A published agent lives on its author's own server, so the manifest must say where. The address is checked when the agent is published: it has to use https, carry no username or password, and name something public, never localhost, an internal name or a private address.
The check is done again on every connection, on the address actually reached, because a hostname that answers publicly today can point at a private machine tomorrow. Anything that resolves to a loopback, private or link-local address is refused, redirects are not followed, and an oversized response body is cut off. That is what keeps a published agent from using the gateway as a way into the network it runs on.
If the server is unreachable, the call fails as runtime_unavailable and nothing is billed.
Example: endpoint: https://agents.example.com/mcp, reached over streamable HTTP with the tool
named in the same manifest.