How NVIDIA’s Open‑Source AI‑Q Blueprint Enables Secure, Automated Deep Research on Enterprise Data

Limitations of existing agent frameworks

Frameworks such as Claude Code, Codex, and LangChain Deep Agents manage conversational context and tool execution well, but they cannot aggregate information from many enterprise data sources, perform long‑term analysis, or preserve source attribution. Engineers must write routing modules, connect encrypted databases, handle complex authentication, fine‑tune prompts, and build evaluation mechanisms, resulting in high development effort and maintenance cost.

AI‑Q Blueprint

AI‑Q Blueprint packages the entire deep‑research pipeline into a lightweight, open‑source Agent Skill. Adding the skill to a framework enables the agent to dispatch research tasks to an AI‑Q server (local or cloud) and receive a structured report while keeping enterprise‑sensitive data on‑premise.

Installation

Claude Code example (skill directory creation and linking):

mkdir -p .claude/skills
ln -s ../../.agents/skills/aiq-research .claude/skills/aiq-research

User‑level installation (global skill directory):

mkdir -p ~/.claude/skills
cp -R .agents/skills/aiq-research ~/.claude/skills/aiq-research

Codex installation (replace <codex-skills-dir> with the actual directory):

mkdir -p <codex-skills-dir>
cp -R .agents/skills/aiq-research <codex-skills-dir>/aiq-research

OpenCode installation:

mkdir -p ~/.config/opencode/skills
cp -R .agents/skills/aiq-research ~/.config/opencode/skills/aiq-research

Verify connectivity with the test script: python3 scripts/aiq.py The script confirms that the agent can route a query (e.g., generate a compliance memo) through the skill module and receive a structured, cited report.

Authentication integration modes

Three modes are documented:

Unauthenticated service node (minimal function_groups entry using streamable-http transport):

function_groups:
  mcp_financial_tools:
    _type: mcp_client
    server:
      transport: streamable-http
      url: ${MCP_SERVER_URL:-http://localhost:9901/mcp}

Service‑account‑based authentication for enterprise environments (provides client_id, client_secret, token URL, and scopes such as enterprise.read):

function_groups:
  mcp_enterprise_tools:
    _type: mcp_client
    server:
      transport: streamable-http
      url: ${ENTERPRISE_MCP_URL}
    auth_provider: enterprise_service_account
    authentication:
      enterprise_service_account:
        _type: mcp_service_account
        client_id: ${SERVICE_ACCOUNT_CLIENT_ID}
        client_secret: ${SERVICE_ACCOUNT_CLIENT_SECRET}
        token_url: ${SERVICE_ACCOUNT_TOKEN_URL}
        scopes:
          - enterprise.read

Dual‑token mode for gateways that require both OAuth2 token and a service token; the token is added via the service_token header.

The API aiq_agent.auth.get_auth_token() captures the request credential at submission time and restores it in asynchronous Dask workers, preserving user identity throughout the research process.

Data sovereignty and deployment

The entire stack (code, Docker Compose files, Helm charts) can be deployed close to the data source: on a developer’s laptop, a local Kubernetes cluster, or an air‑gapped data center. Models, including NVIDIA’s open‑source Nemotron, run locally via NIM (NVIDIA Inference Microservice). Optional cloud models can be invoked for cost‑effective scaling. All outputs carry precise source citations and OpenTelemetry traces, enabling auditors to trace each conclusion back to the originating documents.

Research pipeline stages

The pipeline consists of four filtering stages:

Intent classifier determines the required depth of analysis.

Human‑in‑the‑loop clarification step for ambiguous commands.

Shallow researcher handles simple queries.

Deep researcher performs multi‑source synthesis for complex tasks.

Each stage has been independently tuned on benchmarks such as FreshQA, Deep Research Bench, and DeepSearchQA. Evaluation tools are shipped with the blueprint for custom scoring on proprietary data.

Open‑source availability

Source code and release artifacts are hosted at:

https://github.com/NVIDIA-AI-Blueprints/aiq

References

https://developer.nvidia.com/blog/add-a-specialized-deep-research-skill-to-agent-harnesses

https://x.com/NVIDIAAI/status/2057855521193881773