field(
@@ -171,6 +213,7 @@ class MCPServiceForGetMCPService(MCPBaseModel):
     )
     backend_type: Optional[str] = Field(default=None, alias="BackendType")
     created_at: Optional[str] = Field(default=None, alias="CreatedAt")
+    failed_log_file_url: Optional[str] = Field(default=None, alias="FailedLogFileUrl")
     inbound_authorizer_configuration: Optional[
         InboundAuthorizerConfigurationForGetMCPService
     ] = Field(default=None, alias="InboundAuthorizerConfiguration")
@@ -416,17 +459,33 @@ class TagsForListMCPToolsets(MCPBaseModel):
     value: Optional[str] = Field(default=None, alias="Value")
 
 
+class VkeConfigurationForGetMCPService(MCPBaseModel):
+    cluster_id: Optional[str] = Field(default=None, alias="ClusterId")
+    namespace: Optional[str] = Field(default=None, alias="Namespace")
+    port: Optional[int] = Field(default=None, alias="Port")
+    service_name: Optional[str] = Field(default=None, alias="ServiceName")
+
+
 class VpcConfigurationForGetMCPService(MCPBaseModel):
+    enable_shared_internet_access: Optional[bool] = Field(
+        default=None, alias="EnableSharedInternetAccess"
+    )
     subnet_ids: Optional[list[str]] = Field(default=None, alias="SubnetIds")
     vpc_id: Optional[str] = Field(default=None, alias="VpcId")
 
 
 class VpcConfigurationForGetMCPToolset(MCPBaseModel):
+    enable_shared_internet_access: Optional[bool] = Field(
+        default=None, alias="EnableSharedInternetAccess"
+    )
     subnet_ids: Optional[list[str]] = Field(default=None, alias="SubnetIds")
     vpc_id: Optional[str] = Field(default=None, alias="VpcId")
 
 
 class VpcConfigurationForListMCPServices(MCPBaseModel):
+    enable_shared_internet_access: Optional[bool] = Field(
+        default=None, alias="EnableSharedInternetAccess"
+    )
     security_group_ids: Optional[list[str]] = Field(
         default=None, alias="SecurityGroupIds"
     )
@@ -435,6 +494,9 @@ class VpcConfigurationForListMCPServices(MCPBaseModel):
 
 
 class VpcConfigurationForListMCPToolsets(MCPBaseModel):
+    enable_shared_internet_access: Optional[bool] = Field(
+        default=None, alias="EnableSharedInternetAccess"
+    )
     security_group_ids: Optional[list[str]] = Field(
         default=None, alias="SecurityGroupIds"
     )
@@ -450,9 +512,15 @@ class BackendForCreateMCPService(MCPBaseModel):
     custom_mcp_configuration: Optional[BackendCustomMcpForCreateMCPService] = Field(
         default=None, alias="CustomMcpConfiguration"
     )
+    ecs_configuration: Optional[BackendEcsForCreateMCPService] = Field(
+        default=None, alias="EcsConfiguration"
+    )
     function_configuration: Optional[BackendFunctionForCreateMCPService] = Field(
         default=None, alias="FunctionConfiguration"
     )
+    vke_configuration: Optional[BackendVkeForCreateMCPService] = Field(
+        default=None, alias="VkeConfiguration"
+    )
 
 
 class BackendCustomForCreateMCPService(MCPBaseModel):
@@ -496,11 +564,24 @@ class BackendCustomMcpPublicPackageForCreateMCPService(MCPBaseModel):
     raw_config: Optional[str] = Field(default=None, alias="RawConfig")
 
 
+class BackendEcsForCreateMCPService(MCPBaseModel):
+    instances: Optional[list[BackendEcsInstancesItemForCreateMCPService]] = Field(
+        default=None, alias="Instances"
+    )
+
+
 class BackendFunctionForCreateMCPService(MCPBaseModel):
     function_id: Optional[str] = Field(default=None, alias="FunctionId")
     function_name: Optional[str] = Field(default=None, alias="FunctionName")
 
 
+class BackendVkeForCreateMCPService(MCPBaseModel):
+    cluster_id: Optional[str] = Field(default=None, alias="ClusterId")
+    namespace: Optional[str] = Field(default=None, alias="Namespace")
+    port: Optional[int] = Field(default=None, alias="Port")
+    service_name: Optional[str] = Field(default=None, alias="ServiceName")
+
+
 class InboundAuthorizerForCreateMCPService(MCPBaseModel):
     authorizer: Optional[InboundAuthorizerAuthorizerForCreateMCPService] = Field(
         default=None, alias="Authorizer"
@@ -543,6 +624,9 @@ class NetworkForCreateMCPService(MCPBaseModel):
 
 
 class NetworkVpcForCreateMCPService(MCPBaseModel):
+    enable_shared_internet_access: Optional[bool] = Field(
+        default=None, alias="EnableSharedInternetAccess"
+    )
     subnet_ids: Optional[list[str]] = Field(default=None, alias="SubnetIds")
     vpc_id: str = Field(..., alias="VpcId")
 
@@ -555,11 +639,21 @@ class OutboundAuthorizerForCreateMCPService(MCPBaseModel):
 
 
 class OutboundAuthorizerAuthorizerForCreateMCPService(MCPBaseModel):
+    identity_authorizer: Optional[
+        OutboundAuthorizerAuthorizerIdentityAuthorizerForCreateMCPService
+    ] = Field(default=None, alias="IdentityAuthorizer")
     key_auth: Optional[OutboundAuthorizerAuthorizerKeyAuthForCreateMCPService] = Field(
         default=None, alias="KeyAuth"
     )
 
 
+class OutboundAuthorizerAuthorizerIdentityAuthorizerForCreateMCPService(MCPBaseModel):
+    credential_provider_name: Optional[str] = Field(
+        default=None, alias="CredentialProviderName"
+    )
+    provider_type: Optional[str] = Field(default=None, alias="ProviderType")
+
+
 class OutboundAuthorizerAuthorizerKeyAuthForCreateMCPService(MCPBaseModel):
     api_keys: Optional[
         list[OutboundAuthorizerAuthorizerKeyAuthApiKeysItemForCreateMCPService]
@@ -584,6 +678,12 @@ class BackendCustomMcpPrivatePackageEnvsItemForCreateMCPService(MCPBaseModel):
     value: Optional[str] = Field(default=None, alias="Value")
 
 
+class BackendEcsInstancesItemForCreateMCPService(MCPBaseModel):
+    instance_id: Optional[str] = Field(default=None, alias="InstanceId")
+    ip: Optional[str] = Field(default=None, alias="Ip")
+    port: Optional[int] = Field(default=None, alias="Port")
+
+
 class InboundAuthorizerAuthorizerKeyAuthApiKeysItemForCreateMCPService(MCPBaseModel):
     key: Optional[str] = Field(default=None, alias="Key")
     name: str = Field(..., alias="Name")
@@ -674,6 +774,9 @@ class NetworkForCreateMCPToolset(MCPBaseModel):
 
 
 class NetworkVpcForCreateMCPToolset(MCPBaseModel):
+    enable_shared_internet_access: Optional[bool] = Field(
+        default=None, alias="EnableSharedInternetAccess"
+    )
     security_group_ids: Optional[list[str]] = Field(
         default=None, alias="SecurityGroupIds"
     )
@@ -855,9 +958,15 @@ class BackendForUpdateMCPService(MCPBaseModel):
     custom_mcp_configuration: Optional[BackendCustomMcpForUpdateMCPService] = Field(
         default=None, alias="CustomMcpConfiguration"
     )
+    ecs_configuration: Optional[BackendEcsForUpdateMCPService] = Field(
+        default=None, alias="EcsConfiguration"
+    )
     function_configuration: Optional[BackendFunctionForUpdateMCPService] = Field(
         default=None, alias="FunctionConfiguration"
     )
+    vke_configuration: Optional[BackendVkeForUpdateMCPService] = Field(
+        default=None, alias="VkeConfiguration"
+    )
 
 
 class BackendCustomForUpdateMCPService(MCPBaseModel):
@@ -901,11 +1010,24 @@ class BackendCustomMcpPublicPackageForUpdateMCPService(MCPBaseModel):
     raw_config: Optional[str] = Field(default=None, alias="RawConfig")
 
 
+class BackendEcsForUpdateMCPService(MCPBaseModel):
+    instances: Optional[list[BackendEcsInstancesItemForUpdateMCPService]] = Field(
+        default=None, alias="Instances"
+    )
+
+
 class BackendFunctionForUpdateMCPService(MCPBaseModel):
     function_id: Optional[str] = Field(default=None, alias="FunctionId")
     function_name: Optional[str] = Field(default=None, alias="FunctionName")
 
 
+class BackendVkeForUpdateMCPService(MCPBaseModel):
+    cluster_id: Optional[str] = Field(default=None, alias="ClusterId")
+    namespace: Optional[str] = Field(default=None, alias="Namespace")
+    port: Optional[int] = Field(default=None, alias="Port")
+    service_name: Optional[str] = Field(default=None, alias="ServiceName")
+
+
 class InboundAuthorizerForUpdateMCPService(MCPBaseModel):
     authorizer: Optional[InboundAuthorizerAuthorizerForUpdateMCPService] = Field(
         default=None, alias="Authorizer"
@@ -943,11 +1065,21 @@ class OutboundAuthorizerForUpdateMCPService(MCPBaseModel):
 
 
 class OutboundAuthorizerAuthorizerForUpdateMCPService(MCPBaseModel):
+    identity_authorizer: Optional[
+        OutboundAuthorizerAuthorizerIdentityAuthorizerForUpdateMCPService
+    ] = Field(default=None, alias="IdentityAuthorizer")
     key_auth: Optional[OutboundAuthorizerAuthorizerKeyAuthForUpdateMCPService] = Field(
         default=None, alias="KeyAuth"
     )
 
 
+class OutboundAuthorizerAuthorizerIdentityAuthorizerForUpdateMCPService(MCPBaseModel):
+    credential_provider_name: Optional[str] = Field(
+        default=None, alias="CredentialProviderName"
+    )
+    provider_type: Optional[str] = Field(default=None, alias="ProviderType")
+
+
 class OutboundAuthorizerAuthorizerKeyAuthForUpdateMCPService(MCPBaseModel):
     api_keys: Optional[
         list[OutboundAuthorizerAuthorizerKeyAuthApiKeysItemForUpdateMCPService]
@@ -961,6 +1093,12 @@ class BackendCustomMcpPrivatePackageEnvsItemForUpdateMCPService(MCPBaseModel):
     value: Optional[str] = Field(default=None, alias="Value")
 
 
+class BackendEcsInstancesItemForUpdateMCPService(MCPBaseModel):
+    instance_id: Optional[str] = Field(default=None, alias="InstanceId")
+    ip: Optional[str] = Field(default=None, alias="Ip")
+    port: Optional[int] = Field(default=None, alias="Port")
+
+
 class InboundAuthorizerAuthorizerKeyAuthApiKeysItemForUpdateMCPService(MCPBaseModel):
     key: Optional[str] = Field(default=None, alias="Key")
     name: str = Field(..., alias="Name")
diff --git a/agentkit/sdk/memory/types.py b/agentkit/sdk/memory/types.py
index 3666446..70d59d7 100644
--- a/agentkit/sdk/memory/types.py
+++ b/agentkit/sdk/memory/types.py
@@ -140,6 +140,9 @@ class VpcConfigForGetMemoryCollection(MemoryBaseModel):
 
 
 class VpcConfigurationForListMemoryCollections(MemoryBaseModel):
+    enable_shared_internet_access: Optional[bool] = Field(
+        default=None, alias="EnableSharedInternetAccess"
+    )
     security_group_ids: Optional[list[str]] = Field(
         default=None, alias="SecurityGroupIds"
     )
diff --git a/agentkit/sdk/runtime/types.py b/agentkit/sdk/runtime/types.py
index 461b23b..5f6b745 100644
--- a/agentkit/sdk/runtime/types.py
+++ b/agentkit/sdk/runtime/types.py
@@ -166,11 +166,12 @@ class EnvsForListRuntimes(RuntimeTypeBaseModel):
 
 
 class InstanceItemsForListRuntimeInstances(RuntimeTypeBaseModel):
+    alias_name: Optional[str] = Field(default=None, alias="AliasName")
     create_time: Optional[str] = Field(default=None, alias="CreateTime")
-    function_id: Optional[str] = Field(default=None, alias="FunctionId")
     instance_name: Optional[str] = Field(default=None, alias="InstanceName")
     instance_status: Optional[str] = Field(default=None, alias="InstanceStatus")
     revision_number: Optional[int] = Field(default=None, alias="RevisionNumber")
+    runtime_id: Optional[str] = Field(default=None, alias="RuntimeId")
 
 
 class KeyAuthForGetRuntime(RuntimeTypeBaseModel):
@@ -241,6 +242,9 @@ class TlsConfigurationForListRuntimes(RuntimeTypeBaseModel):
 
 
 class VpcConfigurationForGetRuntime(RuntimeTypeBaseModel):
+    enable_shared_internet_access: Optional[bool] = Field(
+        default=None, alias="EnableSharedInternetAccess"
+    )
     security_group_ids: Optional[list[str]] = Field(
         default=None, alias="SecurityGroupIds"
     )
@@ -249,6 +253,9 @@ class VpcConfigurationForGetRuntime(RuntimeTypeBaseModel):
 
 
 class VpcConfigurationForListRuntimes(RuntimeTypeBaseModel):
+    enable_shared_internet_access: Optional[bool] = Field(
+        default=None, alias="EnableSharedInternetAccess"
+    )
     security_group_ids: Optional[list[str]] = Field(
         default=None, alias="SecurityGroupIds"
     )
@@ -289,6 +296,9 @@ class NetworkForCreateRuntime(RuntimeTypeBaseModel):
 
 
 class NetworkVpcForCreateRuntime(RuntimeTypeBaseModel):
+    enable_shared_internet_access: Optional[bool] = Field(
+        default=None, alias="EnableSharedInternetAccess"
+    )
     subnet_ids: Optional[list[str]] = Field(default=None, alias="SubnetIds")
     vpc_id: str = Field(..., alias="VpcId")
 
@@ -415,9 +425,9 @@ class GetRuntimeCozeTokenResponse(RuntimeTypeBaseModel):
 
 # GetRuntimeInstanceLogs - Request
 class GetRuntimeInstanceLogsRequest(RuntimeTypeBaseModel):
-    function_id: str = Field(..., alias="FunctionId")
     instance_name: str = Field(..., alias="InstanceName")
     limit: Optional[int] = Field(default=None, alias="Limit")
+    runtime_id: str = Field(..., alias="RuntimeId")
 
 
 # GetRuntimeInstanceLogs - Response
diff --git a/agentkit/sdk/tools/types.py b/agentkit/sdk/tools/types.py
index 95803d7..f86d73b 100644
--- a/agentkit/sdk/tools/types.py
+++ b/agentkit/sdk/tools/types.py
@@ -41,6 +41,11 @@ class AuthorizerConfigurationForListTools(ToolsBaseModel):
     key_auth: Optional[KeyAuthForListTools] = Field(default=None, alias="KeyAuth")
 
 
+class CredentialsForGetTool(ToolsBaseModel):
+    access_key_id: Optional[str] = Field(default=None, alias="AccessKeyId")
+    secret_access_key: Optional[str] = Field(default=None, alias="SecretAccessKey")
+
+
 class EnvsForGetTool(ToolsBaseModel):
     key: Optional[str] = Field(default=None, alias="Key")
     value: Optional[str] = Field(default=None, alias="Value")
@@ -63,6 +68,14 @@ class KeyAuthForListTools(ToolsBaseModel):
     api_key_name: Optional[str] = Field(default=None, alias="ApiKeyName")
 
 
+class MountPointsForGetTool(ToolsBaseModel):
+    bucket_name: Optional[str] = Field(default=None, alias="BucketName")
+    bucket_path: Optional[str] = Field(default=None, alias="BucketPath")
+    endpoint: Optional[str] = Field(default=None, alias="Endpoint")
+    local_mount_path: Optional[str] = Field(default=None, alias="LocalMountPath")
+    read_only: Optional[bool] = Field(default=None, alias="ReadOnly")
+
+
 class NetworkConfigurationsForGetTool(ToolsBaseModel):
     endpoint: Optional[str] = Field(default=None, alias="Endpoint")
     network_type: Optional[str] = Field(default=None, alias="NetworkType")
@@ -139,7 +152,20 @@ class ToolsForListTools(ToolsBaseModel):
     updated_at: Optional[str] = Field(default=None, alias="UpdatedAt")
 
 
+class TosMountConfigForGetTool(ToolsBaseModel):
+    credentials: Optional[CredentialsForGetTool] = Field(
+        default=None, alias="Credentials"
+    )
+    enable_tos: Optional[bool] = Field(default=None, alias="EnableTos")
+    mount_points: Optional[list[MountPointsForGetTool]] = Field(
+        default=None, alias="MountPoints"
+    )
+
+
 class VpcConfigurationForGetTool(ToolsBaseModel):
+    enable_shared_internet_access: Optional[bool] = Field(
+        default=None, alias="EnableSharedInternetAccess"
+    )
     security_group_ids: Optional[list[str]] = Field(
         default=None, alias="SecurityGroupIds"
     )
@@ -148,6 +174,9 @@ class VpcConfigurationForGetTool(ToolsBaseModel):
 
 
 class VpcConfigurationForListTools(ToolsBaseModel):
+    enable_shared_internet_access: Optional[bool] = Field(
+        default=None, alias="EnableSharedInternetAccess"
+    )
     security_group_ids: Optional[list[str]] = Field(
         default=None, alias="SecurityGroupIds"
     )
@@ -197,6 +226,9 @@ class NetworkForCreateTool(ToolsBaseModel):
 
 
 class NetworkVpcForCreateTool(ToolsBaseModel):
+    enable_shared_internet_access: Optional[bool] = Field(
+        default=None, alias="EnableSharedInternetAccess"
+    )
     security_group_ids: Optional[list[str]] = Field(
         default=None, alias="SecurityGroupIds"
     )
@@ -210,6 +242,21 @@ class TlsForCreateTool(ToolsBaseModel):
     tls_topic_id: Optional[str] = Field(default=None, alias="TlsTopicId")
 
 
+class TosMountForCreateTool(ToolsBaseModel):
+    credentials: Optional[TosMountCredentialsForCreateTool] = Field(
+        default=None, alias="Credentials"
+    )
+    mount_points: Optional[list[TosMountMountPointsItemForCreateTool]] = Field(
+        default=None, alias="MountPoints"
+    )
+    enable_tos: Optional[bool] = Field(default=None, alias="EnableTos")
+
+
+class TosMountCredentialsForCreateTool(ToolsBaseModel):
+    access_key_id: Optional[str] = Field(default=None, alias="AccessKeyId")
+    secret_access_key: Optional[str] = Field(default=None, alias="SecretAccessKey")
+
+
 class EnvsItemForCreateTool(ToolsBaseModel):
     key: str = Field(..., alias="Key")
     value: Optional[str] = Field(default=None, alias="Value")
@@ -220,6 +267,14 @@ class TagsItemForCreateTool(ToolsBaseModel):
     value: Optional[str] = Field(default=None, alias="Value")
 
 
+class TosMountMountPointsItemForCreateTool(ToolsBaseModel):
+    bucket_name: Optional[str] = Field(default=None, alias="BucketName")
+    bucket_path: Optional[str] = Field(default=None, alias="BucketPath")
+    endpoint: Optional[str] = Field(default=None, alias="Endpoint")
+    local_mount_path: Optional[str] = Field(default=None, alias="LocalMountPath")
+    read_only: Optional[bool] = Field(default=None, alias="ReadOnly")
+
+
 class CreateToolRequest(ToolsBaseModel):
     apmplus_enable: Optional[bool] = Field(default=None, alias="ApmplusEnable")
     command: Optional[str] = Field(default=None, alias="Command")
@@ -239,6 +294,9 @@ class CreateToolRequest(ToolsBaseModel):
     tls_configuration: Optional[TlsForCreateTool] = Field(
         default=None, alias="TlsConfiguration"
     )
+    tos_mount_config: Optional[TosMountForCreateTool] = Field(
+        default=None, alias="TosMountConfig"
+    )
     envs: Optional[list[EnvsItemForCreateTool]] = Field(default=None, alias="Envs")
     tags: Optional[list[TagsItemForCreateTool]] = Field(default=None, alias="Tags")
 
@@ -332,6 +390,9 @@ class GetToolResponse(ToolsBaseModel):
     )
     tool_id: Optional[str] = Field(default=None, alias="ToolId")
     tool_type: Optional[str] = Field(default=None, alias="ToolType")
+    tos_mount_config: Optional[TosMountConfigForGetTool] = Field(
+        default=None, alias="TosMountConfig"
+    )
     updated_at: Optional[str] = Field(default=None, alias="UpdatedAt")
 
 
@@ -417,11 +478,34 @@ class SetSessionTtlResponse(ToolsBaseModel):
 
 
 # UpdateTool - Request
+class TosMountForUpdateTool(ToolsBaseModel):
+    credentials: Optional[TosMountCredentialsForUpdateTool] = Field(
+        default=None, alias="Credentials"
+    )
+    mount_points: Optional[list[TosMountMountPointsItemForUpdateTool]] = Field(
+        default=None, alias="MountPoints"
+    )
+    enable_tos: Optional[bool] = Field(default=None, alias="EnableTos")
+
+
+class TosMountCredentialsForUpdateTool(ToolsBaseModel):
+    access_key_id: Optional[str] = Field(default=None, alias="AccessKeyId")
+    secret_access_key: Optional[str] = Field(default=None, alias="SecretAccessKey")
+
+
 class EnvsItemForUpdateTool(ToolsBaseModel):
     key: str = Field(..., alias="Key")
     value: Optional[str] = Field(default=None, alias="Value")
 
 
+class TosMountMountPointsItemForUpdateTool(ToolsBaseModel):
+    bucket_name: Optional[str] = Field(default=None, alias="BucketName")
+    bucket_path: Optional[str] = Field(default=None, alias="BucketPath")
+    endpoint: Optional[str] = Field(default=None, alias="Endpoint")
+    local_mount_path: Optional[str] = Field(default=None, alias="LocalMountPath")
+    read_only: Optional[bool] = Field(default=None, alias="ReadOnly")
+
+
 class UpdateToolRequest(ToolsBaseModel):
     apmplus_enable: Optional[bool] = Field(default=None, alias="ApmplusEnable")
     command: Optional[str] = Field(default=None, alias="Command")
@@ -430,6 +514,9 @@ class UpdateToolRequest(ToolsBaseModel):
     port: Optional[int] = Field(default=None, alias="Port")
     tool_id: str = Field(..., alias="ToolId")
     tool_type: Optional[str] = Field(default=None, alias="ToolType")
+    tos_mount_config: Optional[TosMountForUpdateTool] = Field(
+        default=None, alias="TosMountConfig"
+    )
     envs: Optional[list[EnvsItemForUpdateTool]] = Field(default=None, alias="Envs")
 
 
diff --git a/agentkit/toolkit/cli/cli_config.py b/agentkit/toolkit/cli/cli_config.py
index 140470c..ba0e3e0 100644
--- a/agentkit/toolkit/cli/cli_config.py
+++ b/agentkit/toolkit/cli/cli_config.py
@@ -201,6 +201,15 @@ def config_command(
         "--runtime-subnet-ids",
         help="Runtime subnet ID (repeatable; cloud/hybrid, CreateRuntime only)",
     ),
+    runtime_enable_shared_internet_access: Optional[bool] = typer.Option(
+        None,
+        "--runtime_enable_shared_internet_access/--no-runtime_enable_shared_internet_access",
+        "--runtime-enable-shared-internet-access/--no-runtime-enable-shared-internet-access",
+        help=(
+            "Enable shared internet egress for Runtime private network "
+            "(cloud/hybrid, CreateRuntime only; effective for private/both)"
+        ),
+    ),
 ):
     """Configure AgentKit (supports interactive and non-interactive modes).
     
@@ -307,6 +316,7 @@ def config_command(
             runtime_network_mode=runtime_network_mode,
             runtime_vpc_id=runtime_vpc_id,
             runtime_subnet_ids=runtime_subnet_ids,
+            runtime_enable_shared_internet_access=runtime_enable_shared_internet_access,
         )
 
         has_cli_params = ConfigParamHandler.has_cli_params(cli_params)
diff --git a/agentkit/toolkit/cli/cli_runtime.py b/agentkit/toolkit/cli/cli_runtime.py
index e2c0be0..7257e2a 100644
--- a/agentkit/toolkit/cli/cli_runtime.py
+++ b/agentkit/toolkit/cli/cli_runtime.py
@@ -36,6 +36,62 @@
 )
 
 
+def _build_network_for_create_runtime(
+    vpc_id: Optional[str],
+    subnet_ids: Optional[str],
+    enable_private_network: bool,
+    enable_public_network: bool,
+    enable_shared_internet_access: bool,
+) -> Optional[rt.NetworkForCreateRuntime]:
+    has_vpc_id = bool((vpc_id or "").strip())
+    has_subnet_ids = bool((subnet_ids or "").strip())
+
+    wants_private_network = (
+        enable_private_network
+        or has_vpc_id
+        or has_subnet_ids
+        or enable_shared_internet_access
+    )
+
+    if enable_shared_internet_access and not wants_private_network:
+        raise ValueError(
+            "enable-shared-internet-access is only effective when private network is enabled."
+        )
+
+    if wants_private_network and not has_vpc_id:
+        raise ValueError(
+            "vpc-id is required when private network is enabled (private/both)."
+        )
+
+    if not wants_private_network and enable_public_network is False:
+        raise ValueError(
+            "At least one network must be enabled. Enable public network or configure private network."
+        )
+
+    should_send_network_configuration = (
+        wants_private_network or enable_public_network is False
+    )
+    if not should_send_network_configuration:
+        return None
+
+    vpc = None
+    if wants_private_network:
+        subs = [s.strip() for s in (subnet_ids or "").split(",") if s.strip()] or None
+        vpc = rt.NetworkVpcForCreateRuntime(
+            vpc_id=(vpc_id or "").strip(),
+            subnet_ids=subs,
+            enable_shared_internet_access=(
+                True if enable_shared_internet_access else None
+            ),
+        )
+
+    return rt.NetworkForCreateRuntime(
+        vpc_configuration=vpc,
+        enable_private_network=wants_private_network,
+        enable_public_network=enable_public_network,
+    )
+
+
 @runtime_app.command("create")
 def create_runtime_command(
     name: str = typer.Option(..., "--name", help="Runtime name"),
@@ -71,7 +127,14 @@ def create_runtime_command(
         False, "--enable-private-network", help="Enable private network"
     ),
     enable_public_network: bool = typer.Option(
-        True, "--enable-public-network", help="Enable public network"
+        True,
+        "--enable-public-network/--no-enable-public-network",
+        help="Enable public network",
+    ),
+    enable_shared_internet_access: bool = typer.Option(
+        False,
+        "--enable-shared-internet-access",
+        help="Enable shared internet egress for private network (effective for private/both)",
     ),
     api_key_name: Optional[str] = typer.Option(
         None, "--apikey-name", help="API key name"
@@ -133,18 +196,13 @@ def create_runtime_command(
                 )
 
             network = None
-            if vpc_id or enable_private_network or enable_public_network:
-                vpc = None
-                if vpc_id:
-                    subs = [
-                        s.strip() for s in (subnet_ids or "").split(",") if s.strip()
-                    ] or None
-                    vpc = rt.NetworkVpcForCreateRuntime(vpc_id=vpc_id, subnet_ids=subs)
-                network = rt.NetworkForCreateRuntime(
-                    vpc_configuration=vpc,
-                    enable_private_network=enable_private_network,
-                    enable_public_network=enable_public_network,
-                )
+            network = _build_network_for_create_runtime(
+                vpc_id=vpc_id,
+                subnet_ids=subnet_ids,
+                enable_private_network=enable_private_network,
+                enable_public_network=enable_public_network,
+                enable_shared_internet_access=enable_shared_internet_access,
+            )
 
             envs = None
             if envs_json:
diff --git a/agentkit/toolkit/config/config_handler.py b/agentkit/toolkit/config/config_handler.py
index 292aa3c..4e98251 100644
--- a/agentkit/toolkit/config/config_handler.py
+++ b/agentkit/toolkit/config/config_handler.py
@@ -110,6 +110,7 @@ def collect_cli_params(
         runtime_network_mode: Optional[str],
         runtime_vpc_id: Optional[str],
         runtime_subnet_ids: Optional[List[str]],
+        runtime_enable_shared_internet_access: Optional[bool],
     ) -> Dict[str, Any]:
         """Collect all CLI parameters.
 
@@ -204,6 +205,10 @@ def collect_cli_params(
             runtime_network["subnet_ids"] = ConfigParamHandler.parse_id_list(
                 runtime_subnet_ids
             )
+        if runtime_enable_shared_internet_access is not None:
+            runtime_network["enable_shared_internet_access"] = (
+                runtime_enable_shared_internet_access
+            )
         if runtime_network:
             strategy_params["runtime_network"] = runtime_network
         if runtime_auth_type is not None:
diff --git a/agentkit/toolkit/config/strategy_configs.py b/agentkit/toolkit/config/strategy_configs.py
index 9e2cf09..fa3a6b1 100644
--- a/agentkit/toolkit/config/strategy_configs.py
+++ b/agentkit/toolkit/config/strategy_configs.py
@@ -323,7 +323,7 @@ class HybridStrategyConfig(AutoSerializableMixin):
         metadata={
             "hidden": True,
             "description": "Runtime network configuration (advanced, CreateRuntime only)",
-            "examples": "{mode: private, vpc_id: vpc-xxx, subnet_ids: [subnet-aaa, subnet-bbb]}",
+            "examples": "{mode: private, vpc_id: vpc-xxx, subnet_ids: [subnet-aaa, subnet-bbb], enable_shared_internet_access: true}",
         },
     )
     _config_metadata = {
@@ -588,7 +588,7 @@ class CloudStrategyConfig(AutoSerializableMixin):
         metadata={
             "hidden": True,
             "description": "Runtime network configuration (advanced, CreateRuntime only)",
-            "examples": "{mode: private, vpc_id: vpc-xxx, subnet_ids: [subnet-aaa, subnet-bbb]}",
+            "examples": "{mode: private, vpc_id: vpc-xxx, subnet_ids: [subnet-aaa, subnet-bbb], enable_shared_internet_access: true}",
         },
     )
 
diff --git a/agentkit/toolkit/runners/ve_agentkit.py b/agentkit/toolkit/runners/ve_agentkit.py
index d33b197..5b1da3b 100644
--- a/agentkit/toolkit/runners/ve_agentkit.py
+++ b/agentkit/toolkit/runners/ve_agentkit.py
@@ -632,6 +632,9 @@ def _build_network_config_for_create(
         mode = runtime_network.get("mode")
         vpc_id = runtime_network.get("vpc_id")
         subnet_ids = runtime_network.get("subnet_ids")
+        enable_shared_internet_access_raw = runtime_network.get(
+            "enable_shared_internet_access"
+        )
 
         # Convenience: if vpc_id is provided without an explicit mode, assume private.
         if mode is None and vpc_id:
@@ -652,6 +655,30 @@ def _build_network_config_for_create(
         enable_public = mode in {"public", "both"}
         enable_private = mode in {"private", "both"}
 
+        enable_shared_internet_access: Optional[bool] = None
+        if enable_shared_internet_access_raw is not None:
+            if isinstance(enable_shared_internet_access_raw, bool):
+                enable_shared_internet_access = enable_shared_internet_access_raw
+            elif isinstance(enable_shared_internet_access_raw, (int, float)):
+                enable_shared_internet_access = bool(enable_shared_internet_access_raw)
+            else:
+                raw_str = str(enable_shared_internet_access_raw).strip().lower()
+                if raw_str in {"true", "1", "yes", "y"}:
+                    enable_shared_internet_access = True
+                elif raw_str in {"false", "0", "no", "n"}:
+                    enable_shared_internet_access = False
+                else:
+                    raise ValueError(
+                        "Invalid runtime_network.enable_shared_internet_access. "
+                        "Valid values: true/false."
+                    )
+
+        if enable_shared_internet_access and not enable_private:
+            raise ValueError(
+                "runtime_network.enable_shared_internet_access is only effective when "
+                "runtime_network.mode is private/both."
+            )
+
         vpc_configuration = None
         if enable_private:
             vpc_id_str = str(vpc_id or "").strip()
@@ -671,6 +698,9 @@ def _build_network_config_for_create(
             vpc_configuration = runtime_types.NetworkVpcForCreateRuntime(
                 vpc_id=vpc_id_str,
                 subnet_ids=parsed_subnet_ids,
+                enable_shared_internet_access=(
+                    True if enable_shared_internet_access else None
+                ),
             )
 
         return runtime_types.NetworkForCreateRuntime(
diff --git a/agentkit/version.py b/agentkit/version.py
index 4e17bbd..93c6bca 100644
--- a/agentkit/version.py
+++ b/agentkit/version.py
@@ -12,4 +12,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-VERSION = "0.4.4"
+VERSION = "0.4.5"
diff --git a/docs/content/2.agentkit-cli/2.commands.md b/docs/content/2.agentkit-cli/2.commands.md
index a05fecd..4d8d37b 100644
--- a/docs/content/2.agentkit-cli/2.commands.md
+++ b/docs/content/2.agentkit-cli/2.commands.md
@@ -537,7 +537,8 @@ launch_types:
 agentkit config \
   --runtime-network-mode private \
   --runtime-vpc-id vpc-xxxxxxxx \
-  --runtime-subnet-id subnet-aaaaaaaa
+  --runtime-subnet-id subnet-aaaaaaaa \
+  --runtime-enable-shared-internet-access
 ```
 
 **YAML 配置格式**（`agentkit.yaml`）：
@@ -548,6 +549,7 @@ launch_types:
     runtime_network:
       mode: private            # public | private | both
       vpc_id: vpc-xxxxxxxx     # private/both 必填
+      enable_shared_internet_access: true  # 仅对 private/both 生效
       subnet_ids:
         - subnet-aaaaaaaa
 ```
@@ -557,6 +559,10 @@ launch_types:
 - `private`：仅私网访问（需要 `vpc_id`）
 - `both`：同时开启公网与私网（需要 `vpc_id`）
 
+`enable_shared_internet_access` 说明：
+- 仅当 `mode` 为 `private` 或 `both` 时生效；开启后 Runtime 将使用平台提供的共享公网出口访问公网
+- 若 `mode=public` 且开启该开关，AgentKit 会报错以避免“看似配置但实际不生效”的误用
+
 ### 控制选项
 
 | 选项 | 说明 |
@@ -1826,4 +1832,4 @@ agentkit status
 
 - 📖 [配置文件说明](./3.configurations.md) - 深入了解每个配置项
 - 🚀 [快速开始](../1.introduction/3.quickstart.md) - 跟随教程实践
-- ❓ [问题排查](../1.introduction/4.troubleshooting.md) - 更多疑难问题解答
\ No newline at end of file
+- ❓ [问题排查](../1.introduction/4.troubleshooting.md) - 更多疑难问题解答
diff --git a/pyproject.toml b/pyproject.toml
index d360d2a..3f5c770 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "agentkit-sdk-python"
-version = "0.4.4"
+version = "0.4.5"
 description = "Python SDK for transforming any AI agent into a production-ready application. Framework-agnostic primitives for runtime, memory, authentication, and tools with volcengine-managed infrastructure."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -98,6 +98,7 @@ exclude = [
     "build",
     "dist",
     "node_modules",
+    "third-party/",
     "venv",
     "agentkit/toolkit/resources/samples/",
 ]
diff --git a/tests/toolkit/cli/test_cli_runtime_network_config.py b/tests/toolkit/cli/test_cli_runtime_network_config.py
new file mode 100644
index 0000000..44fc825
--- /dev/null
+++ b/tests/toolkit/cli/test_cli_runtime_network_config.py
@@ -0,0 +1,74 @@
+import pytest
+
+
+def test_build_network_none_when_no_user_intent():
+    from agentkit.toolkit.cli.cli_runtime import _build_network_for_create_runtime
+
+    network = _build_network_for_create_runtime(
+        vpc_id=None,
+        subnet_ids=None,
+        enable_private_network=False,
+        enable_public_network=True,
+        enable_shared_internet_access=False,
+    )
+    assert network is None
+
+
+def test_build_network_private_requires_vpc_id():
+    from agentkit.toolkit.cli.cli_runtime import _build_network_for_create_runtime
+
+    with pytest.raises(ValueError):
+        _build_network_for_create_runtime(
+            vpc_id=None,
+            subnet_ids=None,
+            enable_private_network=True,
+            enable_public_network=True,
+            enable_shared_internet_access=False,
+        )
+
+
+def test_build_network_disable_public_requires_private():
+    from agentkit.toolkit.cli.cli_runtime import _build_network_for_create_runtime
+
+    with pytest.raises(ValueError):
+        _build_network_for_create_runtime(
+            vpc_id=None,
+            subnet_ids=None,
+            enable_private_network=False,
+            enable_public_network=False,
+            enable_shared_internet_access=False,
+        )
+
+
+def test_build_network_vpc_id_implies_private_enabled():
+    from agentkit.toolkit.cli.cli_runtime import _build_network_for_create_runtime
+
+    network = _build_network_for_create_runtime(
+        vpc_id="vpc-123",
+        subnet_ids=None,
+        enable_private_network=False,
+        enable_public_network=True,
+        enable_shared_internet_access=False,
+    )
+    assert network is not None
+    assert network.enable_private_network is True
+    assert network.enable_public_network is True
+    assert network.vpc_configuration is not None
+    assert network.vpc_configuration.vpc_id == "vpc-123"
+
+
+def test_build_network_shared_internet_access_sets_vpc_field():
+    from agentkit.toolkit.cli.cli_runtime import _build_network_for_create_runtime
+
+    network = _build_network_for_create_runtime(
+        vpc_id="vpc-123",
+        subnet_ids="subnet-1,subnet-2",
+        enable_private_network=True,
+        enable_public_network=False,
+        enable_shared_internet_access=True,
+    )
+    assert network is not None
+    assert network.enable_private_network is True
+    assert network.enable_public_network is False
+    assert network.vpc_configuration is not None
+    assert network.vpc_configuration.enable_shared_internet_access is True
diff --git a/tests/toolkit/runners/test_ve_agentkit_network_config.py b/tests/toolkit/runners/test_ve_agentkit_network_config.py
new file mode 100644
index 0000000..5dd3c39
--- /dev/null
+++ b/tests/toolkit/runners/test_ve_agentkit_network_config.py
@@ -0,0 +1,66 @@
+import pytest
+
+
+def test_build_network_config_private_with_shared_internet_access_enabled():
+    from agentkit.toolkit.runners.ve_agentkit import (
+        VeAgentkitRuntimeRunner,
+        VeAgentkitRunnerConfig,
+    )
+
+    runner = VeAgentkitRuntimeRunner()
+    cfg = VeAgentkitRunnerConfig(
+        runtime_network={
+            "mode": "private",
+            "vpc_id": "vpc-123",
+            "subnet_ids": ["subnet-1"],
+            "enable_shared_internet_access": True,
+        }
+    )
+
+    network = runner._build_network_config_for_create(cfg)
+    assert network is not None
+    assert network.enable_private_network is True
+    assert network.enable_public_network is False
+    assert network.vpc_configuration is not None
+    assert network.vpc_configuration.enable_shared_internet_access is True
+
+
+def test_build_network_config_public_with_shared_internet_access_enabled_raises():
+    from agentkit.toolkit.runners.ve_agentkit import (
+        VeAgentkitRuntimeRunner,
+        VeAgentkitRunnerConfig,
+    )
+
+    runner = VeAgentkitRuntimeRunner()
+    cfg = VeAgentkitRunnerConfig(
+        runtime_network={
+            "mode": "public",
+            "enable_shared_internet_access": True,
+        }
+    )
+
+    with pytest.raises(ValueError):
+        runner._build_network_config_for_create(cfg)
+
+
+def test_build_network_config_both_with_shared_internet_access_enabled():
+    from agentkit.toolkit.runners.ve_agentkit import (
+        VeAgentkitRuntimeRunner,
+        VeAgentkitRunnerConfig,
+    )
+
+    runner = VeAgentkitRuntimeRunner()
+    cfg = VeAgentkitRunnerConfig(
+        runtime_network={
+            "mode": "both",
+            "vpc_id": "vpc-123",
+            "enable_shared_internet_access": True,
+        }
+    )
+
+    network = runner._build_network_config_for_create(cfg)
+    assert network is not None
+    assert network.enable_private_network is True
+    assert network.enable_public_network is True
+    assert network.vpc_configuration is not None
+    assert network.vpc_configuration.enable_shared_internet_access is True