diff --git a/.github/workflows/openvmm-ci.yaml b/.github/workflows/openvmm-ci.yaml
index 74b9d1b04c..90cc8b81ec 100644
--- a/.github/workflows/openvmm-ci.yaml
+++ b/.github/workflows/openvmm-ci.yaml
@@ -1905,7 +1905,7 @@ jobs:
     - name: 🌼📦 Download artifacts
       uses: actions/download-artifact@v4
       with:
-        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-12,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
+        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-12,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-test_igvm_agent_rpc_server,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
         path: ${{ runner.temp }}/used_artifacts/
     - run: echo "${{ runner.temp }}/used_artifacts/_internal-flowey-bootstrap-x86_64-windows-uid-12" >> $GITHUB_PATH
       shell: bash
@@ -1933,6 +1933,7 @@ jobs:
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-openvmm" | flowey.exe v 16 'artifact_use_from_x64-windows-openvmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-pipette" | flowey.exe v 16 'artifact_use_from_x64-windows-pipette' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-prep_steps" | flowey.exe v 16 'artifact_use_from_x64-windows-prep_steps' --is-raw-string update
+        echo "${{ runner.temp }}\\used_artifacts\\x64-windows-test_igvm_agent_rpc_server" | flowey.exe v 16 'artifact_use_from_x64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tmk_vmm" | flowey.exe v 16 'artifact_use_from_x64-windows-tmk_vmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tpm_guest_tests" | flowey.exe v 16 'artifact_use_from_x64-windows-tpm_guest_tests' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-vmgstool" | flowey.exe v 16 'artifact_use_from_x64-windows-vmgstool' --is-raw-string update
@@ -1944,12 +1945,13 @@ jobs:
         flowey.exe e 16 flowey_core::pipeline::artifact::resolve 6
         flowey.exe e 16 flowey_core::pipeline::artifact::resolve 1
         flowey.exe e 16 flowey_core::pipeline::artifact::resolve 0
-        flowey.exe e 16 flowey_core::pipeline::artifact::resolve 8
+        flowey.exe e 16 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 16 flowey_core::pipeline::artifact::resolve 2
         flowey.exe e 16 flowey_core::pipeline::artifact::resolve 4
+        flowey.exe e 16 flowey_core::pipeline::artifact::resolve 11
         flowey.exe e 16 flowey_core::pipeline::artifact::resolve 10
-        flowey.exe e 16 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 16 flowey_core::pipeline::artifact::resolve 3
+        flowey.exe e 16 flowey_core::pipeline::artifact::resolve 8
         flowey.exe e 16 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: resolve OpenHCL igvm artifact
@@ -2106,7 +2108,7 @@ jobs:
         flowey.exe e 16 flowey_lib_hvlite::git_checkout_openvmm_repo 0
         flowey.exe e 16 flowey_lib_hvlite::run_cargo_nextest_run 0
         flowey.exe e 16 flowey_lib_hvlite::run_cargo_nextest_run 1
-        flowey.exe e 16 flowey_core::pipeline::artifact::resolve 11
+        flowey.exe e 16 flowey_core::pipeline::artifact::resolve 12
         flowey.exe e 16 flowey_lib_hvlite::test_nextest_vmm_tests_archive 0
       shell: bash
     - name: generate nextest command
@@ -2115,6 +2117,9 @@ jobs:
     - name: install vmm tests deps (windows)
       run: flowey.exe e 16 flowey_lib_hvlite::install_vmm_tests_deps 0
       shell: bash
+    - name: starting test_igvm_agent_rpc_server
+      run: flowey.exe e 16 flowey_lib_hvlite::run_test_igvm_agent_rpc_server 0
+      shell: bash
     - name: run 'vmm_tests' nextest tests
       run: |-
         flowey.exe e 16 flowey_lib_common::run_cargo_nextest_run 0
@@ -2183,7 +2188,7 @@ jobs:
     - name: 🌼📦 Download artifacts
       uses: actions/download-artifact@v4
       with:
-        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-12,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
+        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-12,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-test_igvm_agent_rpc_server,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
         path: ${{ runner.temp }}/used_artifacts/
     - run: echo "${{ runner.temp }}/used_artifacts/_internal-flowey-bootstrap-x86_64-windows-uid-12" >> $GITHUB_PATH
       shell: bash
@@ -2211,6 +2216,7 @@ jobs:
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-openvmm" | flowey.exe v 17 'artifact_use_from_x64-windows-openvmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-pipette" | flowey.exe v 17 'artifact_use_from_x64-windows-pipette' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-prep_steps" | flowey.exe v 17 'artifact_use_from_x64-windows-prep_steps' --is-raw-string update
+        echo "${{ runner.temp }}\\used_artifacts\\x64-windows-test_igvm_agent_rpc_server" | flowey.exe v 17 'artifact_use_from_x64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tmk_vmm" | flowey.exe v 17 'artifact_use_from_x64-windows-tmk_vmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tpm_guest_tests" | flowey.exe v 17 'artifact_use_from_x64-windows-tpm_guest_tests' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-vmgstool" | flowey.exe v 17 'artifact_use_from_x64-windows-vmgstool' --is-raw-string update
@@ -2222,12 +2228,13 @@ jobs:
         flowey.exe e 17 flowey_core::pipeline::artifact::resolve 6
         flowey.exe e 17 flowey_core::pipeline::artifact::resolve 1
         flowey.exe e 17 flowey_core::pipeline::artifact::resolve 0
-        flowey.exe e 17 flowey_core::pipeline::artifact::resolve 8
+        flowey.exe e 17 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 17 flowey_core::pipeline::artifact::resolve 2
         flowey.exe e 17 flowey_core::pipeline::artifact::resolve 4
+        flowey.exe e 17 flowey_core::pipeline::artifact::resolve 11
         flowey.exe e 17 flowey_core::pipeline::artifact::resolve 10
-        flowey.exe e 17 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 17 flowey_core::pipeline::artifact::resolve 3
+        flowey.exe e 17 flowey_core::pipeline::artifact::resolve 8
         flowey.exe e 17 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: resolve OpenHCL igvm artifact
@@ -2384,15 +2391,18 @@ jobs:
         flowey.exe e 17 flowey_lib_hvlite::git_checkout_openvmm_repo 0
         flowey.exe e 17 flowey_lib_hvlite::run_cargo_nextest_run 0
         flowey.exe e 17 flowey_lib_hvlite::run_cargo_nextest_run 1
-        flowey.exe e 17 flowey_core::pipeline::artifact::resolve 11
+        flowey.exe e 17 flowey_core::pipeline::artifact::resolve 12
         flowey.exe e 17 flowey_lib_hvlite::test_nextest_vmm_tests_archive 0
       shell: bash
     - name: generate nextest command
       run: flowey.exe e 17 flowey_lib_common::gen_cargo_nextest_run_cmd 0
       shell: bash
     - name: install vmm tests deps (windows)
+      run: flowey.exe e 17 flowey_lib_hvlite::install_vmm_tests_deps 0
+      shell: bash
+    - name: starting test_igvm_agent_rpc_server
       run: |-
-        flowey.exe e 17 flowey_lib_hvlite::install_vmm_tests_deps 0
+        flowey.exe e 17 flowey_lib_hvlite::run_test_igvm_agent_rpc_server 0
         flowey.exe e 17 flowey_core::pipeline::artifact::resolve 7
       shell: bash
     - name: running vmm_test prep_steps
@@ -2464,7 +2474,7 @@ jobs:
     - name: 🌼📦 Download artifacts
       uses: actions/download-artifact@v4
       with:
-        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-12,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
+        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-12,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-test_igvm_agent_rpc_server,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
         path: ${{ runner.temp }}/used_artifacts/
     - run: echo "${{ runner.temp }}/used_artifacts/_internal-flowey-bootstrap-x86_64-windows-uid-12" >> $GITHUB_PATH
       shell: bash
@@ -2492,6 +2502,7 @@ jobs:
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-openvmm" | flowey.exe v 18 'artifact_use_from_x64-windows-openvmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-pipette" | flowey.exe v 18 'artifact_use_from_x64-windows-pipette' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-prep_steps" | flowey.exe v 18 'artifact_use_from_x64-windows-prep_steps' --is-raw-string update
+        echo "${{ runner.temp }}\\used_artifacts\\x64-windows-test_igvm_agent_rpc_server" | flowey.exe v 18 'artifact_use_from_x64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tmk_vmm" | flowey.exe v 18 'artifact_use_from_x64-windows-tmk_vmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tpm_guest_tests" | flowey.exe v 18 'artifact_use_from_x64-windows-tpm_guest_tests' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-vmgstool" | flowey.exe v 18 'artifact_use_from_x64-windows-vmgstool' --is-raw-string update
@@ -2503,12 +2514,13 @@ jobs:
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 6
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 1
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 0
-        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 8
+        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 2
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 4
+        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 11
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 10
-        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 3
+        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 8
         flowey.exe e 18 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: resolve OpenHCL igvm artifact
@@ -2665,7 +2677,7 @@ jobs:
         flowey.exe e 18 flowey_lib_hvlite::git_checkout_openvmm_repo 0
         flowey.exe e 18 flowey_lib_hvlite::run_cargo_nextest_run 0
         flowey.exe e 18 flowey_lib_hvlite::run_cargo_nextest_run 1
-        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 11
+        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 12
         flowey.exe e 18 flowey_lib_hvlite::test_nextest_vmm_tests_archive 0
       shell: bash
     - name: generate nextest command
@@ -2674,6 +2686,9 @@ jobs:
     - name: install vmm tests deps (windows)
       run: flowey.exe e 18 flowey_lib_hvlite::install_vmm_tests_deps 0
       shell: bash
+    - name: starting test_igvm_agent_rpc_server
+      run: flowey.exe e 18 flowey_lib_hvlite::run_test_igvm_agent_rpc_server 0
+      shell: bash
     - name: run 'vmm_tests' nextest tests
       run: |-
         flowey.exe e 18 flowey_lib_common::run_cargo_nextest_run 0
@@ -2742,7 +2757,7 @@ jobs:
     - name: 🌼📦 Download artifacts
       uses: actions/download-artifact@v4
       with:
-        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-12,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
+        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-12,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-test_igvm_agent_rpc_server,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
         path: ${{ runner.temp }}/used_artifacts/
     - run: echo "${{ runner.temp }}/used_artifacts/_internal-flowey-bootstrap-x86_64-windows-uid-12" >> $GITHUB_PATH
       shell: bash
@@ -2770,6 +2785,7 @@ jobs:
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-openvmm" | flowey.exe v 19 'artifact_use_from_x64-windows-openvmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-pipette" | flowey.exe v 19 'artifact_use_from_x64-windows-pipette' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-prep_steps" | flowey.exe v 19 'artifact_use_from_x64-windows-prep_steps' --is-raw-string update
+        echo "${{ runner.temp }}\\used_artifacts\\x64-windows-test_igvm_agent_rpc_server" | flowey.exe v 19 'artifact_use_from_x64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tmk_vmm" | flowey.exe v 19 'artifact_use_from_x64-windows-tmk_vmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tpm_guest_tests" | flowey.exe v 19 'artifact_use_from_x64-windows-tpm_guest_tests' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-vmgstool" | flowey.exe v 19 'artifact_use_from_x64-windows-vmgstool' --is-raw-string update
@@ -2781,12 +2797,13 @@ jobs:
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 6
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 1
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 0
-        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 8
+        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 2
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 4
+        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 11
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 10
-        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 3
+        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 8
         flowey.exe e 19 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: resolve OpenHCL igvm artifact
@@ -2943,15 +2960,18 @@ jobs:
         flowey.exe e 19 flowey_lib_hvlite::git_checkout_openvmm_repo 0
         flowey.exe e 19 flowey_lib_hvlite::run_cargo_nextest_run 0
         flowey.exe e 19 flowey_lib_hvlite::run_cargo_nextest_run 1
-        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 11
+        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 12
         flowey.exe e 19 flowey_lib_hvlite::test_nextest_vmm_tests_archive 0
       shell: bash
     - name: generate nextest command
       run: flowey.exe e 19 flowey_lib_common::gen_cargo_nextest_run_cmd 0
       shell: bash
     - name: install vmm tests deps (windows)
+      run: flowey.exe e 19 flowey_lib_hvlite::install_vmm_tests_deps 0
+      shell: bash
+    - name: starting test_igvm_agent_rpc_server
       run: |-
-        flowey.exe e 19 flowey_lib_hvlite::install_vmm_tests_deps 0
+        flowey.exe e 19 flowey_lib_hvlite::run_test_igvm_agent_rpc_server 0
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 7
       shell: bash
     - name: running vmm_test prep_steps
@@ -3266,12 +3286,12 @@ jobs:
       shell: bash
     - name: creating new test content dir
       run: |-
-        flowey e 20 flowey_core::pipeline::artifact::resolve 3
-        flowey e 20 flowey_core::pipeline::artifact::resolve 6
         flowey e 20 flowey_core::pipeline::artifact::resolve 1
         flowey e 20 flowey_core::pipeline::artifact::resolve 0
         flowey e 20 flowey_core::pipeline::artifact::resolve 2
         flowey e 20 flowey_core::pipeline::artifact::resolve 5
+        flowey e 20 flowey_core::pipeline::artifact::resolve 3
+        flowey e 20 flowey_core::pipeline::artifact::resolve 6
         flowey e 20 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: create azcopy cache dir
@@ -3591,6 +3611,7 @@ jobs:
       shell: bash
     - name: creating new test content dir
       run: |-
+        flowey.exe e 21 flowey_core::pipeline::artifact::resolve 4
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 5
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 1
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 0
@@ -3598,7 +3619,6 @@ jobs:
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 2
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 3
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 7
-        flowey.exe e 21 flowey_core::pipeline::artifact::resolve 4
         flowey.exe e 21 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: resolve OpenHCL igvm artifact
@@ -3764,6 +3784,9 @@ jobs:
     - name: install vmm tests deps (windows)
       run: flowey.exe e 21 flowey_lib_hvlite::install_vmm_tests_deps 0
       shell: bash
+    - name: starting test_igvm_agent_rpc_server
+      run: flowey.exe e 21 flowey_lib_hvlite::run_test_igvm_agent_rpc_server 0
+      shell: bash
     - name: run 'vmm_tests' nextest tests
       run: |-
         flowey.exe e 21 flowey_lib_common::run_cargo_nextest_run 0
@@ -4005,6 +4028,8 @@ jobs:
         echo "${{ runner.temp }}\\publish_artifacts\\aarch64-windows-pipette" | flowey.exe v 3 'artifact_publish_from_aarch64-windows-pipette' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/aarch64-windows-prep_steps"
         echo "${{ runner.temp }}\\publish_artifacts\\aarch64-windows-prep_steps" | flowey.exe v 3 'artifact_publish_from_aarch64-windows-prep_steps' --is-raw-string update
+        mkdir -p "$AgentTempDirNormal/publish_artifacts/aarch64-windows-test_igvm_agent_rpc_server"
+        echo "${{ runner.temp }}\\publish_artifacts\\aarch64-windows-test_igvm_agent_rpc_server" | flowey.exe v 3 'artifact_publish_from_aarch64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/aarch64-windows-tmk_vmm"
         echo "${{ runner.temp }}\\publish_artifacts\\aarch64-windows-tmk_vmm" | flowey.exe v 3 'artifact_publish_from_aarch64-windows-tmk_vmm' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/aarch64-windows-tpm_guest_tests"
@@ -4081,32 +4106,42 @@ jobs:
     - name: symlink protoc
       run: |-
         flowey.exe e 3 flowey_lib_hvlite::init_openvmm_magicpath_protoc 0
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 6
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 7
       shell: bash
     - name: cargo build prep_steps
       run: |-
         flowey.exe e 3 flowey_lib_common::run_cargo_build 2
         flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 2
         flowey.exe e 3 flowey_lib_hvlite::build_prep_steps 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 4
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 3
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 5
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 4
       shell: bash
     - name: cargo build vmgstool
       run: |-
-        flowey.exe e 3 flowey_lib_common::run_cargo_build 5
-        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 7
+        flowey.exe e 3 flowey_lib_common::run_cargo_build 6
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 10
         flowey.exe e 3 flowey_lib_hvlite::build_vmgstool 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 5
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 2
-        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 4
-        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 5
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 6
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 3
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 7
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 8
       shell: bash
     - name: cargo build tpm_guest_tests
       run: |-
-        flowey.exe e 3 flowey_lib_common::run_cargo_build 4
-        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 6
+        flowey.exe e 3 flowey_lib_common::run_cargo_build 5
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 9
         flowey.exe e 3 flowey_lib_hvlite::build_tpm_guest_tests 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 6
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 7
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 1
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 3
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 4
+      shell: bash
+    - name: cargo build test_igvm_agent_rpc_server
+      run: |-
+        flowey.exe e 3 flowey_lib_common::run_cargo_build 3
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 5
+        flowey.exe e 3 flowey_lib_hvlite::build_test_igvm_agent_rpc_server 0
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 0
       shell: bash
     - name: create cargo-nextest cache dir
       run: |-
@@ -4147,31 +4182,31 @@ jobs:
       run: |-
         flowey.exe e 3 flowey_lib_common::run_cargo_nextest_archive 0
         flowey.exe e 3 flowey_lib_hvlite::build_nextest_vmm_tests 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 0
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 4
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 1
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 5
       shell: bash
     - name: cargo build openvmm
       run: |-
         flowey.exe e 3 flowey_lib_common::run_cargo_build 0
         flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 0
         flowey.exe e 3 flowey_lib_hvlite::build_openvmm 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 1
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 5
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 2
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 6
       shell: bash
     - name: cargo build pipette
       run: |-
         flowey.exe e 3 flowey_lib_common::run_cargo_build 1
         flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 1
         flowey.exe e 3 flowey_lib_hvlite::build_pipette 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 2
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 1
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 3
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 2
       shell: bash
     - name: cargo build tmk_vmm
       run: |-
-        flowey.exe e 3 flowey_lib_common::run_cargo_build 3
-        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 3
+        flowey.exe e 3 flowey_lib_common::run_cargo_build 4
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 6
         flowey.exe e 3 flowey_lib_hvlite::build_tmk_vmm 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 3
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 4
       shell: bash
     - name: 'validate cache entry: cargo-nextest'
       run: flowey.exe e 3 flowey_lib_common::cache 3
@@ -4197,6 +4232,12 @@ jobs:
         name: aarch64-windows-prep_steps
         path: ${{ runner.temp }}/publish_artifacts/aarch64-windows-prep_steps/
         include-hidden-files: true
+    - name: 🌼📦 Publish aarch64-windows-test_igvm_agent_rpc_server
+      uses: actions/upload-artifact@v4
+      with:
+        name: aarch64-windows-test_igvm_agent_rpc_server
+        path: ${{ runner.temp }}/publish_artifacts/aarch64-windows-test_igvm_agent_rpc_server/
+        include-hidden-files: true
     - name: 🌼📦 Publish aarch64-windows-tmk_vmm
       uses: actions/upload-artifact@v4
       with:
@@ -4522,6 +4563,8 @@ jobs:
         echo "${{ runner.temp }}\\publish_artifacts\\x64-windows-pipette" | flowey.exe v 5 'artifact_publish_from_x64-windows-pipette' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/x64-windows-prep_steps"
         echo "${{ runner.temp }}\\publish_artifacts\\x64-windows-prep_steps" | flowey.exe v 5 'artifact_publish_from_x64-windows-prep_steps' --is-raw-string update
+        mkdir -p "$AgentTempDirNormal/publish_artifacts/x64-windows-test_igvm_agent_rpc_server"
+        echo "${{ runner.temp }}\\publish_artifacts\\x64-windows-test_igvm_agent_rpc_server" | flowey.exe v 5 'artifact_publish_from_x64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/x64-windows-tmk_vmm"
         echo "${{ runner.temp }}\\publish_artifacts\\x64-windows-tmk_vmm" | flowey.exe v 5 'artifact_publish_from_x64-windows-tmk_vmm' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/x64-windows-tpm_guest_tests"
@@ -4598,7 +4641,7 @@ jobs:
     - name: symlink protoc
       run: |-
         flowey.exe e 5 flowey_lib_hvlite::init_openvmm_magicpath_protoc 0
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 4
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 5
       shell: bash
     - name: cargo build openvmm
       run: |-
@@ -4606,7 +4649,7 @@ jobs:
         flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 0
         flowey.exe e 5 flowey_lib_hvlite::build_openvmm 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 0
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 5
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 6
       shell: bash
     - name: cargo build pipette
       run: |-
@@ -4614,15 +4657,15 @@ jobs:
         flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 1
         flowey.exe e 5 flowey_lib_hvlite::build_pipette 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 1
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 1
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 2
       shell: bash
     - name: cargo build tmk_vmm
       run: |-
-        flowey.exe e 5 flowey_lib_common::run_cargo_build 3
-        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 3
+        flowey.exe e 5 flowey_lib_common::run_cargo_build 4
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 6
         flowey.exe e 5 flowey_lib_hvlite::build_tmk_vmm 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 2
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 6
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 7
       shell: bash
     - name: cargo build prep_steps
       run: |-
@@ -4630,24 +4673,34 @@ jobs:
         flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 2
         flowey.exe e 5 flowey_lib_hvlite::build_prep_steps 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 3
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 3
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 4
       shell: bash
     - name: cargo build vmgstool
       run: |-
-        flowey.exe e 5 flowey_lib_common::run_cargo_build 5
-        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 7
+        flowey.exe e 5 flowey_lib_common::run_cargo_build 6
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 10
         flowey.exe e 5 flowey_lib_hvlite::build_vmgstool 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 4
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 2
-        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 4
-        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 5
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 3
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 7
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 8
       shell: bash
     - name: cargo build tpm_guest_tests
       run: |-
-        flowey.exe e 5 flowey_lib_common::run_cargo_build 4
-        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 6
+        flowey.exe e 5 flowey_lib_common::run_cargo_build 5
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 9
         flowey.exe e 5 flowey_lib_hvlite::build_tpm_guest_tests 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 5
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 1
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 3
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 4
+      shell: bash
+    - name: cargo build test_igvm_agent_rpc_server
+      run: |-
+        flowey.exe e 5 flowey_lib_common::run_cargo_build 3
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 5
+        flowey.exe e 5 flowey_lib_hvlite::build_test_igvm_agent_rpc_server 0
+        flowey.exe e 5 flowey_core::pipeline::artifact::publish 6
       shell: bash
     - name: create cargo-nextest cache dir
       run: |-
@@ -4688,7 +4741,7 @@ jobs:
       run: |-
         flowey.exe e 5 flowey_lib_common::run_cargo_nextest_archive 0
         flowey.exe e 5 flowey_lib_hvlite::build_nextest_vmm_tests 0
-        flowey.exe e 5 flowey_core::pipeline::artifact::publish 6
+        flowey.exe e 5 flowey_core::pipeline::artifact::publish 7
       shell: bash
     - name: 'validate cache entry: cargo-nextest'
       run: flowey.exe e 5 flowey_lib_common::cache 3
@@ -4714,6 +4767,12 @@ jobs:
         name: x64-windows-prep_steps
         path: ${{ runner.temp }}/publish_artifacts/x64-windows-prep_steps/
         include-hidden-files: true
+    - name: 🌼📦 Publish x64-windows-test_igvm_agent_rpc_server
+      uses: actions/upload-artifact@v4
+      with:
+        name: x64-windows-test_igvm_agent_rpc_server
+        path: ${{ runner.temp }}/publish_artifacts/x64-windows-test_igvm_agent_rpc_server/
+        include-hidden-files: true
     - name: 🌼📦 Publish x64-windows-tmk_vmm
       uses: actions/upload-artifact@v4
       with:
diff --git a/.github/workflows/openvmm-pr-release.yaml b/.github/workflows/openvmm-pr-release.yaml
index 6c14bab751..8a0b99f061 100644
--- a/.github/workflows/openvmm-pr-release.yaml
+++ b/.github/workflows/openvmm-pr-release.yaml
@@ -1914,7 +1914,7 @@ jobs:
     - name: 🌼📦 Download artifacts
       uses: actions/download-artifact@v4
       with:
-        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-12,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
+        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-12,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-test_igvm_agent_rpc_server,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
         path: ${{ runner.temp }}/used_artifacts/
     - run: echo "${{ runner.temp }}/used_artifacts/_internal-flowey-bootstrap-x86_64-windows-uid-12" >> $GITHUB_PATH
       shell: bash
@@ -1942,6 +1942,7 @@ jobs:
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-openvmm" | flowey.exe v 16 'artifact_use_from_x64-windows-openvmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-pipette" | flowey.exe v 16 'artifact_use_from_x64-windows-pipette' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-prep_steps" | flowey.exe v 16 'artifact_use_from_x64-windows-prep_steps' --is-raw-string update
+        echo "${{ runner.temp }}\\used_artifacts\\x64-windows-test_igvm_agent_rpc_server" | flowey.exe v 16 'artifact_use_from_x64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tmk_vmm" | flowey.exe v 16 'artifact_use_from_x64-windows-tmk_vmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tpm_guest_tests" | flowey.exe v 16 'artifact_use_from_x64-windows-tpm_guest_tests' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-vmgstool" | flowey.exe v 16 'artifact_use_from_x64-windows-vmgstool' --is-raw-string update
@@ -1953,12 +1954,13 @@ jobs:
         flowey.exe e 16 flowey_core::pipeline::artifact::resolve 6
         flowey.exe e 16 flowey_core::pipeline::artifact::resolve 1
         flowey.exe e 16 flowey_core::pipeline::artifact::resolve 0
-        flowey.exe e 16 flowey_core::pipeline::artifact::resolve 8
+        flowey.exe e 16 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 16 flowey_core::pipeline::artifact::resolve 2
         flowey.exe e 16 flowey_core::pipeline::artifact::resolve 4
+        flowey.exe e 16 flowey_core::pipeline::artifact::resolve 11
         flowey.exe e 16 flowey_core::pipeline::artifact::resolve 10
-        flowey.exe e 16 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 16 flowey_core::pipeline::artifact::resolve 3
+        flowey.exe e 16 flowey_core::pipeline::artifact::resolve 8
         flowey.exe e 16 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: resolve OpenHCL igvm artifact
@@ -2115,7 +2117,7 @@ jobs:
         flowey.exe e 16 flowey_lib_hvlite::git_checkout_openvmm_repo 0
         flowey.exe e 16 flowey_lib_hvlite::run_cargo_nextest_run 0
         flowey.exe e 16 flowey_lib_hvlite::run_cargo_nextest_run 1
-        flowey.exe e 16 flowey_core::pipeline::artifact::resolve 11
+        flowey.exe e 16 flowey_core::pipeline::artifact::resolve 12
         flowey.exe e 16 flowey_lib_hvlite::test_nextest_vmm_tests_archive 0
       shell: bash
     - name: generate nextest command
@@ -2124,6 +2126,9 @@ jobs:
     - name: install vmm tests deps (windows)
       run: flowey.exe e 16 flowey_lib_hvlite::install_vmm_tests_deps 0
       shell: bash
+    - name: starting test_igvm_agent_rpc_server
+      run: flowey.exe e 16 flowey_lib_hvlite::run_test_igvm_agent_rpc_server 0
+      shell: bash
     - name: run 'vmm_tests' nextest tests
       run: |-
         flowey.exe e 16 flowey_lib_common::run_cargo_nextest_run 0
@@ -2192,7 +2197,7 @@ jobs:
     - name: 🌼📦 Download artifacts
       uses: actions/download-artifact@v4
       with:
-        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-12,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
+        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-12,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-test_igvm_agent_rpc_server,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
         path: ${{ runner.temp }}/used_artifacts/
     - run: echo "${{ runner.temp }}/used_artifacts/_internal-flowey-bootstrap-x86_64-windows-uid-12" >> $GITHUB_PATH
       shell: bash
@@ -2220,6 +2225,7 @@ jobs:
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-openvmm" | flowey.exe v 17 'artifact_use_from_x64-windows-openvmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-pipette" | flowey.exe v 17 'artifact_use_from_x64-windows-pipette' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-prep_steps" | flowey.exe v 17 'artifact_use_from_x64-windows-prep_steps' --is-raw-string update
+        echo "${{ runner.temp }}\\used_artifacts\\x64-windows-test_igvm_agent_rpc_server" | flowey.exe v 17 'artifact_use_from_x64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tmk_vmm" | flowey.exe v 17 'artifact_use_from_x64-windows-tmk_vmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tpm_guest_tests" | flowey.exe v 17 'artifact_use_from_x64-windows-tpm_guest_tests' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-vmgstool" | flowey.exe v 17 'artifact_use_from_x64-windows-vmgstool' --is-raw-string update
@@ -2231,12 +2237,13 @@ jobs:
         flowey.exe e 17 flowey_core::pipeline::artifact::resolve 6
         flowey.exe e 17 flowey_core::pipeline::artifact::resolve 1
         flowey.exe e 17 flowey_core::pipeline::artifact::resolve 0
-        flowey.exe e 17 flowey_core::pipeline::artifact::resolve 8
+        flowey.exe e 17 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 17 flowey_core::pipeline::artifact::resolve 2
         flowey.exe e 17 flowey_core::pipeline::artifact::resolve 4
+        flowey.exe e 17 flowey_core::pipeline::artifact::resolve 11
         flowey.exe e 17 flowey_core::pipeline::artifact::resolve 10
-        flowey.exe e 17 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 17 flowey_core::pipeline::artifact::resolve 3
+        flowey.exe e 17 flowey_core::pipeline::artifact::resolve 8
         flowey.exe e 17 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: resolve OpenHCL igvm artifact
@@ -2393,15 +2400,18 @@ jobs:
         flowey.exe e 17 flowey_lib_hvlite::git_checkout_openvmm_repo 0
         flowey.exe e 17 flowey_lib_hvlite::run_cargo_nextest_run 0
         flowey.exe e 17 flowey_lib_hvlite::run_cargo_nextest_run 1
-        flowey.exe e 17 flowey_core::pipeline::artifact::resolve 11
+        flowey.exe e 17 flowey_core::pipeline::artifact::resolve 12
         flowey.exe e 17 flowey_lib_hvlite::test_nextest_vmm_tests_archive 0
       shell: bash
     - name: generate nextest command
       run: flowey.exe e 17 flowey_lib_common::gen_cargo_nextest_run_cmd 0
       shell: bash
     - name: install vmm tests deps (windows)
+      run: flowey.exe e 17 flowey_lib_hvlite::install_vmm_tests_deps 0
+      shell: bash
+    - name: starting test_igvm_agent_rpc_server
       run: |-
-        flowey.exe e 17 flowey_lib_hvlite::install_vmm_tests_deps 0
+        flowey.exe e 17 flowey_lib_hvlite::run_test_igvm_agent_rpc_server 0
         flowey.exe e 17 flowey_core::pipeline::artifact::resolve 7
       shell: bash
     - name: running vmm_test prep_steps
@@ -2473,7 +2483,7 @@ jobs:
     - name: 🌼📦 Download artifacts
       uses: actions/download-artifact@v4
       with:
-        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-12,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
+        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-12,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-test_igvm_agent_rpc_server,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
         path: ${{ runner.temp }}/used_artifacts/
     - run: echo "${{ runner.temp }}/used_artifacts/_internal-flowey-bootstrap-x86_64-windows-uid-12" >> $GITHUB_PATH
       shell: bash
@@ -2501,6 +2511,7 @@ jobs:
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-openvmm" | flowey.exe v 18 'artifact_use_from_x64-windows-openvmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-pipette" | flowey.exe v 18 'artifact_use_from_x64-windows-pipette' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-prep_steps" | flowey.exe v 18 'artifact_use_from_x64-windows-prep_steps' --is-raw-string update
+        echo "${{ runner.temp }}\\used_artifacts\\x64-windows-test_igvm_agent_rpc_server" | flowey.exe v 18 'artifact_use_from_x64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tmk_vmm" | flowey.exe v 18 'artifact_use_from_x64-windows-tmk_vmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tpm_guest_tests" | flowey.exe v 18 'artifact_use_from_x64-windows-tpm_guest_tests' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-vmgstool" | flowey.exe v 18 'artifact_use_from_x64-windows-vmgstool' --is-raw-string update
@@ -2512,12 +2523,13 @@ jobs:
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 6
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 1
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 0
-        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 8
+        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 2
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 4
+        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 11
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 10
-        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 3
+        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 8
         flowey.exe e 18 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: resolve OpenHCL igvm artifact
@@ -2674,7 +2686,7 @@ jobs:
         flowey.exe e 18 flowey_lib_hvlite::git_checkout_openvmm_repo 0
         flowey.exe e 18 flowey_lib_hvlite::run_cargo_nextest_run 0
         flowey.exe e 18 flowey_lib_hvlite::run_cargo_nextest_run 1
-        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 11
+        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 12
         flowey.exe e 18 flowey_lib_hvlite::test_nextest_vmm_tests_archive 0
       shell: bash
     - name: generate nextest command
@@ -2683,6 +2695,9 @@ jobs:
     - name: install vmm tests deps (windows)
       run: flowey.exe e 18 flowey_lib_hvlite::install_vmm_tests_deps 0
       shell: bash
+    - name: starting test_igvm_agent_rpc_server
+      run: flowey.exe e 18 flowey_lib_hvlite::run_test_igvm_agent_rpc_server 0
+      shell: bash
     - name: run 'vmm_tests' nextest tests
       run: |-
         flowey.exe e 18 flowey_lib_common::run_cargo_nextest_run 0
@@ -2751,7 +2766,7 @@ jobs:
     - name: 🌼📦 Download artifacts
       uses: actions/download-artifact@v4
       with:
-        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-12,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
+        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-12,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-test_igvm_agent_rpc_server,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
         path: ${{ runner.temp }}/used_artifacts/
     - run: echo "${{ runner.temp }}/used_artifacts/_internal-flowey-bootstrap-x86_64-windows-uid-12" >> $GITHUB_PATH
       shell: bash
@@ -2779,6 +2794,7 @@ jobs:
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-openvmm" | flowey.exe v 19 'artifact_use_from_x64-windows-openvmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-pipette" | flowey.exe v 19 'artifact_use_from_x64-windows-pipette' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-prep_steps" | flowey.exe v 19 'artifact_use_from_x64-windows-prep_steps' --is-raw-string update
+        echo "${{ runner.temp }}\\used_artifacts\\x64-windows-test_igvm_agent_rpc_server" | flowey.exe v 19 'artifact_use_from_x64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tmk_vmm" | flowey.exe v 19 'artifact_use_from_x64-windows-tmk_vmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tpm_guest_tests" | flowey.exe v 19 'artifact_use_from_x64-windows-tpm_guest_tests' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-vmgstool" | flowey.exe v 19 'artifact_use_from_x64-windows-vmgstool' --is-raw-string update
@@ -2790,12 +2806,13 @@ jobs:
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 6
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 1
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 0
-        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 8
+        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 2
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 4
+        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 11
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 10
-        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 3
+        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 8
         flowey.exe e 19 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: resolve OpenHCL igvm artifact
@@ -2952,15 +2969,18 @@ jobs:
         flowey.exe e 19 flowey_lib_hvlite::git_checkout_openvmm_repo 0
         flowey.exe e 19 flowey_lib_hvlite::run_cargo_nextest_run 0
         flowey.exe e 19 flowey_lib_hvlite::run_cargo_nextest_run 1
-        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 11
+        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 12
         flowey.exe e 19 flowey_lib_hvlite::test_nextest_vmm_tests_archive 0
       shell: bash
     - name: generate nextest command
       run: flowey.exe e 19 flowey_lib_common::gen_cargo_nextest_run_cmd 0
       shell: bash
     - name: install vmm tests deps (windows)
+      run: flowey.exe e 19 flowey_lib_hvlite::install_vmm_tests_deps 0
+      shell: bash
+    - name: starting test_igvm_agent_rpc_server
       run: |-
-        flowey.exe e 19 flowey_lib_hvlite::install_vmm_tests_deps 0
+        flowey.exe e 19 flowey_lib_hvlite::run_test_igvm_agent_rpc_server 0
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 7
       shell: bash
     - name: running vmm_test prep_steps
@@ -3275,12 +3295,12 @@ jobs:
       shell: bash
     - name: creating new test content dir
       run: |-
-        flowey e 20 flowey_core::pipeline::artifact::resolve 3
-        flowey e 20 flowey_core::pipeline::artifact::resolve 6
         flowey e 20 flowey_core::pipeline::artifact::resolve 1
         flowey e 20 flowey_core::pipeline::artifact::resolve 0
         flowey e 20 flowey_core::pipeline::artifact::resolve 2
         flowey e 20 flowey_core::pipeline::artifact::resolve 5
+        flowey e 20 flowey_core::pipeline::artifact::resolve 3
+        flowey e 20 flowey_core::pipeline::artifact::resolve 6
         flowey e 20 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: create azcopy cache dir
@@ -3600,6 +3620,7 @@ jobs:
       shell: bash
     - name: creating new test content dir
       run: |-
+        flowey.exe e 21 flowey_core::pipeline::artifact::resolve 4
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 5
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 1
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 0
@@ -3607,7 +3628,6 @@ jobs:
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 2
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 3
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 7
-        flowey.exe e 21 flowey_core::pipeline::artifact::resolve 4
         flowey.exe e 21 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: resolve OpenHCL igvm artifact
@@ -3773,6 +3793,9 @@ jobs:
     - name: install vmm tests deps (windows)
       run: flowey.exe e 21 flowey_lib_hvlite::install_vmm_tests_deps 0
       shell: bash
+    - name: starting test_igvm_agent_rpc_server
+      run: flowey.exe e 21 flowey_lib_hvlite::run_test_igvm_agent_rpc_server 0
+      shell: bash
     - name: run 'vmm_tests' nextest tests
       run: |-
         flowey.exe e 21 flowey_lib_common::run_cargo_nextest_run 0
@@ -4014,6 +4037,8 @@ jobs:
         echo "${{ runner.temp }}\\publish_artifacts\\aarch64-windows-pipette" | flowey.exe v 3 'artifact_publish_from_aarch64-windows-pipette' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/aarch64-windows-prep_steps"
         echo "${{ runner.temp }}\\publish_artifacts\\aarch64-windows-prep_steps" | flowey.exe v 3 'artifact_publish_from_aarch64-windows-prep_steps' --is-raw-string update
+        mkdir -p "$AgentTempDirNormal/publish_artifacts/aarch64-windows-test_igvm_agent_rpc_server"
+        echo "${{ runner.temp }}\\publish_artifacts\\aarch64-windows-test_igvm_agent_rpc_server" | flowey.exe v 3 'artifact_publish_from_aarch64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/aarch64-windows-tmk_vmm"
         echo "${{ runner.temp }}\\publish_artifacts\\aarch64-windows-tmk_vmm" | flowey.exe v 3 'artifact_publish_from_aarch64-windows-tmk_vmm' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/aarch64-windows-tpm_guest_tests"
@@ -4090,32 +4115,42 @@ jobs:
     - name: symlink protoc
       run: |-
         flowey.exe e 3 flowey_lib_hvlite::init_openvmm_magicpath_protoc 0
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 6
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 7
       shell: bash
     - name: cargo build prep_steps
       run: |-
         flowey.exe e 3 flowey_lib_common::run_cargo_build 2
         flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 2
         flowey.exe e 3 flowey_lib_hvlite::build_prep_steps 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 4
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 3
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 5
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 4
       shell: bash
     - name: cargo build vmgstool
       run: |-
-        flowey.exe e 3 flowey_lib_common::run_cargo_build 5
-        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 7
+        flowey.exe e 3 flowey_lib_common::run_cargo_build 6
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 10
         flowey.exe e 3 flowey_lib_hvlite::build_vmgstool 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 5
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 2
-        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 4
-        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 5
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 6
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 3
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 7
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 8
       shell: bash
     - name: cargo build tpm_guest_tests
       run: |-
-        flowey.exe e 3 flowey_lib_common::run_cargo_build 4
-        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 6
+        flowey.exe e 3 flowey_lib_common::run_cargo_build 5
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 9
         flowey.exe e 3 flowey_lib_hvlite::build_tpm_guest_tests 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 6
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 7
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 1
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 3
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 4
+      shell: bash
+    - name: cargo build test_igvm_agent_rpc_server
+      run: |-
+        flowey.exe e 3 flowey_lib_common::run_cargo_build 3
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 5
+        flowey.exe e 3 flowey_lib_hvlite::build_test_igvm_agent_rpc_server 0
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 0
       shell: bash
     - name: create cargo-nextest cache dir
       run: |-
@@ -4156,31 +4191,31 @@ jobs:
       run: |-
         flowey.exe e 3 flowey_lib_common::run_cargo_nextest_archive 0
         flowey.exe e 3 flowey_lib_hvlite::build_nextest_vmm_tests 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 0
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 4
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 1
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 5
       shell: bash
     - name: cargo build openvmm
       run: |-
         flowey.exe e 3 flowey_lib_common::run_cargo_build 0
         flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 0
         flowey.exe e 3 flowey_lib_hvlite::build_openvmm 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 1
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 5
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 2
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 6
       shell: bash
     - name: cargo build pipette
       run: |-
         flowey.exe e 3 flowey_lib_common::run_cargo_build 1
         flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 1
         flowey.exe e 3 flowey_lib_hvlite::build_pipette 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 2
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 1
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 3
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 2
       shell: bash
     - name: cargo build tmk_vmm
       run: |-
-        flowey.exe e 3 flowey_lib_common::run_cargo_build 3
-        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 3
+        flowey.exe e 3 flowey_lib_common::run_cargo_build 4
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 6
         flowey.exe e 3 flowey_lib_hvlite::build_tmk_vmm 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 3
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 4
       shell: bash
     - name: 'validate cache entry: cargo-nextest'
       run: flowey.exe e 3 flowey_lib_common::cache 3
@@ -4206,6 +4241,12 @@ jobs:
         name: aarch64-windows-prep_steps
         path: ${{ runner.temp }}/publish_artifacts/aarch64-windows-prep_steps/
         include-hidden-files: true
+    - name: 🌼📦 Publish aarch64-windows-test_igvm_agent_rpc_server
+      uses: actions/upload-artifact@v4
+      with:
+        name: aarch64-windows-test_igvm_agent_rpc_server
+        path: ${{ runner.temp }}/publish_artifacts/aarch64-windows-test_igvm_agent_rpc_server/
+        include-hidden-files: true
     - name: 🌼📦 Publish aarch64-windows-tmk_vmm
       uses: actions/upload-artifact@v4
       with:
@@ -4531,6 +4572,8 @@ jobs:
         echo "${{ runner.temp }}\\publish_artifacts\\x64-windows-pipette" | flowey.exe v 5 'artifact_publish_from_x64-windows-pipette' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/x64-windows-prep_steps"
         echo "${{ runner.temp }}\\publish_artifacts\\x64-windows-prep_steps" | flowey.exe v 5 'artifact_publish_from_x64-windows-prep_steps' --is-raw-string update
+        mkdir -p "$AgentTempDirNormal/publish_artifacts/x64-windows-test_igvm_agent_rpc_server"
+        echo "${{ runner.temp }}\\publish_artifacts\\x64-windows-test_igvm_agent_rpc_server" | flowey.exe v 5 'artifact_publish_from_x64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/x64-windows-tmk_vmm"
         echo "${{ runner.temp }}\\publish_artifacts\\x64-windows-tmk_vmm" | flowey.exe v 5 'artifact_publish_from_x64-windows-tmk_vmm' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/x64-windows-tpm_guest_tests"
@@ -4607,7 +4650,7 @@ jobs:
     - name: symlink protoc
       run: |-
         flowey.exe e 5 flowey_lib_hvlite::init_openvmm_magicpath_protoc 0
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 4
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 5
       shell: bash
     - name: cargo build openvmm
       run: |-
@@ -4615,7 +4658,7 @@ jobs:
         flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 0
         flowey.exe e 5 flowey_lib_hvlite::build_openvmm 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 0
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 5
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 6
       shell: bash
     - name: cargo build pipette
       run: |-
@@ -4623,15 +4666,15 @@ jobs:
         flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 1
         flowey.exe e 5 flowey_lib_hvlite::build_pipette 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 1
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 1
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 2
       shell: bash
     - name: cargo build tmk_vmm
       run: |-
-        flowey.exe e 5 flowey_lib_common::run_cargo_build 3
-        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 3
+        flowey.exe e 5 flowey_lib_common::run_cargo_build 4
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 6
         flowey.exe e 5 flowey_lib_hvlite::build_tmk_vmm 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 2
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 6
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 7
       shell: bash
     - name: cargo build prep_steps
       run: |-
@@ -4639,24 +4682,34 @@ jobs:
         flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 2
         flowey.exe e 5 flowey_lib_hvlite::build_prep_steps 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 3
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 3
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 4
       shell: bash
     - name: cargo build vmgstool
       run: |-
-        flowey.exe e 5 flowey_lib_common::run_cargo_build 5
-        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 7
+        flowey.exe e 5 flowey_lib_common::run_cargo_build 6
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 10
         flowey.exe e 5 flowey_lib_hvlite::build_vmgstool 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 4
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 2
-        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 4
-        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 5
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 3
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 7
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 8
       shell: bash
     - name: cargo build tpm_guest_tests
       run: |-
-        flowey.exe e 5 flowey_lib_common::run_cargo_build 4
-        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 6
+        flowey.exe e 5 flowey_lib_common::run_cargo_build 5
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 9
         flowey.exe e 5 flowey_lib_hvlite::build_tpm_guest_tests 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 5
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 1
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 3
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 4
+      shell: bash
+    - name: cargo build test_igvm_agent_rpc_server
+      run: |-
+        flowey.exe e 5 flowey_lib_common::run_cargo_build 3
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 5
+        flowey.exe e 5 flowey_lib_hvlite::build_test_igvm_agent_rpc_server 0
+        flowey.exe e 5 flowey_core::pipeline::artifact::publish 6
       shell: bash
     - name: create cargo-nextest cache dir
       run: |-
@@ -4697,7 +4750,7 @@ jobs:
       run: |-
         flowey.exe e 5 flowey_lib_common::run_cargo_nextest_archive 0
         flowey.exe e 5 flowey_lib_hvlite::build_nextest_vmm_tests 0
-        flowey.exe e 5 flowey_core::pipeline::artifact::publish 6
+        flowey.exe e 5 flowey_core::pipeline::artifact::publish 7
       shell: bash
     - name: 'validate cache entry: cargo-nextest'
       run: flowey.exe e 5 flowey_lib_common::cache 3
@@ -4723,6 +4776,12 @@ jobs:
         name: x64-windows-prep_steps
         path: ${{ runner.temp }}/publish_artifacts/x64-windows-prep_steps/
         include-hidden-files: true
+    - name: 🌼📦 Publish x64-windows-test_igvm_agent_rpc_server
+      uses: actions/upload-artifact@v4
+      with:
+        name: x64-windows-test_igvm_agent_rpc_server
+        path: ${{ runner.temp }}/publish_artifacts/x64-windows-test_igvm_agent_rpc_server/
+        include-hidden-files: true
     - name: 🌼📦 Publish x64-windows-tmk_vmm
       uses: actions/upload-artifact@v4
       with:
diff --git a/.github/workflows/openvmm-pr.yaml b/.github/workflows/openvmm-pr.yaml
index f607300099..5b8ddb6851 100644
--- a/.github/workflows/openvmm-pr.yaml
+++ b/.github/workflows/openvmm-pr.yaml
@@ -2568,7 +2568,7 @@ jobs:
     - name: 🌼📦 Download artifacts
       uses: actions/download-artifact@v4
       with:
-        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-14,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
+        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-14,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-test_igvm_agent_rpc_server,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
         path: ${{ runner.temp }}/used_artifacts/
     - run: echo "${{ runner.temp }}/used_artifacts/_internal-flowey-bootstrap-x86_64-windows-uid-14" >> $GITHUB_PATH
       shell: bash
@@ -2596,6 +2596,7 @@ jobs:
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-openvmm" | flowey.exe v 18 'artifact_use_from_x64-windows-openvmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-pipette" | flowey.exe v 18 'artifact_use_from_x64-windows-pipette' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-prep_steps" | flowey.exe v 18 'artifact_use_from_x64-windows-prep_steps' --is-raw-string update
+        echo "${{ runner.temp }}\\used_artifacts\\x64-windows-test_igvm_agent_rpc_server" | flowey.exe v 18 'artifact_use_from_x64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tmk_vmm" | flowey.exe v 18 'artifact_use_from_x64-windows-tmk_vmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tpm_guest_tests" | flowey.exe v 18 'artifact_use_from_x64-windows-tpm_guest_tests' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-vmgstool" | flowey.exe v 18 'artifact_use_from_x64-windows-vmgstool' --is-raw-string update
@@ -2607,12 +2608,13 @@ jobs:
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 6
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 1
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 0
-        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 8
+        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 2
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 4
+        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 11
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 10
-        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 18 flowey_core::pipeline::artifact::resolve 3
+        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 8
         flowey.exe e 18 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: resolve OpenHCL igvm artifact
@@ -2769,7 +2771,7 @@ jobs:
         flowey.exe e 18 flowey_lib_hvlite::git_checkout_openvmm_repo 0
         flowey.exe e 18 flowey_lib_hvlite::run_cargo_nextest_run 0
         flowey.exe e 18 flowey_lib_hvlite::run_cargo_nextest_run 1
-        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 11
+        flowey.exe e 18 flowey_core::pipeline::artifact::resolve 12
         flowey.exe e 18 flowey_lib_hvlite::test_nextest_vmm_tests_archive 0
       shell: bash
     - name: generate nextest command
@@ -2778,6 +2780,9 @@ jobs:
     - name: install vmm tests deps (windows)
       run: flowey.exe e 18 flowey_lib_hvlite::install_vmm_tests_deps 0
       shell: bash
+    - name: starting test_igvm_agent_rpc_server
+      run: flowey.exe e 18 flowey_lib_hvlite::run_test_igvm_agent_rpc_server 0
+      shell: bash
     - name: run 'vmm_tests' nextest tests
       run: |-
         flowey.exe e 18 flowey_lib_common::run_cargo_nextest_run 0
@@ -2846,7 +2851,7 @@ jobs:
     - name: 🌼📦 Download artifacts
       uses: actions/download-artifact@v4
       with:
-        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-14,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
+        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-14,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-test_igvm_agent_rpc_server,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
         path: ${{ runner.temp }}/used_artifacts/
     - run: echo "${{ runner.temp }}/used_artifacts/_internal-flowey-bootstrap-x86_64-windows-uid-14" >> $GITHUB_PATH
       shell: bash
@@ -2874,6 +2879,7 @@ jobs:
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-openvmm" | flowey.exe v 19 'artifact_use_from_x64-windows-openvmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-pipette" | flowey.exe v 19 'artifact_use_from_x64-windows-pipette' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-prep_steps" | flowey.exe v 19 'artifact_use_from_x64-windows-prep_steps' --is-raw-string update
+        echo "${{ runner.temp }}\\used_artifacts\\x64-windows-test_igvm_agent_rpc_server" | flowey.exe v 19 'artifact_use_from_x64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tmk_vmm" | flowey.exe v 19 'artifact_use_from_x64-windows-tmk_vmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tpm_guest_tests" | flowey.exe v 19 'artifact_use_from_x64-windows-tpm_guest_tests' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-vmgstool" | flowey.exe v 19 'artifact_use_from_x64-windows-vmgstool' --is-raw-string update
@@ -2885,12 +2891,13 @@ jobs:
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 6
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 1
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 0
-        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 8
+        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 2
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 4
+        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 11
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 10
-        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 3
+        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 8
         flowey.exe e 19 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: resolve OpenHCL igvm artifact
@@ -3047,15 +3054,18 @@ jobs:
         flowey.exe e 19 flowey_lib_hvlite::git_checkout_openvmm_repo 0
         flowey.exe e 19 flowey_lib_hvlite::run_cargo_nextest_run 0
         flowey.exe e 19 flowey_lib_hvlite::run_cargo_nextest_run 1
-        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 11
+        flowey.exe e 19 flowey_core::pipeline::artifact::resolve 12
         flowey.exe e 19 flowey_lib_hvlite::test_nextest_vmm_tests_archive 0
       shell: bash
     - name: generate nextest command
       run: flowey.exe e 19 flowey_lib_common::gen_cargo_nextest_run_cmd 0
       shell: bash
     - name: install vmm tests deps (windows)
+      run: flowey.exe e 19 flowey_lib_hvlite::install_vmm_tests_deps 0
+      shell: bash
+    - name: starting test_igvm_agent_rpc_server
       run: |-
-        flowey.exe e 19 flowey_lib_hvlite::install_vmm_tests_deps 0
+        flowey.exe e 19 flowey_lib_hvlite::run_test_igvm_agent_rpc_server 0
         flowey.exe e 19 flowey_core::pipeline::artifact::resolve 7
       shell: bash
     - name: running vmm_test prep_steps
@@ -3341,7 +3351,7 @@ jobs:
     - name: 🌼📦 Download artifacts
       uses: actions/download-artifact@v4
       with:
-        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-14,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
+        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-14,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-test_igvm_agent_rpc_server,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
         path: ${{ runner.temp }}/used_artifacts/
     - run: echo "${{ runner.temp }}/used_artifacts/_internal-flowey-bootstrap-x86_64-windows-uid-14" >> $GITHUB_PATH
       shell: bash
@@ -3369,6 +3379,7 @@ jobs:
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-openvmm" | flowey.exe v 20 'artifact_use_from_x64-windows-openvmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-pipette" | flowey.exe v 20 'artifact_use_from_x64-windows-pipette' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-prep_steps" | flowey.exe v 20 'artifact_use_from_x64-windows-prep_steps' --is-raw-string update
+        echo "${{ runner.temp }}\\used_artifacts\\x64-windows-test_igvm_agent_rpc_server" | flowey.exe v 20 'artifact_use_from_x64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tmk_vmm" | flowey.exe v 20 'artifact_use_from_x64-windows-tmk_vmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tpm_guest_tests" | flowey.exe v 20 'artifact_use_from_x64-windows-tpm_guest_tests' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-vmgstool" | flowey.exe v 20 'artifact_use_from_x64-windows-vmgstool' --is-raw-string update
@@ -3380,12 +3391,13 @@ jobs:
         flowey.exe e 20 flowey_core::pipeline::artifact::resolve 6
         flowey.exe e 20 flowey_core::pipeline::artifact::resolve 1
         flowey.exe e 20 flowey_core::pipeline::artifact::resolve 0
-        flowey.exe e 20 flowey_core::pipeline::artifact::resolve 8
+        flowey.exe e 20 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 20 flowey_core::pipeline::artifact::resolve 2
         flowey.exe e 20 flowey_core::pipeline::artifact::resolve 4
+        flowey.exe e 20 flowey_core::pipeline::artifact::resolve 11
         flowey.exe e 20 flowey_core::pipeline::artifact::resolve 10
-        flowey.exe e 20 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 20 flowey_core::pipeline::artifact::resolve 3
+        flowey.exe e 20 flowey_core::pipeline::artifact::resolve 8
         flowey.exe e 20 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: resolve OpenHCL igvm artifact
@@ -3542,7 +3554,7 @@ jobs:
         flowey.exe e 20 flowey_lib_hvlite::git_checkout_openvmm_repo 0
         flowey.exe e 20 flowey_lib_hvlite::run_cargo_nextest_run 0
         flowey.exe e 20 flowey_lib_hvlite::run_cargo_nextest_run 1
-        flowey.exe e 20 flowey_core::pipeline::artifact::resolve 11
+        flowey.exe e 20 flowey_core::pipeline::artifact::resolve 12
         flowey.exe e 20 flowey_lib_hvlite::test_nextest_vmm_tests_archive 0
       shell: bash
     - name: generate nextest command
@@ -3551,6 +3563,9 @@ jobs:
     - name: install vmm tests deps (windows)
       run: flowey.exe e 20 flowey_lib_hvlite::install_vmm_tests_deps 0
       shell: bash
+    - name: starting test_igvm_agent_rpc_server
+      run: flowey.exe e 20 flowey_lib_hvlite::run_test_igvm_agent_rpc_server 0
+      shell: bash
     - name: run 'vmm_tests' nextest tests
       run: |-
         flowey.exe e 20 flowey_lib_common::run_cargo_nextest_run 0
@@ -3619,7 +3634,7 @@ jobs:
     - name: 🌼📦 Download artifacts
       uses: actions/download-artifact@v4
       with:
-        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-14,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
+        pattern: '{_internal-flowey-bootstrap-x86_64-windows-uid-14,x64-guest_test_uefi,x64-linux-musl-pipette,x64-linux-musl-tmk_vmm,x64-linux-tpm_guest_tests,x64-openhcl-igvm,x64-tmks,x64-windows-openvmm,x64-windows-pipette,x64-windows-prep_steps,x64-windows-test_igvm_agent_rpc_server,x64-windows-tmk_vmm,x64-windows-tpm_guest_tests,x64-windows-vmgstool,x64-windows-vmm-tests-archive}'
         path: ${{ runner.temp }}/used_artifacts/
     - run: echo "${{ runner.temp }}/used_artifacts/_internal-flowey-bootstrap-x86_64-windows-uid-14" >> $GITHUB_PATH
       shell: bash
@@ -3647,6 +3662,7 @@ jobs:
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-openvmm" | flowey.exe v 21 'artifact_use_from_x64-windows-openvmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-pipette" | flowey.exe v 21 'artifact_use_from_x64-windows-pipette' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-prep_steps" | flowey.exe v 21 'artifact_use_from_x64-windows-prep_steps' --is-raw-string update
+        echo "${{ runner.temp }}\\used_artifacts\\x64-windows-test_igvm_agent_rpc_server" | flowey.exe v 21 'artifact_use_from_x64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tmk_vmm" | flowey.exe v 21 'artifact_use_from_x64-windows-tmk_vmm' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-tpm_guest_tests" | flowey.exe v 21 'artifact_use_from_x64-windows-tpm_guest_tests' --is-raw-string update
         echo "${{ runner.temp }}\\used_artifacts\\x64-windows-vmgstool" | flowey.exe v 21 'artifact_use_from_x64-windows-vmgstool' --is-raw-string update
@@ -3658,12 +3674,13 @@ jobs:
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 6
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 1
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 0
-        flowey.exe e 21 flowey_core::pipeline::artifact::resolve 8
+        flowey.exe e 21 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 2
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 4
+        flowey.exe e 21 flowey_core::pipeline::artifact::resolve 11
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 10
-        flowey.exe e 21 flowey_core::pipeline::artifact::resolve 9
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 3
+        flowey.exe e 21 flowey_core::pipeline::artifact::resolve 8
         flowey.exe e 21 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: resolve OpenHCL igvm artifact
@@ -3820,15 +3837,18 @@ jobs:
         flowey.exe e 21 flowey_lib_hvlite::git_checkout_openvmm_repo 0
         flowey.exe e 21 flowey_lib_hvlite::run_cargo_nextest_run 0
         flowey.exe e 21 flowey_lib_hvlite::run_cargo_nextest_run 1
-        flowey.exe e 21 flowey_core::pipeline::artifact::resolve 11
+        flowey.exe e 21 flowey_core::pipeline::artifact::resolve 12
         flowey.exe e 21 flowey_lib_hvlite::test_nextest_vmm_tests_archive 0
       shell: bash
     - name: generate nextest command
       run: flowey.exe e 21 flowey_lib_common::gen_cargo_nextest_run_cmd 0
       shell: bash
     - name: install vmm tests deps (windows)
+      run: flowey.exe e 21 flowey_lib_hvlite::install_vmm_tests_deps 0
+      shell: bash
+    - name: starting test_igvm_agent_rpc_server
       run: |-
-        flowey.exe e 21 flowey_lib_hvlite::install_vmm_tests_deps 0
+        flowey.exe e 21 flowey_lib_hvlite::run_test_igvm_agent_rpc_server 0
         flowey.exe e 21 flowey_core::pipeline::artifact::resolve 7
       shell: bash
     - name: running vmm_test prep_steps
@@ -3929,12 +3949,12 @@ jobs:
       shell: bash
     - name: creating new test content dir
       run: |-
-        flowey e 22 flowey_core::pipeline::artifact::resolve 3
-        flowey e 22 flowey_core::pipeline::artifact::resolve 6
         flowey e 22 flowey_core::pipeline::artifact::resolve 1
         flowey e 22 flowey_core::pipeline::artifact::resolve 0
         flowey e 22 flowey_core::pipeline::artifact::resolve 2
         flowey e 22 flowey_core::pipeline::artifact::resolve 5
+        flowey e 22 flowey_core::pipeline::artifact::resolve 3
+        flowey e 22 flowey_core::pipeline::artifact::resolve 6
         flowey e 22 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: create azcopy cache dir
@@ -4254,6 +4274,7 @@ jobs:
       shell: bash
     - name: creating new test content dir
       run: |-
+        flowey.exe e 23 flowey_core::pipeline::artifact::resolve 4
         flowey.exe e 23 flowey_core::pipeline::artifact::resolve 5
         flowey.exe e 23 flowey_core::pipeline::artifact::resolve 1
         flowey.exe e 23 flowey_core::pipeline::artifact::resolve 0
@@ -4261,7 +4282,6 @@ jobs:
         flowey.exe e 23 flowey_core::pipeline::artifact::resolve 2
         flowey.exe e 23 flowey_core::pipeline::artifact::resolve 3
         flowey.exe e 23 flowey_core::pipeline::artifact::resolve 7
-        flowey.exe e 23 flowey_core::pipeline::artifact::resolve 4
         flowey.exe e 23 flowey_lib_hvlite::_jobs::consume_and_test_nextest_vmm_tests_archive 0
       shell: bash
     - name: resolve OpenHCL igvm artifact
@@ -4427,6 +4447,9 @@ jobs:
     - name: install vmm tests deps (windows)
       run: flowey.exe e 23 flowey_lib_hvlite::install_vmm_tests_deps 0
       shell: bash
+    - name: starting test_igvm_agent_rpc_server
+      run: flowey.exe e 23 flowey_lib_hvlite::run_test_igvm_agent_rpc_server 0
+      shell: bash
     - name: run 'vmm_tests' nextest tests
       run: |-
         flowey.exe e 23 flowey_lib_common::run_cargo_nextest_run 0
@@ -4730,6 +4753,8 @@ jobs:
         echo "${{ runner.temp }}\\publish_artifacts\\aarch64-windows-pipette" | flowey.exe v 3 'artifact_publish_from_aarch64-windows-pipette' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/aarch64-windows-prep_steps"
         echo "${{ runner.temp }}\\publish_artifacts\\aarch64-windows-prep_steps" | flowey.exe v 3 'artifact_publish_from_aarch64-windows-prep_steps' --is-raw-string update
+        mkdir -p "$AgentTempDirNormal/publish_artifacts/aarch64-windows-test_igvm_agent_rpc_server"
+        echo "${{ runner.temp }}\\publish_artifacts\\aarch64-windows-test_igvm_agent_rpc_server" | flowey.exe v 3 'artifact_publish_from_aarch64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/aarch64-windows-tmk_vmm"
         echo "${{ runner.temp }}\\publish_artifacts\\aarch64-windows-tmk_vmm" | flowey.exe v 3 'artifact_publish_from_aarch64-windows-tmk_vmm' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/aarch64-windows-tpm_guest_tests"
@@ -4806,32 +4831,42 @@ jobs:
     - name: symlink protoc
       run: |-
         flowey.exe e 3 flowey_lib_hvlite::init_openvmm_magicpath_protoc 0
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 6
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 7
       shell: bash
     - name: cargo build prep_steps
       run: |-
         flowey.exe e 3 flowey_lib_common::run_cargo_build 2
         flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 2
         flowey.exe e 3 flowey_lib_hvlite::build_prep_steps 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 4
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 3
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 5
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 4
       shell: bash
     - name: cargo build vmgstool
       run: |-
-        flowey.exe e 3 flowey_lib_common::run_cargo_build 5
-        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 7
+        flowey.exe e 3 flowey_lib_common::run_cargo_build 6
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 10
         flowey.exe e 3 flowey_lib_hvlite::build_vmgstool 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 5
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 2
-        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 4
-        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 5
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 6
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 3
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 7
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 8
       shell: bash
     - name: cargo build tpm_guest_tests
       run: |-
-        flowey.exe e 3 flowey_lib_common::run_cargo_build 4
-        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 6
+        flowey.exe e 3 flowey_lib_common::run_cargo_build 5
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 9
         flowey.exe e 3 flowey_lib_hvlite::build_tpm_guest_tests 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 6
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 7
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 1
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 3
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 4
+      shell: bash
+    - name: cargo build test_igvm_agent_rpc_server
+      run: |-
+        flowey.exe e 3 flowey_lib_common::run_cargo_build 3
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 5
+        flowey.exe e 3 flowey_lib_hvlite::build_test_igvm_agent_rpc_server 0
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 0
       shell: bash
     - name: create cargo-nextest cache dir
       run: |-
@@ -4872,31 +4907,31 @@ jobs:
       run: |-
         flowey.exe e 3 flowey_lib_common::run_cargo_nextest_archive 0
         flowey.exe e 3 flowey_lib_hvlite::build_nextest_vmm_tests 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 0
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 4
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 1
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 5
       shell: bash
     - name: cargo build openvmm
       run: |-
         flowey.exe e 3 flowey_lib_common::run_cargo_build 0
         flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 0
         flowey.exe e 3 flowey_lib_hvlite::build_openvmm 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 1
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 5
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 2
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 6
       shell: bash
     - name: cargo build pipette
       run: |-
         flowey.exe e 3 flowey_lib_common::run_cargo_build 1
         flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 1
         flowey.exe e 3 flowey_lib_hvlite::build_pipette 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 2
-        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 1
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 3
+        flowey.exe e 3 flowey_lib_hvlite::init_cross_build 2
       shell: bash
     - name: cargo build tmk_vmm
       run: |-
-        flowey.exe e 3 flowey_lib_common::run_cargo_build 3
-        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 3
+        flowey.exe e 3 flowey_lib_common::run_cargo_build 4
+        flowey.exe e 3 flowey_lib_hvlite::run_cargo_build 6
         flowey.exe e 3 flowey_lib_hvlite::build_tmk_vmm 0
-        flowey.exe e 3 flowey_core::pipeline::artifact::publish 3
+        flowey.exe e 3 flowey_core::pipeline::artifact::publish 4
       shell: bash
     - name: 'validate cache entry: cargo-nextest'
       run: flowey.exe e 3 flowey_lib_common::cache 3
@@ -4922,6 +4957,12 @@ jobs:
         name: aarch64-windows-prep_steps
         path: ${{ runner.temp }}/publish_artifacts/aarch64-windows-prep_steps/
         include-hidden-files: true
+    - name: 🌼📦 Publish aarch64-windows-test_igvm_agent_rpc_server
+      uses: actions/upload-artifact@v4
+      with:
+        name: aarch64-windows-test_igvm_agent_rpc_server
+        path: ${{ runner.temp }}/publish_artifacts/aarch64-windows-test_igvm_agent_rpc_server/
+        include-hidden-files: true
     - name: 🌼📦 Publish aarch64-windows-tmk_vmm
       uses: actions/upload-artifact@v4
       with:
@@ -5247,6 +5288,8 @@ jobs:
         echo "${{ runner.temp }}\\publish_artifacts\\x64-windows-pipette" | flowey.exe v 5 'artifact_publish_from_x64-windows-pipette' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/x64-windows-prep_steps"
         echo "${{ runner.temp }}\\publish_artifacts\\x64-windows-prep_steps" | flowey.exe v 5 'artifact_publish_from_x64-windows-prep_steps' --is-raw-string update
+        mkdir -p "$AgentTempDirNormal/publish_artifacts/x64-windows-test_igvm_agent_rpc_server"
+        echo "${{ runner.temp }}\\publish_artifacts\\x64-windows-test_igvm_agent_rpc_server" | flowey.exe v 5 'artifact_publish_from_x64-windows-test_igvm_agent_rpc_server' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/x64-windows-tmk_vmm"
         echo "${{ runner.temp }}\\publish_artifacts\\x64-windows-tmk_vmm" | flowey.exe v 5 'artifact_publish_from_x64-windows-tmk_vmm' --is-raw-string update
         mkdir -p "$AgentTempDirNormal/publish_artifacts/x64-windows-tpm_guest_tests"
@@ -5323,7 +5366,7 @@ jobs:
     - name: symlink protoc
       run: |-
         flowey.exe e 5 flowey_lib_hvlite::init_openvmm_magicpath_protoc 0
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 4
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 5
       shell: bash
     - name: cargo build openvmm
       run: |-
@@ -5331,7 +5374,7 @@ jobs:
         flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 0
         flowey.exe e 5 flowey_lib_hvlite::build_openvmm 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 0
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 5
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 6
       shell: bash
     - name: cargo build pipette
       run: |-
@@ -5339,15 +5382,15 @@ jobs:
         flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 1
         flowey.exe e 5 flowey_lib_hvlite::build_pipette 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 1
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 1
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 2
       shell: bash
     - name: cargo build tmk_vmm
       run: |-
-        flowey.exe e 5 flowey_lib_common::run_cargo_build 3
-        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 3
+        flowey.exe e 5 flowey_lib_common::run_cargo_build 4
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 6
         flowey.exe e 5 flowey_lib_hvlite::build_tmk_vmm 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 2
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 6
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 7
       shell: bash
     - name: cargo build prep_steps
       run: |-
@@ -5355,24 +5398,34 @@ jobs:
         flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 2
         flowey.exe e 5 flowey_lib_hvlite::build_prep_steps 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 3
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 3
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 4
       shell: bash
     - name: cargo build vmgstool
       run: |-
-        flowey.exe e 5 flowey_lib_common::run_cargo_build 5
-        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 7
+        flowey.exe e 5 flowey_lib_common::run_cargo_build 6
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 10
         flowey.exe e 5 flowey_lib_hvlite::build_vmgstool 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 4
-        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 2
-        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 4
-        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 5
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 3
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 7
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 8
       shell: bash
     - name: cargo build tpm_guest_tests
       run: |-
-        flowey.exe e 5 flowey_lib_common::run_cargo_build 4
-        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 6
+        flowey.exe e 5 flowey_lib_common::run_cargo_build 5
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 9
         flowey.exe e 5 flowey_lib_hvlite::build_tpm_guest_tests 0
         flowey.exe e 5 flowey_core::pipeline::artifact::publish 5
+        flowey.exe e 5 flowey_lib_hvlite::init_cross_build 1
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 3
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 4
+      shell: bash
+    - name: cargo build test_igvm_agent_rpc_server
+      run: |-
+        flowey.exe e 5 flowey_lib_common::run_cargo_build 3
+        flowey.exe e 5 flowey_lib_hvlite::run_cargo_build 5
+        flowey.exe e 5 flowey_lib_hvlite::build_test_igvm_agent_rpc_server 0
+        flowey.exe e 5 flowey_core::pipeline::artifact::publish 6
       shell: bash
     - name: create cargo-nextest cache dir
       run: |-
@@ -5413,7 +5466,7 @@ jobs:
       run: |-
         flowey.exe e 5 flowey_lib_common::run_cargo_nextest_archive 0
         flowey.exe e 5 flowey_lib_hvlite::build_nextest_vmm_tests 0
-        flowey.exe e 5 flowey_core::pipeline::artifact::publish 6
+        flowey.exe e 5 flowey_core::pipeline::artifact::publish 7
       shell: bash
     - name: 'validate cache entry: cargo-nextest'
       run: flowey.exe e 5 flowey_lib_common::cache 3
@@ -5439,6 +5492,12 @@ jobs:
         name: x64-windows-prep_steps
         path: ${{ runner.temp }}/publish_artifacts/x64-windows-prep_steps/
         include-hidden-files: true
+    - name: 🌼📦 Publish x64-windows-test_igvm_agent_rpc_server
+      uses: actions/upload-artifact@v4
+      with:
+        name: x64-windows-test_igvm_agent_rpc_server
+        path: ${{ runner.temp }}/publish_artifacts/x64-windows-test_igvm_agent_rpc_server/
+        include-hidden-files: true
     - name: 🌼📦 Publish x64-windows-tmk_vmm
       uses: actions/upload-artifact@v4
       with:
diff --git a/Cargo.lock b/Cargo.lock
index 28ddc840b1..7edcab89c5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2625,7 +2625,6 @@ name = "guest_emulation_device"
 version = "0.0.0"
 dependencies = [
  "async-trait",
- "base64 0.22.1",
  "disk_backend",
  "disklayer_ram",
  "futures",
@@ -2636,15 +2635,13 @@ dependencies = [
  "inspect",
  "jiff",
  "mesh",
- "openhcl_attestation_protocol",
  "pal_async",
  "parking_lot",
  "power_resources",
- "rsa",
  "scsi_buffers",
  "serde_json",
- "sha2",
  "task_control",
+ "test_igvm_agent_lib",
  "thiserror 2.0.16",
  "tracelimit",
  "tracing",
@@ -7217,6 +7214,40 @@ dependencies = [
  "windows-sys 0.60.2",
 ]
 
+[[package]]
+name = "test_igvm_agent_lib"
+version = "0.0.0"
+dependencies = [
+ "base64 0.22.1",
+ "get_resources",
+ "inspect",
+ "openhcl_attestation_protocol",
+ "rsa",
+ "serde_json",
+ "sha2",
+ "thiserror 2.0.16",
+ "tracing",
+ "zerocopy 0.8.27",
+]
+
+[[package]]
+name = "test_igvm_agent_rpc_server"
+version = "0.0.0"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "clap",
+ "get_resources",
+ "guid",
+ "parking_lot",
+ "serde_json",
+ "test_igvm_agent_lib",
+ "tracing",
+ "tracing-subscriber",
+ "winapi",
+ "windows-sys 0.61.0",
+]
+
 [[package]]
 name = "test_with_tracing"
 version = "0.0.0"
diff --git a/Cargo.toml b/Cargo.toml
index 70550ee604..1311cfd7fb 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -44,6 +44,7 @@ members = [
   # tools
   "petri/make_imc_hive",
   "petri/petri-tool",
+  "vm/devices/get/test_igvm_agent_rpc_server",
   "vm/devices/tpm/tpm_guest_tests",
   "vm/loader/igvmfilegen",
   "vm/vmgs/vmgs_lib",
@@ -224,6 +225,7 @@ get_protocol = { path = "vm/devices/get/get_protocol" }
 get_resources = { path = "vm/devices/get/get_resources" }
 guest_crash_device = { path = "vm/devices/get/guest_crash_device" }
 guest_emulation_device = { path = "vm/devices/get/guest_emulation_device" }
+test_igvm_agent_lib = { path = "vm/devices/get/test_igvm_agent_lib" }
 guest_emulation_log = { path = "vm/devices/get/guest_emulation_log" }
 guest_emulation_transport = { path = "vm/devices/get/guest_emulation_transport" }
 vtl2_settings_proto = { path = "vm/devices/get/vtl2_settings_proto" }
@@ -420,6 +422,7 @@ bitvec = { version = "1.1", default-features = false }
 blocking = "1.2"
 caps = "0.5"
 cargo_toml = "0.22"
+cc = "1.2.34"
 cfg-if = "1"
 clap = "4.2"
 crc32fast = { version = "1.3.2", default-features = false }
diff --git a/flowey/flowey_hvlite/src/pipelines/checkin_gates.rs b/flowey/flowey_hvlite/src/pipelines/checkin_gates.rs
index 144dca7aab..520a2c8884 100644
--- a/flowey/flowey_hvlite/src/pipelines/checkin_gates.rs
+++ b/flowey/flowey_hvlite/src/pipelines/checkin_gates.rs
@@ -255,6 +255,9 @@ impl IntoPipeline for CheckinGatesCli {
             let (pub_tpm_guest_tests, use_tpm_guest_tests_windows) =
                 pipeline.new_typed_artifact(format!("{arch_tag}-windows-tpm_guest_tests"));
 
+            let (pub_test_igvm_agent_rpc_server, use_test_igvm_agent_rpc_server) = pipeline
+                .new_typed_artifact(format!("{arch_tag}-windows-test_igvm_agent_rpc_server"));
+
             // filter off interesting artifacts required by the VMM tests job
             match arch {
                 CommonArch::X86_64 => {
@@ -268,6 +271,8 @@ impl IntoPipeline for CheckinGatesCli {
                     vmm_tests_artifacts_windows_x86.use_vmgstool = Some(use_vmgstool.clone());
                     vmm_tests_artifacts_windows_x86.use_tpm_guest_tests_windows =
                         Some(use_tpm_guest_tests_windows.clone());
+                    vmm_tests_artifacts_windows_x86.use_test_igvm_agent_rpc_server =
+                        Some(use_test_igvm_agent_rpc_server.clone());
                 }
                 CommonArch::Aarch64 => {
                     vmm_tests_artifacts_windows_aarch64.use_openvmm = Some(use_openvmm.clone());
@@ -403,7 +408,18 @@ impl IntoPipeline for CheckinGatesCli {
                     },
                     profile: CommonProfile::from_release(release),
                     tpm_guest_tests: ctx.publish_typed_artifact(pub_tpm_guest_tests),
-                });
+                })
+                .dep_on(
+                    |ctx| flowey_lib_hvlite::build_test_igvm_agent_rpc_server::Request {
+                        target: CommonTriple::Common {
+                            arch,
+                            platform: CommonPlatform::WindowsMsvc,
+                        },
+                        profile: CommonProfile::from_release(release),
+                        test_igvm_agent_rpc_server: ctx
+                            .publish_typed_artifact(pub_test_igvm_agent_rpc_server),
+                    },
+                );
 
             // Hang building the windows VMM tests off this big windows job.
             match arch {
@@ -1186,6 +1202,7 @@ mod vmm_tests_artifact_builders {
     use flowey_lib_hvlite::build_openvmm::OpenvmmOutput;
     use flowey_lib_hvlite::build_pipette::PipetteOutput;
     use flowey_lib_hvlite::build_prep_steps::PrepStepsOutput;
+    use flowey_lib_hvlite::build_test_igvm_agent_rpc_server::TestIgvmAgentRpcServerOutput;
     use flowey_lib_hvlite::build_tmk_vmm::TmkVmmOutput;
     use flowey_lib_hvlite::build_tmks::TmksOutput;
     use flowey_lib_hvlite::build_tpm_guest_tests::TpmGuestTestsOutput;
@@ -1239,6 +1256,7 @@ mod vmm_tests_artifact_builders {
                 vmgstool: None,
                 tpm_guest_tests_windows: None,
                 tpm_guest_tests_linux: None,
+                test_igvm_agent_rpc_server: None,
             }))
         }
     }
@@ -1253,6 +1271,7 @@ mod vmm_tests_artifact_builders {
         pub use_vmgstool: Option<UseTypedArtifact<VmgstoolOutput>>,
         pub use_tpm_guest_tests_windows: Option<UseTypedArtifact<TpmGuestTestsOutput>>,
         pub use_tpm_guest_tests_linux: Option<UseTypedArtifact<TpmGuestTestsOutput>>,
+        pub use_test_igvm_agent_rpc_server: Option<UseTypedArtifact<TestIgvmAgentRpcServerOutput>>,
         // linux build machine
         pub use_openhcl_igvm_files: Option<UseArtifact>,
         pub use_pipette_linux_musl: Option<UseTypedArtifact<PipetteOutput>>,
@@ -1277,6 +1296,7 @@ mod vmm_tests_artifact_builders {
                 use_vmgstool,
                 use_tpm_guest_tests_windows,
                 use_tpm_guest_tests_linux,
+                use_test_igvm_agent_rpc_server,
             } = self;
 
             let use_openvmm = use_openvmm.ok_or("openvmm")?;
@@ -1293,6 +1313,8 @@ mod vmm_tests_artifact_builders {
                 use_tpm_guest_tests_windows.ok_or("tpm_guest_tests_windows")?;
             let use_tpm_guest_tests_linux =
                 use_tpm_guest_tests_linux.ok_or("tpm_guest_tests_linux")?;
+            let use_test_igvm_agent_rpc_server =
+                use_test_igvm_agent_rpc_server.ok_or("test_igvm_agent_rpc_server")?;
 
             Ok(Box::new(move |ctx| VmmTestsDepArtifacts {
                 openvmm: Some(ctx.use_typed_artifact(&use_openvmm)),
@@ -1307,6 +1329,9 @@ mod vmm_tests_artifact_builders {
                 vmgstool: Some(ctx.use_typed_artifact(&use_vmgstool)),
                 tpm_guest_tests_windows: Some(ctx.use_typed_artifact(&use_tpm_guest_tests_windows)),
                 tpm_guest_tests_linux: Some(ctx.use_typed_artifact(&use_tpm_guest_tests_linux)),
+                test_igvm_agent_rpc_server: Some(
+                    ctx.use_typed_artifact(&use_test_igvm_agent_rpc_server),
+                ),
             }))
         }
     }
@@ -1364,6 +1389,7 @@ mod vmm_tests_artifact_builders {
                 vmgstool: Some(ctx.use_typed_artifact(&use_vmgstool)),
                 tpm_guest_tests_windows: None,
                 tpm_guest_tests_linux: None,
+                test_igvm_agent_rpc_server: None,
             }))
         }
     }
diff --git a/flowey/flowey_lib_hvlite/src/_jobs/consume_and_test_nextest_vmm_tests_archive.rs b/flowey/flowey_lib_hvlite/src/_jobs/consume_and_test_nextest_vmm_tests_archive.rs
index 7e805f7447..93f2e50ed7 100644
--- a/flowey/flowey_lib_hvlite/src/_jobs/consume_and_test_nextest_vmm_tests_archive.rs
+++ b/flowey/flowey_lib_hvlite/src/_jobs/consume_and_test_nextest_vmm_tests_archive.rs
@@ -8,6 +8,7 @@ use crate::build_nextest_vmm_tests::NextestVmmTestsArchive;
 use crate::build_openvmm::OpenvmmOutput;
 use crate::build_pipette::PipetteOutput;
 use crate::build_prep_steps::PrepStepsOutput;
+use crate::build_test_igvm_agent_rpc_server::TestIgvmAgentRpcServerOutput;
 use crate::build_tmk_vmm::TmkVmmOutput;
 use crate::build_tmks::TmksOutput;
 use crate::build_tpm_guest_tests::TpmGuestTestsOutput;
@@ -32,6 +33,7 @@ pub struct VmmTestsDepArtifacts {
     pub vmgstool: Option<ReadVar<VmgstoolOutput>>,
     pub tpm_guest_tests_windows: Option<ReadVar<TpmGuestTestsOutput>>,
     pub tpm_guest_tests_linux: Option<ReadVar<TpmGuestTestsOutput>>,
+    pub test_igvm_agent_rpc_server: Option<ReadVar<TestIgvmAgentRpcServerOutput>>,
 }
 
 flowey_request! {
@@ -75,6 +77,7 @@ impl SimpleFlowNode for Node {
         ctx.import::<crate::install_vmm_tests_deps::Node>();
         ctx.import::<crate::init_vmm_tests_env::Node>();
         ctx.import::<crate::run_prep_steps::Node>();
+        ctx.import::<crate::run_test_igvm_agent_rpc_server::Node>();
         ctx.import::<crate::test_nextest_vmm_tests_archive::Node>();
         ctx.import::<flowey_lib_common::publish_test_results::Node>();
     }
@@ -112,6 +115,7 @@ impl SimpleFlowNode for Node {
             vmgstool: register_vmgstool,
             tpm_guest_tests_windows: register_tpm_guest_tests_windows,
             tpm_guest_tests_linux: register_tpm_guest_tests_linux,
+            test_igvm_agent_rpc_server: register_test_igvm_agent_rpc_server,
         } = dep_artifact_dirs;
 
         let register_openhcl_igvm_files = artifact_dir_openhcl_igvm_files.map(|artifact_dir| {
@@ -176,6 +180,7 @@ impl SimpleFlowNode for Node {
             register_vmgstool,
             register_tpm_guest_tests_windows,
             register_tpm_guest_tests_linux,
+            register_test_igvm_agent_rpc_server,
             disk_images_dir: Some(disk_images_dir),
             register_openhcl_igvm_files,
             get_test_log_path: Some(get_test_log_path),
@@ -184,6 +189,22 @@ impl SimpleFlowNode for Node {
             use_relative_paths: false,
         });
 
+        // Start the test_igvm_agent_rpc_server before running tests (Windows only).
+        // This must happen after init_vmm_tests_env which copies the binary.
+        // The server runs in the background for the duration of the test run.
+        // The node itself handles the platform check at runtime.
+        if matches!(
+            target.operating_system,
+            target_lexicon::OperatingSystem::Windows
+        ) {
+            pre_run_deps.push(
+                ctx.reqv(|done| crate::run_test_igvm_agent_rpc_server::Request {
+                    env: extra_env.clone(),
+                    done,
+                }),
+            );
+        }
+
         if needs_prep_run {
             pre_run_deps.push(ctx.reqv(|done| crate::run_prep_steps::Request {
                 prep_steps: register_prep_steps.expect("Test run indicated prep_steps was needed but built prep_steps binary was not given"),
diff --git a/flowey/flowey_lib_hvlite/src/_jobs/local_build_and_run_nextest_vmm_tests.rs b/flowey/flowey_lib_hvlite/src/_jobs/local_build_and_run_nextest_vmm_tests.rs
index a31d85c8d8..26111314a8 100644
--- a/flowey/flowey_lib_hvlite/src/_jobs/local_build_and_run_nextest_vmm_tests.rs
+++ b/flowey/flowey_lib_hvlite/src/_jobs/local_build_and_run_nextest_vmm_tests.rs
@@ -118,6 +118,7 @@ pub struct BuildSelections {
     pub vmgstool: bool,
     pub tpm_guest_tests_windows: bool,
     pub tpm_guest_tests_linux: bool,
+    pub test_igvm_agent_rpc_server: bool,
 }
 
 // Build everything we can by default
@@ -136,6 +137,7 @@ impl Default for BuildSelections {
             vmgstool: true,
             tpm_guest_tests_windows: true,
             tpm_guest_tests_linux: true,
+            test_igvm_agent_rpc_server: true,
         }
     }
 }
@@ -182,7 +184,9 @@ impl SimpleFlowNode for Node {
         ctx.import::<crate::build_tmks::Node>();
         ctx.import::<crate::build_tmk_vmm::Node>();
         ctx.import::<crate::build_tpm_guest_tests::Node>();
+        ctx.import::<crate::build_test_igvm_agent_rpc_server::Node>();
         ctx.import::<crate::download_openvmm_vmm_tests_artifacts::Node>();
+        ctx.import::<crate::run_test_igvm_agent_rpc_server::Node>();
         ctx.import::<crate::download_release_igvm_files_from_gh::resolve::Node>();
         ctx.import::<crate::init_vmm_tests_env::Node>();
         ctx.import::<crate::test_nextest_vmm_tests_archive::Node>();
@@ -290,6 +294,7 @@ impl SimpleFlowNode for Node {
                     filter.push_str(" & !test(windows)");
                     build.pipette_windows = false;
                     build.tpm_guest_tests_windows = false;
+                    build.test_igvm_agent_rpc_server = false;
                 }
                 if !freebsd {
                     filter.push_str(" & !test(freebsd)");
@@ -402,6 +407,7 @@ impl SimpleFlowNode for Node {
             build.pipette_linux = false;
             build.tmk_vmm_linux = false;
             build.tpm_guest_tests_linux = false;
+            build.test_igvm_agent_rpc_server = false;
         }
 
         let register_openhcl_igvm_files = build.openhcl.then(|| {
@@ -664,6 +670,25 @@ impl SimpleFlowNode for Node {
             output
         });
 
+        let register_test_igvm_agent_rpc_server = build.test_igvm_agent_rpc_server.then(|| {
+            let output = ctx.reqv(|v| crate::build_test_igvm_agent_rpc_server::Request {
+                target: CommonTriple::Common {
+                    arch,
+                    platform: CommonPlatform::WindowsMsvc,
+                },
+                profile: CommonProfile::from_release(release),
+                test_igvm_agent_rpc_server: v,
+            });
+
+            if copy_extras {
+                copy_to_dir.push((
+                    extras_dir.to_owned(),
+                    output.map(ctx, |x| Some(x.pdb.clone())),
+                ));
+            }
+            output
+        });
+
         let register_tmk_vmm = build.tmk_vmm_windows.then(|| {
             let output = ctx.reqv(|v| crate::build_tmk_vmm::Request {
                 target: CommonTriple::Common {
@@ -882,6 +907,7 @@ impl SimpleFlowNode for Node {
             register_vmgstool,
             register_tpm_guest_tests_windows,
             register_tpm_guest_tests_linux,
+            register_test_igvm_agent_rpc_server,
             disk_images_dir: Some(test_artifacts_dir),
             register_openhcl_igvm_files,
             get_test_log_path: None,
@@ -994,6 +1020,20 @@ impl SimpleFlowNode for Node {
             }
         } else {
             side_effects.push(ctx.reqv(crate::install_vmm_tests_deps::Request::Install));
+
+            // Start the test_igvm_agent_rpc_server before running tests (Windows only).
+            if matches!(
+                target_triple.operating_system,
+                target_lexicon::OperatingSystem::Windows
+            ) {
+                side_effects.push(ctx.reqv(|done| {
+                    crate::run_test_igvm_agent_rpc_server::Request {
+                        env: extra_env.clone(),
+                        done,
+                    }
+                }));
+            }
+
             if let Some((prep_steps, _)) = register_prep_steps {
                 side_effects.push(ctx.reqv(|done| crate::run_prep_steps::Request {
                     prep_steps,
diff --git a/flowey/flowey_lib_hvlite/src/build_test_igvm_agent_rpc_server.rs b/flowey/flowey_lib_hvlite/src/build_test_igvm_agent_rpc_server.rs
new file mode 100644
index 0000000000..f414470ee4
--- /dev/null
+++ b/flowey/flowey_lib_hvlite/src/build_test_igvm_agent_rpc_server.rs
@@ -0,0 +1,102 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Build `test_igvm_agent_rpc_server` binaries
+
+use crate::run_cargo_build::common::CommonProfile;
+use crate::run_cargo_build::common::CommonTriple;
+use flowey::node::prelude::*;
+use flowey_lib_common::run_cargo_build::CargoCrateType;
+use std::collections::BTreeMap;
+
+#[derive(Serialize, Deserialize)]
+pub struct TestIgvmAgentRpcServerOutput {
+    #[serde(rename = "test_igvm_agent_rpc_server.exe")]
+    pub exe: PathBuf,
+    #[serde(rename = "test_igvm_agent_rpc_server.pdb")]
+    pub pdb: PathBuf,
+}
+
+impl Artifact for TestIgvmAgentRpcServerOutput {}
+
+flowey_request! {
+    pub struct Request {
+        pub target: CommonTriple,
+        pub profile: CommonProfile,
+        pub test_igvm_agent_rpc_server: WriteVar<TestIgvmAgentRpcServerOutput>,
+    }
+}
+
+new_simple_flow_node!(struct Node);
+
+impl SimpleFlowNode for Node {
+    type Request = Request;
+
+    fn imports(ctx: &mut ImportCtx<'_>) {
+        ctx.import::<crate::run_cargo_build::Node>();
+    }
+
+    fn process_request(request: Self::Request, ctx: &mut NodeCtx<'_>) -> anyhow::Result<()> {
+        let Request {
+            target,
+            profile,
+            test_igvm_agent_rpc_server,
+        } = request;
+
+        let target_triple = target.as_triple();
+
+        // Only Windows MSVC is supported for test_igvm_agent_rpc_server
+        if target_triple.operating_system != target_lexicon::OperatingSystem::Windows
+            || target_triple.environment != target_lexicon::Environment::Msvc
+        {
+            anyhow::bail!(
+                "test_igvm_agent_rpc_server only supports Windows MSVC targets, got: {}",
+                target_triple
+            );
+        }
+
+        let env_key = format!(
+            "CARGO_TARGET_{}_RUSTFLAGS",
+            target_triple.to_string().replace('-', "_").to_uppercase()
+        );
+
+        let mut env: BTreeMap<String, String> = BTreeMap::new();
+
+        // Enable CRT static linking
+        env.insert(env_key, "-Ctarget-feature=+crt-static".to_string());
+
+        let extra_env = Some(ReadVar::from_static(env));
+
+        let output = ctx.reqv(|v| crate::run_cargo_build::Request {
+            crate_name: "test_igvm_agent_rpc_server".into(),
+            out_name: "test_igvm_agent_rpc_server".into(),
+            crate_type: CargoCrateType::Bin,
+            profile: profile.into(),
+            features: Default::default(),
+            target: target_triple,
+            no_split_dbg_info: false,
+            extra_env,
+            pre_build_deps: Vec::new(),
+            output: v,
+        });
+
+        ctx.emit_minor_rust_step("report built test_igvm_agent_rpc_server", |ctx| {
+            let test_igvm_agent_rpc_server = test_igvm_agent_rpc_server.claim(ctx);
+            let output = output.claim(ctx);
+            move |rt| {
+                let output = match rt.read(output) {
+                    crate::run_cargo_build::CargoBuildOutput::WindowsBin { exe, pdb } => {
+                        TestIgvmAgentRpcServerOutput { exe, pdb }
+                    }
+                    _ => unreachable!(
+                        "unsupported build output variant for test_igvm_agent_rpc_server"
+                    ),
+                };
+
+                rt.write(test_igvm_agent_rpc_server, &output);
+            }
+        });
+
+        Ok(())
+    }
+}
diff --git a/flowey/flowey_lib_hvlite/src/init_vmm_tests_env.rs b/flowey/flowey_lib_hvlite/src/init_vmm_tests_env.rs
index 97d0cee558..6c3da29b33 100644
--- a/flowey/flowey_lib_hvlite/src/init_vmm_tests_env.rs
+++ b/flowey/flowey_lib_hvlite/src/init_vmm_tests_env.rs
@@ -5,6 +5,7 @@
 //! require to run.
 
 use crate::build_openhcl_igvm_from_recipe::OpenhclIgvmRecipe;
+use crate::build_test_igvm_agent_rpc_server::TestIgvmAgentRpcServerOutput;
 use crate::build_tpm_guest_tests::TpmGuestTestsOutput;
 use crate::download_openvmm_deps::OpenvmmDepsArch;
 use crate::download_release_igvm_files_from_gh::OpenhclReleaseVersion;
@@ -55,6 +56,8 @@ flowey_request! {
         pub register_tpm_guest_tests_windows: Option<ReadVar<TpmGuestTestsOutput>>,
         /// Register a Linux tpm_guest_tests binary
         pub register_tpm_guest_tests_linux: Option<ReadVar<TpmGuestTestsOutput>>,
+        /// Register a Windows test_igvm_agent_rpc_server binary
+        pub register_test_igvm_agent_rpc_server: Option<ReadVar<TestIgvmAgentRpcServerOutput>>,
 
         /// Get the path to the folder containing various logs emitted VMM tests.
         pub get_test_log_path: Option<WriteVar<PathBuf>>,
@@ -91,6 +94,7 @@ impl SimpleFlowNode for Node {
             register_vmgstool,
             register_tpm_guest_tests_windows,
             register_tpm_guest_tests_linux,
+            register_test_igvm_agent_rpc_server,
             disk_images_dir,
             register_openhcl_igvm_files,
             get_test_log_path,
@@ -134,6 +138,7 @@ impl SimpleFlowNode for Node {
             let tmk_vmm = register_tmk_vmm.claim(ctx);
             let tmk_vmm_linux_musl = register_tmk_vmm_linux_musl.claim(ctx);
             let vmgstool = register_vmgstool.claim(ctx);
+            let test_igvm_agent_rpc_server = register_test_igvm_agent_rpc_server.claim(ctx);
             let tpm_guest_tests_windows = register_tpm_guest_tests_windows.claim(ctx);
             let tpm_guest_tests_linux = register_tpm_guest_tests_linux.claim(ctx);
             let disk_image_dir = disk_images_dir.claim(ctx);
@@ -329,6 +334,12 @@ impl SimpleFlowNode for Node {
                     dst.make_executable()?;
                 }
 
+                if let Some(test_igvm_agent_rpc_server) = test_igvm_agent_rpc_server {
+                    let TestIgvmAgentRpcServerOutput { exe, .. } =
+                        rt.read(test_igvm_agent_rpc_server);
+                    fs_err::copy(exe, test_content_dir.join("test_igvm_agent_rpc_server.exe"))?;
+                }
+
                 if let Some(openhcl_igvm_files) = openhcl_igvm_files {
                     for (recipe, openhcl_igvm) in rt.read(openhcl_igvm_files) {
                         let crate::run_igvmfilegen::IgvmOutput { igvm_bin, .. } = openhcl_igvm;
diff --git a/flowey/flowey_lib_hvlite/src/lib.rs b/flowey/flowey_lib_hvlite/src/lib.rs
index b1ddecbe91..e82237840b 100644
--- a/flowey/flowey_lib_hvlite/src/lib.rs
+++ b/flowey/flowey_lib_hvlite/src/lib.rs
@@ -27,6 +27,7 @@ pub mod build_pipette;
 pub mod build_prep_steps;
 pub mod build_rustdoc;
 pub mod build_sidecar;
+pub mod build_test_igvm_agent_rpc_server;
 pub mod build_tmk_vmm;
 pub mod build_tmks;
 pub mod build_tpm_guest_tests;
@@ -56,5 +57,6 @@ pub mod run_cargo_nextest_run;
 pub mod run_igvmfilegen;
 pub mod run_prep_steps;
 pub mod run_split_debug_info;
+pub mod run_test_igvm_agent_rpc_server;
 pub mod test_nextest_unit_tests_archive;
 pub mod test_nextest_vmm_tests_archive;
diff --git a/flowey/flowey_lib_hvlite/src/run_test_igvm_agent_rpc_server.rs b/flowey/flowey_lib_hvlite/src/run_test_igvm_agent_rpc_server.rs
new file mode 100644
index 0000000000..b0f7170011
--- /dev/null
+++ b/flowey/flowey_lib_hvlite/src/run_test_igvm_agent_rpc_server.rs
@@ -0,0 +1,136 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Start the test_igvm_agent_rpc_server before running VMM tests.
+//!
+//! The RPC server provides a fake IGVM agent attestation endpoint for
+//! CVM TPM guest tests. It must be running before the tests start and
+//! stay alive for the duration of the test run.
+//!
+//! This node starts the server from the test content directory (where
+//! init_vmm_tests_env copies the binary) and redirects output to a log file.
+
+use flowey::node::prelude::*;
+use std::collections::BTreeMap;
+
+flowey_request! {
+    pub struct Request {
+        /// Environment variables from init_vmm_tests_env (contains VMM_TESTS_CONTENT_DIR and TEST_OUTPUT_PATH)
+        pub env: ReadVar<BTreeMap<String, String>>,
+        /// Completion indicator - signals that the server is ready
+        pub done: WriteVar<SideEffect>,
+    }
+}
+
+new_simple_flow_node!(struct Node);
+
+impl SimpleFlowNode for Node {
+    type Request = Request;
+
+    fn imports(_ctx: &mut ImportCtx<'_>) {}
+
+    fn process_request(request: Self::Request, ctx: &mut NodeCtx<'_>) -> anyhow::Result<()> {
+        let Request { env, done } = request;
+
+        ctx.emit_rust_step("starting test_igvm_agent_rpc_server", |ctx| {
+            let env = env.claim(ctx);
+            done.claim(ctx);
+            move |rt| {
+                let env = rt.read(env);
+
+                // Only run on Windows - the RPC server is Windows-only
+                #[cfg(not(windows))]
+                {
+                    let _ = env;
+                    log::info!("test_igvm_agent_rpc_server is Windows-only, skipping");
+                    Ok(())
+                }
+
+                #[cfg(windows)]
+                {
+                    use std::os::windows::process::CommandExt;
+
+                    // Get paths from environment
+                    let test_content_dir = env
+                        .get("VMM_TESTS_CONTENT_DIR")
+                        .context("VMM_TESTS_CONTENT_DIR not set")?;
+                    let test_output_path = env
+                        .get("TEST_OUTPUT_PATH")
+                        .context("TEST_OUTPUT_PATH not set")?;
+
+                    let exe = Path::new(test_content_dir).join("test_igvm_agent_rpc_server.exe");
+
+                    if !exe.exists() {
+                        log::info!(
+                            "test_igvm_agent_rpc_server.exe not found at {}, skipping",
+                            exe.display()
+                        );
+                        return Ok(());
+                    }
+
+                    // Create log file for server output
+                    let log_file_path =
+                        Path::new(test_output_path).join("test_igvm_agent_rpc_server.log");
+                    let log_file = std::fs::File::create(&log_file_path)?;
+                    let log_file_stderr = log_file.try_clone()?;
+
+                    log::info!(
+                        "starting test_igvm_agent_rpc_server from {}, logs at: {}",
+                        exe.display(),
+                        log_file_path.display()
+                    );
+
+                    // Spawn the RPC server as a background process.
+                    // Use CREATE_NEW_PROCESS_GROUP so it doesn't receive console signals.
+                    const CREATE_NEW_PROCESS_GROUP: u32 = 0x00000200;
+
+                    let mut child = std::process::Command::new(&exe)
+                        .stdin(std::process::Stdio::null())
+                        .stdout(log_file)
+                        .stderr(log_file_stderr)
+                        .creation_flags(CREATE_NEW_PROCESS_GROUP)
+                        .spawn()
+                        .with_context(|| {
+                            format!(
+                                "failed to spawn test_igvm_agent_rpc_server: {}",
+                                exe.display()
+                            )
+                        })?;
+
+                    // Give the server a moment to start up and bind to the RPC endpoint.
+                    // The server closes stdout when it's ready, but since we redirected
+                    // stdout to a file, we can't detect that. Instead, we poll briefly.
+                    std::thread::sleep(std::time::Duration::from_millis(500));
+
+                    // Check if the server is still running
+                    match child.try_wait()? {
+                        Some(status) => {
+                            // Server exited - this is an error unless endpoint was already in use
+                            anyhow::bail!(
+                                "test_igvm_agent_rpc_server exited unexpectedly with status: {:?}. \
+                                Check logs at: {}",
+                                status.code(),
+                                log_file_path.display()
+                            );
+                        }
+                        None => {
+                            log::info!(
+                                "test_igvm_agent_rpc_server started successfully (pid: {})",
+                                child.id()
+                            );
+                        }
+                    }
+
+                    // Don't wait on the child - let it run in the background.
+                    // The process will be cleaned up when the CI job ends.
+                    // We intentionally drop the Child handle without waiting.
+                    drop(child);
+
+                    Ok(())
+                }
+            }
+        });
+
+        Ok(())
+    }
+}
diff --git a/openhcl/underhill_attestation/Cargo.toml b/openhcl/underhill_attestation/Cargo.toml
index 63aeae3537..6f2085924c 100644
--- a/openhcl/underhill_attestation/Cargo.toml
+++ b/openhcl/underhill_attestation/Cargo.toml
@@ -41,7 +41,7 @@ disk_backend.workspace = true
 vmgs = { workspace = true, features = ["encryption_ossl", "test_helpers"] }
 vmgs_format.workspace = true
 guest_emulation_transport = { workspace = true, features = ["test_utilities"] }
-guest_emulation_device = { workspace = true, features = ["test_igvm_agent"] }
+guest_emulation_device.workspace = true
 test_with_tracing.workspace = true
 user_driver_emulated_mock.workspace = true
 
diff --git a/openvmm/openvmm_resources/Cargo.toml b/openvmm/openvmm_resources/Cargo.toml
index fa539e97cc..8a7bcb4ed8 100644
--- a/openvmm/openvmm_resources/Cargo.toml
+++ b/openvmm/openvmm_resources/Cargo.toml
@@ -79,7 +79,7 @@ virtio_pmem.workspace = true
 
 # Vmbus devices
 guest_crash_device.workspace = true
-guest_emulation_device = { workspace = true, features = ["test_igvm_agent"] }
+guest_emulation_device.workspace = true
 guest_emulation_log.workspace = true
 hyperv_ic.workspace = true
 netvsp.workspace = true
diff --git a/vm/devices/get/guest_emulation_device/Cargo.toml b/vm/devices/get/guest_emulation_device/Cargo.toml
index 05ccf15623..fa33f441d7 100644
--- a/vm/devices/get/guest_emulation_device/Cargo.toml
+++ b/vm/devices/get/guest_emulation_device/Cargo.toml
@@ -8,16 +8,15 @@ rust-version.workspace = true
 
 [features]
 test_utilities = ["dep:disklayer_ram"]
-test_igvm_agent = ["dep:base64", "dep:sha2", "dep:rsa"]
 
 [dependencies]
 get_protocol.workspace = true
 get_resources.workspace = true
+test_igvm_agent_lib.workspace = true
 
 disk_backend.workspace = true
 disklayer_ram = { workspace = true, optional = true }
 guestmem.workspace = true
-openhcl_attestation_protocol.workspace = true
 power_resources.workspace = true
 scsi_buffers.workspace = true
 video_core.workspace = true
@@ -35,14 +34,11 @@ pal_async.workspace = true
 task_control.workspace = true
 tracelimit.workspace = true
 
-base64 = { workspace = true, optional = true }
 futures.workspace = true
 parking_lot.workspace = true
 serde_json = { workspace = true, features = ["std"] }
-sha2 = { workspace = true, optional = true }
 thiserror.workspace = true
 jiff.workspace = true
-rsa = { workspace = true, optional = true }
 tracing.workspace = true
 zerocopy.workspace = true
 guid.workspace = true
diff --git a/vm/devices/get/guest_emulation_device/src/lib.rs b/vm/devices/get/guest_emulation_device/src/lib.rs
index a437630232..be1cb09c0c 100644
--- a/vm/devices/get/guest_emulation_device/src/lib.rs
+++ b/vm/devices/get/guest_emulation_device/src/lib.rs
@@ -16,14 +16,9 @@ pub mod resolver;
 #[cfg(feature = "test_utilities")]
 pub mod test_utilities;
 
-#[cfg(feature = "test_igvm_agent")]
-mod test_igvm_agent;
-
-#[cfg(feature = "test_igvm_agent")]
-mod test_crypto;
-
-#[cfg(feature = "test_igvm_agent")]
-use crate::test_igvm_agent::TestIgvmAgent;
+pub use test_igvm_agent_lib::IgvmAgentAction;
+pub use test_igvm_agent_lib::IgvmAgentTestPlan;
+pub use test_igvm_agent_lib::IgvmAgentTestSetting;
 
 use async_trait::async_trait;
 use core::mem::size_of;
@@ -53,7 +48,6 @@ use get_protocol::dps_json::PcatBootDevice;
 use get_resources::ged::FirmwareEvent;
 use get_resources::ged::GuestEmulationRequest;
 use get_resources::ged::GuestServicingFlags;
-use get_resources::ged::IgvmAttestTestConfig;
 use get_resources::ged::ModifyVtl2SettingsError;
 use get_resources::ged::SaveRestoreError;
 use get_resources::ged::Vtl0StartError;
@@ -67,14 +61,12 @@ use jiff::civil::date;
 use jiff::tz::TimeZone;
 use mesh::error::RemoteError;
 use mesh::rpc::Rpc;
-use openhcl_attestation_protocol::igvm_attest::get::IgvmAttestRequestType;
 use power_resources::PowerRequest;
 use power_resources::PowerRequestClient;
 use scsi_buffers::OwnedRequestBuffers;
-use std::collections::HashMap;
-use std::collections::VecDeque;
 use std::io::IoSlice;
 use task_control::StopTask;
+use test_igvm_agent_lib::TestIgvmAgent;
 use thiserror::Error;
 use video_core::FramebufferControl;
 use vmbus_async::async_dgram::AsyncRecvExt;
@@ -118,9 +110,8 @@ enum Error {
     LargeDpsV2Unimplemented,
     #[error("invalid IGVM_ATTEST request")]
     InvalidIgvmAttestRequest,
-    #[cfg(feature = "test_igvm_agent")]
     #[error("test IGVM agent error")]
-    TestIgvmAgent(#[source] test_igvm_agent::Error),
+    TestIgvmAgent(#[source] test_igvm_agent_lib::Error),
     #[error("failed to write to shared memory")]
     SharedMemoryWriteFailed(#[source] guestmem::GuestMemoryError),
 }
@@ -211,43 +202,6 @@ pub enum GuestEvent {
     BootAttempt,
 }
 
-/// Possible actions for the IGVM agent to take in response to a request.
-#[derive(Debug, Clone)]
-pub enum IgvmAgentAction {
-    RespondSuccess,
-    RespondFailure,
-    NoResponse,
-}
-
-/// IGVM Agent test plan that specifies the list of action for a given request type.
-pub type IgvmAgentTestPlan = HashMap<IgvmAttestRequestType, VecDeque<IgvmAgentAction>>;
-
-/// IGVM Agent test setting. Custom Inspect impl avoids requiring HashMap to implement Inspect.
-#[derive(Debug)]
-pub enum IgvmAgentTestSetting {
-    /// Use test config that will be mapped to a plan. Used when creating GED via `GuestEmulationDeviceHandle`
-    /// (VMM tests).
-    TestConfig(IgvmAttestTestConfig),
-    /// Use test plan. Used when creating GED via test_utilities (unit tests).
-    TestPlan(IgvmAgentTestPlan),
-}
-
-impl Inspect for IgvmAgentTestSetting {
-    fn inspect(&self, req: inspect::Request<'_>) {
-        let mut resp = req.respond();
-        match self {
-            Self::TestConfig(cfg) => {
-                resp.field("TestConfig", cfg);
-            }
-            Self::TestPlan(plan) => {
-                // Only expose summary to avoid needing Inspect on HashMap.
-                let len = plan.len();
-                resp.field("TestPlan len", len);
-            }
-        }
-    }
-}
-
 /// VMBUS device that implements the host side of the Guest Emulation Transport protocol.
 #[derive(InspectMut)]
 pub struct GuestEmulationDevice {
@@ -272,7 +226,6 @@ pub struct GuestEmulationDevice {
 
     igvm_agent_setting: Option<IgvmAgentTestSetting>,
 
-    #[cfg(feature = "test_igvm_agent")]
     /// Test agent implementation for `handle_igvm_attest`
     #[inspect(skip)]
     igvm_agent: TestIgvmAgent,
@@ -314,7 +267,6 @@ impl GuestEmulationDevice {
             waiting_for_vtl0_start: Vec::new(),
             last_save_restore_buf_len: 0,
             igvm_agent_setting,
-            #[cfg(feature = "test_igvm_agent")]
             igvm_agent: TestIgvmAgent::new(),
             test_gsp_by_id,
         }
@@ -939,22 +891,14 @@ impl<T: RingMem + Unpin> GedChannel<T> {
         }
 
         let (response_payload, length) = {
-            #[cfg(feature = "test_igvm_agent")]
-            {
-                if let Some(setting) = &state.igvm_agent_setting {
-                    state.igvm_agent.install_plan_from_setting(setting);
-                }
-
-                state
-                    .igvm_agent
-                    .handle_request(&request.report[..request.report_length as usize])
-                    .map_err(Error::TestIgvmAgent)?
-            }
-            #[cfg(not(feature = "test_igvm_agent"))]
-            {
-                tracing::warn!("Test IGVM agent feature not enabled, returning empty response");
-                (&[][..], 0)
+            if let Some(setting) = &state.igvm_agent_setting {
+                state.igvm_agent.install_plan_from_setting(setting);
             }
+
+            state
+                .igvm_agent
+                .handle_request(&request.report[..request.report_length as usize])
+                .map_err(Error::TestIgvmAgent)?
         };
 
         // Write the response payload to the guest's shared memory
diff --git a/vm/devices/get/test_igvm_agent_lib/Cargo.toml b/vm/devices/get/test_igvm_agent_lib/Cargo.toml
new file mode 100644
index 0000000000..8b151f9c1b
--- /dev/null
+++ b/vm/devices/get/test_igvm_agent_lib/Cargo.toml
@@ -0,0 +1,22 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+[package]
+name = "test_igvm_agent_lib"
+edition.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+base64.workspace = true
+get_resources.workspace = true
+inspect = { workspace = true, features = ["derive"] }
+openhcl_attestation_protocol.workspace = true
+rsa.workspace = true
+serde_json.workspace = true
+sha2.workspace = true
+thiserror.workspace = true
+tracing.workspace = true
+zerocopy.workspace = true
+
+[lints]
+workspace = true
diff --git a/vm/devices/get/guest_emulation_device/src/test_igvm_agent.rs b/vm/devices/get/test_igvm_agent_lib/src/lib.rs
similarity index 90%
rename from vm/devices/get/guest_emulation_device/src/test_igvm_agent.rs
rename to vm/devices/get/test_igvm_agent_lib/src/lib.rs
index 84047ef9d7..4b45e6d546 100644
--- a/vm/devices/get/guest_emulation_device/src/test_igvm_agent.rs
+++ b/vm/devices/get/test_igvm_agent_lib/src/lib.rs
@@ -8,14 +8,14 @@
 
 //! NOTE: This is a test implementation and should not be used in production.
 
-use crate::IgvmAgentAction;
-use crate::IgvmAgentTestPlan;
-use crate::IgvmAgentTestSetting;
+mod test_crypto;
+
 use crate::test_crypto::DummyRng;
 use crate::test_crypto::TestSha1;
 use crate::test_crypto::aes_key_wrap_with_padding;
 use base64::Engine;
 use get_resources::ged::IgvmAttestTestConfig;
+use inspect::Inspect;
 use openhcl_attestation_protocol::igvm_attest::get::IGVM_ATTEST_REQUEST_CURRENT_VERSION;
 use openhcl_attestation_protocol::igvm_attest::get::IGVM_ATTEST_RESPONSE_CURRENT_VERSION;
 use openhcl_attestation_protocol::igvm_attest::get::IgvmAttestAkCertResponseHeader;
@@ -35,17 +35,15 @@ use rsa::rand_core::OsRng;
 use rsa::rand_core::RngCore;
 use rsa::rand_core::SeedableRng;
 use sha2::Sha256;
+use std::collections::HashMap;
 use std::collections::VecDeque;
-use std::sync::Once;
 use thiserror::Error;
 use zerocopy::FromBytes;
 use zerocopy::IntoBytes;
 
-// Support one-time initialization for `install_plan_from_setting`.
-static INIT: Once = Once::new();
-
+#[expect(missing_docs)] // self-explanatory fields
 #[derive(Debug, Error)]
-pub(crate) enum Error {
+pub enum Error {
     #[error("unsupported igvm attest request type: {0:?}")]
     UnsupportedIgvmAttestRequestType(u32),
     #[error("failed to initialize keys for attestation")]
@@ -65,8 +63,9 @@ pub(crate) enum Error {
     KeyReleaseError(#[source] KeyReleaseError),
 }
 
+#[expect(missing_docs)] // self-explanatory fields
 #[derive(Debug, Error)]
-pub(crate) enum WrappedKeyError {
+pub enum WrappedKeyError {
     #[error("RSA encryption error")]
     RsaEncryptionError(#[source] rsa::Error),
     #[error("JSON serialization error")]
@@ -77,8 +76,9 @@ pub(crate) enum WrappedKeyError {
     SecretKeyNotInitialized,
 }
 
+#[expect(missing_docs)] // self-explanatory fields
 #[derive(Debug, Error)]
-pub(crate) enum KeyReleaseError {
+pub enum KeyReleaseError {
     #[error("invalid runtime claims")]
     InvalidRuntimeClaims,
     #[error("missing transfer key in runtime claims")]
@@ -97,13 +97,53 @@ pub(crate) enum KeyReleaseError {
 
 /// Test IGVM agent includes states that need to be persisted.
 #[derive(Debug, Clone, Default)]
-pub(crate) struct TestIgvmAgent {
+pub struct TestIgvmAgent {
     /// Optional RSA private key used for attestation.
     secret_key: Option<RsaPrivateKey>,
     /// Optional DES key
     des_key: Option<[u8; 32]>,
     /// Optional scripted actions per request type for tests.
     plan: Option<IgvmAgentTestPlan>,
+    /// Track whether the plan has been installed to prevent multiple installations.
+    plan_installed: bool,
+}
+
+/// Possible actions for the IGVM agent to take in response to a request.
+#[derive(Debug, Clone)]
+pub enum IgvmAgentAction {
+    /// Emit a successful response payload.
+    RespondSuccess,
+    /// Emit a response that indicates a protocol error.
+    RespondFailure,
+    /// Skip responding to simulate a timeout.
+    NoResponse,
+}
+
+/// IGVM Agent test plan specifying scripted actions for a request type.
+pub type IgvmAgentTestPlan = HashMap<IgvmAttestRequestType, VecDeque<IgvmAgentAction>>;
+
+/// Settings used to configure the IGVM agent for tests.
+#[derive(Debug, Clone)]
+pub enum IgvmAgentTestSetting {
+    /// Use a pre-defined test configuration that maps to a plan.
+    TestConfig(IgvmAttestTestConfig),
+    /// Use a manually provided plan.
+    TestPlan(IgvmAgentTestPlan),
+}
+
+impl Inspect for IgvmAgentTestSetting {
+    fn inspect(&self, req: inspect::Request<'_>) {
+        let mut resp = req.respond();
+        match self {
+            Self::TestConfig(cfg) => {
+                resp.field("TestConfig", cfg);
+            }
+            Self::TestPlan(plan) => {
+                let len = plan.len();
+                resp.field("TestPlan len", len);
+            }
+        }
+    }
 }
 
 fn test_config_to_plan(test_config: &IgvmAttestTestConfig) -> IgvmAgentTestPlan {
@@ -133,32 +173,39 @@ fn test_config_to_plan(test_config: &IgvmAttestTestConfig) -> IgvmAgentTestPlan
 
 impl TestIgvmAgent {
     /// Create an instance.
-    pub(crate) fn new() -> Self {
+    pub fn new() -> Self {
         Self {
             secret_key: None,
             des_key: None,
             plan: None,
+            plan_installed: false,
         }
     }
 
-    /// Install a scripted plan used by tests based on the setting (one-time only). Allow to be called multiple times.
+    /// Install a scripted plan used by tests based on the setting.
+    /// Can be called multiple times but will only install the plan once per instance.
     pub fn install_plan_from_setting(&mut self, setting: &IgvmAgentTestSetting) {
-        INIT.call_once(|| {
-            tracing::info!("install the scripted plan for test IGVM Agent");
+        // Only install the plan once per agent instance
+        if self.plan_installed {
+            return;
+        }
 
-            match setting {
-                IgvmAgentTestSetting::TestPlan(plan) => {
-                    self.plan = Some(plan.clone());
-                }
-                IgvmAgentTestSetting::TestConfig(config) => {
-                    self.plan = Some(test_config_to_plan(config));
-                }
+        tracing::info!("install the scripted plan for test IGVM Agent");
+
+        match setting {
+            IgvmAgentTestSetting::TestPlan(plan) => {
+                self.plan = Some(plan.clone());
             }
-        });
+            IgvmAgentTestSetting::TestConfig(config) => {
+                self.plan = Some(test_config_to_plan(config));
+            }
+        }
+
+        self.plan_installed = true;
     }
 
     /// Take the next scripted action for the given request type, if any.
-    pub(crate) fn take_next_action(
+    pub fn take_next_action(
         &mut self,
         request_type: IgvmAttestRequestType,
     ) -> Option<IgvmAgentAction> {
@@ -167,7 +214,8 @@ impl TestIgvmAgent {
         plan.get_mut(&request_type)?.pop_front()
     }
 
-    pub(crate) fn handle_request(&mut self, request_bytes: &[u8]) -> Result<(Vec<u8>, u32), Error> {
+    /// Request handler.
+    pub fn handle_request(&mut self, request_bytes: &[u8]) -> Result<(Vec<u8>, u32), Error> {
         let request = IgvmAttestRequestBase::read_from_prefix(request_bytes)
             .map_err(|_| Error::InvalidIgvmAttestRequest)?
             .0; // TODO: zerocopy: map_err (https://github.com/microsoft/openvmm/issues/759)
@@ -400,7 +448,7 @@ impl TestIgvmAgent {
         Ok((response, length))
     }
 
-    pub(crate) fn initialize_keys(&mut self) -> Result<(), Error> {
+    fn initialize_keys(&mut self) -> Result<(), Error> {
         if self.secret_key.is_some() && self.des_key.is_some() {
             // Keys are already initialized, nothing to do.
             return Ok(());
@@ -425,7 +473,7 @@ impl TestIgvmAgent {
         Ok(())
     }
 
-    pub(crate) fn generate_mock_wrapped_key_response(&self) -> Result<Vec<u8>, WrappedKeyError> {
+    fn generate_mock_wrapped_key_response(&self) -> Result<Vec<u8>, WrappedKeyError> {
         use openhcl_attestation_protocol::igvm_attest::cps;
 
         // Ensure DES key is available
@@ -483,7 +531,7 @@ impl TestIgvmAgent {
     }
 
     /// Generate a mock JWT response for testing KEY_RELEASE_REQUEST
-    pub(crate) fn generate_mock_key_release_response(
+    fn generate_mock_key_release_response(
         &self,
         runtime_claims_bytes: &[u8],
     ) -> Result<String, KeyReleaseError> {
@@ -527,7 +575,7 @@ impl TestIgvmAgent {
     }
 
     /// Generate a mock JWT response for testing KEY_RELEASE_REQUEST
-    pub(crate) fn generate_jwt_with_rsa_key(
+    fn generate_jwt_with_rsa_key(
         &self,
         public_key: RsaPublicKey,
     ) -> Result<String, KeyReleaseError> {
diff --git a/vm/devices/get/guest_emulation_device/src/test_crypto.rs b/vm/devices/get/test_igvm_agent_lib/src/test_crypto.rs
similarity index 99%
rename from vm/devices/get/guest_emulation_device/src/test_crypto.rs
rename to vm/devices/get/test_igvm_agent_lib/src/test_crypto.rs
index ad01fdf777..8530bb5401 100644
--- a/vm/devices/get/guest_emulation_device/src/test_crypto.rs
+++ b/vm/devices/get/test_igvm_agent_lib/src/test_crypto.rs
@@ -12,7 +12,8 @@ use rsa::rand_core::CryptoRng;
 use rsa::rand_core::RngCore;
 use rsa::rand_core::SeedableRng;
 use sha2::digest;
-use sha2::digest::consts::{U20, U64};
+use sha2::digest::consts::U20;
+use sha2::digest::consts::U64;
 use sha2::digest::core_api::BlockSizeUser;
 
 /// Minimal, non-constant-time SHA-1 implementation sufficient to satisfy the
diff --git a/vm/devices/get/test_igvm_agent_rpc_server/Cargo.toml b/vm/devices/get/test_igvm_agent_rpc_server/Cargo.toml
new file mode 100644
index 0000000000..f5654535b4
--- /dev/null
+++ b/vm/devices/get/test_igvm_agent_rpc_server/Cargo.toml
@@ -0,0 +1,36 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+[package]
+name = "test_igvm_agent_rpc_server"
+edition.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+test_igvm_agent_lib.workspace = true
+get_resources.workspace = true
+
+guid.workspace = true
+
+cfg-if.workspace = true
+clap = { workspace = true, features = ["derive"] }
+parking_lot.workspace = true
+tracing.workspace = true
+tracing-subscriber = { workspace = true, features = ["env-filter"] }
+
+[target.'cfg(windows)'.dependencies]
+winapi.workspace = true
+windows-sys = { workspace = true, features = [
+    "Win32_Foundation",
+    "Win32_System_Memory",
+    "Win32_System_Rpc",
+    "Win32_System_Console",
+    "Win32_System_Com",
+] }
+
+[build-dependencies]
+cc.workspace = true
+serde_json = { workspace = true, features = ["std"] }
+
+[lints]
+workspace = true
diff --git a/vm/devices/get/test_igvm_agent_rpc_server/build.rs b/vm/devices/get/test_igvm_agent_rpc_server/build.rs
new file mode 100644
index 0000000000..43b42ac992
--- /dev/null
+++ b/vm/devices/get/test_igvm_agent_rpc_server/build.rs
@@ -0,0 +1,408 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Build script that compiles the Windows RPC server for test IGVM agent.
+
+use serde_json::Value;
+use std::env;
+use std::ffi::OsString;
+use std::path::{Component, Path, PathBuf};
+use std::process::Command;
+
+struct CrossConfig {
+    include: Vec<PathBuf>,
+    lib: Vec<PathBuf>,
+    bin_dirs: Vec<PathBuf>,
+}
+
+fn main() {
+    println!("cargo:rerun-if-changed=idl/IGVmAgentRpcApi.idl");
+    println!("cargo:rerun-if-env-changed=MIDL");
+
+    let target = env::var("TARGET").unwrap_or_default();
+    let target_env = target.replace('-', "_");
+    println!("cargo:rerun-if-env-changed=MIDLRT_{}", target_env);
+
+    let target_os = env::var("CARGO_CFG_TARGET_OS").unwrap_or_default();
+    if target_os != "windows" {
+        // Stub interface is only needed when targeting Windows.
+        return;
+    }
+
+    let host = env::var("HOST").unwrap_or_default();
+    let host_is_windows = host.contains("windows");
+    let midl_info = locate_midl(&target_env);
+
+    if midl_info.is_none() {
+        if host_is_windows {
+            panic!(
+                "MIDL compiler not found. Please install the Windows SDK which includes MIDL, \
+                or set the MIDL environment variable to point to midl.exe. \
+                You can download the Windows SDK from: \
+                https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/"
+            );
+        } else {
+            panic!(
+                "MIDL compiler is required to build for Windows targets from non-Windows hosts. \
+                Set MIDL or MIDLRT_{} environment variable to point to a cross-compilation MIDL tool.",
+                target_env
+            );
+        }
+    }
+
+    let out_dir = PathBuf::from(env::var("OUT_DIR").expect("OUT_DIR not set"));
+    let idl_path = Path::new("idl/IGVmAgentRpcApi.idl");
+
+    let (midl, uses_cross_tool) = midl_info.unwrap_or_else(|| ("midl".to_owned(), false));
+    let mut cmd = Command::new(&midl);
+    cmd.arg("/nologo");
+
+    let cross_cfg = if !host_is_windows {
+        match load_cross_config(&target) {
+            Ok(cfg) => Some(cfg),
+            Err(err) => {
+                panic!("Failed to load cross-compilation configuration: {err}");
+            }
+        }
+    } else {
+        None
+    };
+
+    match (uses_cross_tool, cross_cfg.as_ref()) {
+        (true, Some(cfg)) => {
+            if let Some(cl_path) = locate_cl_exe(cfg) {
+                if let Some(bin_dir) = cl_path.parent() {
+                    let mut path_value = env::var_os("PATH").unwrap_or_default();
+                    if !path_value.is_empty() {
+                        path_value.push(":");
+                    }
+                    path_value.push(bin_dir.as_os_str());
+                    cmd.env("PATH", &path_value);
+
+                    let mut wslenv = env::var("WSLENV").unwrap_or_default();
+                    if !wslenv.split(':').any(|entry| entry == "PATH/wl") {
+                        if !wslenv.is_empty() {
+                            wslenv.push(':');
+                        }
+                        wslenv.push_str("PATH/wl");
+                    }
+                    cmd.env("WSLENV", wslenv);
+                } else {
+                    panic!(
+                        "Missing parent directory for cl.exe in cross-compilation configuration"
+                    );
+                }
+            } else {
+                panic!("Unable to locate cl.exe in cross-compilation configuration");
+            }
+        }
+        (false, Some(cfg)) => {
+            if let Err(err) = configure_cross_env(&mut cmd, cfg) {
+                panic!("Failed to configure cross-compilation environment: {err}");
+            }
+        }
+        _ => {
+            // When building on native Windows, set up the MSVC environment for MIDL
+            if host_is_windows {
+                if let Err(err) = setup_msvc_env_for_midl(&mut cmd, &target) {
+                    panic!("Failed to set up MSVC environment for MIDL: {err}");
+                }
+            }
+        }
+    }
+
+    // Determine the MIDL target environment based on the Cargo target.
+    // xtask-fmt allow-target-arch dependency
+    let arch = env::var("CARGO_CFG_TARGET_ARCH").unwrap_or_else(|_| "x86_64".to_owned());
+    let midl_env = match arch.as_str() {
+        "x86_64" => "x64",
+        "aarch64" => "arm64",
+        unsupported => panic!("Unsupported architecture for MIDL: {}", unsupported),
+    };
+    cmd.args(["/env", midl_env]);
+
+    let out_dir_arg = path_for_midl(&out_dir, host_is_windows);
+    cmd.arg("/out");
+    cmd.arg(&out_dir_arg);
+
+    let idl_arg = path_for_midl(idl_path, host_is_windows);
+    cmd.arg(&idl_arg);
+
+    let status = cmd.status().unwrap_or_else(|err| {
+        panic!("Failed to execute MIDL `{midl}`: {err}. Install the Windows MIDL compiler.")
+    });
+    if !status.success() {
+        panic!("midl failed: status {status}");
+    }
+
+    let stub_c = out_dir.join("IGVmAgentRpcApi_s.c");
+
+    if !stub_c.exists() {
+        panic!("MIDL did not produce expected stub: {}", stub_c.display());
+    }
+
+    cc::Build::new()
+        .file(&stub_c)
+        .include(&out_dir)
+        .compile("igvm_agent_rpc_stub");
+
+    println!("cargo:rustc-link-lib=Rpcrt4");
+}
+
+fn locate_midl(target_env: &str) -> Option<(String, bool)> {
+    // Check for cross-compilation MIDL tool first
+    let key = format!("MIDLRT_{}", target_env);
+    if let Ok(path) = env::var(&key) {
+        if !path.is_empty() {
+            return Some((path, true));
+        }
+    }
+
+    if let Ok(path) = env::var("MIDL") {
+        if !path.is_empty() {
+            return Some((path, false));
+        }
+    }
+
+    // On Windows, try to find MIDL from the Windows SDK
+    #[cfg(windows)]
+    {
+        if let Some(midl_path) = find_windows_sdk_midl() {
+            return Some((midl_path, false));
+        }
+    }
+
+    None
+}
+
+#[cfg(windows)]
+fn find_windows_sdk_midl() -> Option<String> {
+    use std::process::Command;
+
+    // Try common Windows SDK paths directly
+    // The SDK can be installed standalone without Visual Studio
+    let sdk_dirs = [
+        "C:\\Program Files (x86)\\Windows Kits\\10\\bin",
+        "C:\\Program Files\\Windows Kits\\10\\bin",
+    ];
+
+    for sdk_dir in &sdk_dirs {
+        // Try to find the latest SDK version
+        if let Ok(entries) = std::fs::read_dir(sdk_dir) {
+            let mut versions: Vec<_> = entries
+                .filter_map(|e| e.ok())
+                .filter(|e| e.file_type().map(|t| t.is_dir()).unwrap_or(false))
+                .filter_map(|e| {
+                    let name = e.file_name();
+                    let name_str = name.to_string_lossy();
+                    // Check if it looks like a version number (starts with digit)
+                    if name_str.chars().next()?.is_ascii_digit() {
+                        Some((name_str.to_string(), e.path()))
+                    } else {
+                        None
+                    }
+                })
+                .collect();
+
+            // Sort versions in reverse order to get the latest
+            versions.sort_by(|a, b| b.0.cmp(&a.0));
+
+            for (_, version_path) in versions {
+                // Check both x64 and x86 subdirectories
+                for arch_subdir in &["x64", "x86"] {
+                    let midl_path = version_path.join(arch_subdir).join("midl.exe");
+                    if midl_path.exists() {
+                        return Some(midl_path.to_string_lossy().to_string());
+                    }
+                }
+            }
+        }
+    }
+
+    // Fallback: check if "midl" is in PATH
+    if Command::new("midl").arg("/?").output().is_ok() {
+        return Some("midl".to_string());
+    }
+
+    None
+}
+
+#[cfg(windows)]
+fn setup_msvc_env_for_midl(cmd: &mut Command, target: &str) -> Result<(), String> {
+    // Use the cc crate to get the MSVC compiler tool, which will give us
+    // access to the properly configured environment including cl.exe path
+    let tool = cc::Build::new().target(target).host(target).get_compiler();
+
+    // Get the path to cl.exe
+    let cl_path = tool.path();
+    if let Some(bin_dir) = cl_path.parent() {
+        // Add the MSVC bin directory to PATH so MIDL can find cl.exe
+        let mut path_value = env::var_os("PATH").unwrap_or_default();
+        if !path_value.is_empty() {
+            path_value.push(";");
+        }
+        path_value.push(bin_dir.as_os_str());
+        cmd.env("PATH", &path_value);
+
+        // Also set up INCLUDE and LIB environment variables that MIDL/cl.exe need
+        for (key, value) in tool.env() {
+            cmd.env(key, value);
+        }
+    } else {
+        return Err("Failed to find parent directory of cl.exe".to_string());
+    }
+
+    Ok(())
+}
+
+#[cfg(not(windows))]
+fn setup_msvc_env_for_midl(_cmd: &mut Command, _target: &str) -> Result<(), String> {
+    Ok(())
+}
+
+fn configure_cross_env(cmd: &mut Command, cfg: &CrossConfig) -> Result<(), String> {
+    let include = join_windows_paths(&cfg.include)?;
+    let lib = join_windows_paths(&cfg.lib)?;
+    let mut path_entries = join_windows_paths(&cfg.bin_dirs)?;
+
+    if let Some(existing) = env::var_os("PATH") {
+        if !existing.is_empty() {
+            if !path_entries.is_empty() {
+                path_entries.push(";");
+            }
+            path_entries.push(existing);
+        }
+    }
+
+    cmd.env("INCLUDE", &include);
+    cmd.env("LIB", &lib);
+    cmd.env("PATH", &path_entries);
+
+    Ok(())
+}
+
+fn load_cross_config(target: &str) -> Result<CrossConfig, String> {
+    let arch = target
+        .split('-')
+        .next()
+        .ok_or_else(|| "could not determine target arch".to_string())?;
+    let tool = env::var_os("OPENVMM_WINDOWS_CROSS_TOOL")
+        .ok_or_else(|| "OPENVMM_WINDOWS_CROSS_TOOL not set".to_string())?;
+
+    let output = Command::new(&tool)
+        .arg("--arch")
+        .arg(arch)
+        .arg("--dump")
+        .output()
+        .map_err(|err| format!("failed to run cross tool `{tool:?}`: {err}"))?;
+
+    if !output.status.success() {
+        return Err("cross tool did not return success".to_string());
+    }
+
+    let value: Value = serde_json::from_slice(&output.stdout)
+        .map_err(|err| format!("failed to parse cross tool output: {err}"))?;
+
+    let include = extract_paths(&value, "include")?;
+    let lib = extract_paths(&value, "lib")?;
+    let mut bin_dirs = extract_paths(&value, "sdk")?;
+
+    if let Some(msvc_bin) = msvc_bin_dir(&include, arch) {
+        bin_dirs.push(msvc_bin);
+    }
+
+    Ok(CrossConfig {
+        include,
+        lib,
+        bin_dirs,
+    })
+}
+
+fn extract_paths(value: &Value, key: &str) -> Result<Vec<PathBuf>, String> {
+    let array = value
+        .get(key)
+        .and_then(|v| v.as_array())
+        .ok_or_else(|| format!("missing `{key}` array in cross tool output"))?;
+
+    let mut paths = Vec::new();
+    for entry in array {
+        let path = entry
+            .as_str()
+            .ok_or_else(|| format!("invalid `{key}` entry in cross tool output"))?;
+        paths.push(PathBuf::from(path));
+    }
+
+    if paths.is_empty() {
+        return Err(format!("no entries found for `{key}`"));
+    }
+
+    Ok(paths)
+}
+
+fn msvc_bin_dir(include_paths: &[PathBuf], target_arch: &str) -> Option<PathBuf> {
+    for include in include_paths {
+        let mut base = include.parent()?.to_path_buf();
+        base.push("bin");
+        base.push("Hostx64");
+        base.push(match target_arch {
+            "aarch64" | "arm64" => "arm64",
+            _ => "x64",
+        });
+
+        if base.join("clang-cl.exe").exists() || base.join("cl.exe").exists() {
+            return Some(base);
+        }
+    }
+
+    None
+}
+
+fn locate_cl_exe(cfg: &CrossConfig) -> Option<PathBuf> {
+    for dir in &cfg.bin_dirs {
+        let candidate = dir.join("cl.exe");
+        if candidate.exists() {
+            return Some(candidate);
+        }
+    }
+
+    None
+}
+
+fn join_windows_paths(paths: &[PathBuf]) -> Result<OsString, String> {
+    let mut parts = Vec::with_capacity(paths.len());
+    for path in paths {
+        let converted = path_for_midl(path, false);
+        let piece = converted.to_string_lossy().into_owned();
+        if piece.is_empty() {
+            return Err(format!(
+                "unable to convert path `{}` to Windows format",
+                path.display()
+            ));
+        }
+        parts.push(piece);
+    }
+
+    Ok(OsString::from(parts.join(";")))
+}
+
+fn path_for_midl(path: &Path, host_is_windows: bool) -> OsString {
+    if host_is_windows {
+        return path.as_os_str().to_os_string();
+    }
+
+    if matches!(path.components().next(), Some(Component::Prefix(_))) {
+        return path.as_os_str().to_os_string();
+    }
+
+    match Command::new("wslpath").arg("-w").arg(path).output() {
+        Ok(output) if output.status.success() => {
+            let converted = String::from_utf8_lossy(&output.stdout).trim().to_owned();
+            if converted.is_empty() {
+                path.as_os_str().to_os_string()
+            } else {
+                OsString::from(converted)
+            }
+        }
+        _ => path.as_os_str().to_os_string(),
+    }
+}
diff --git a/vm/devices/get/test_igvm_agent_rpc_server/idl/IGVmAgentRpcApi.idl b/vm/devices/get/test_igvm_agent_rpc_server/idl/IGVmAgentRpcApi.idl
new file mode 100644
index 0000000000..e81f0cb3f1
--- /dev/null
+++ b/vm/devices/get/test_igvm_agent_rpc_server/idl/IGVmAgentRpcApi.idl
@@ -0,0 +1,86 @@
+/*++
+
+Copyright (c) Microsoft Corporation
+
+Abstract:
+
+    IGVM Agent RPC Interface Definition File.
+
+--*/
+
+cpp_quote("static WCHAR IGVM_AGENT_RPC_ENDPOINT[] = L\"IGVM_AGENT_RPC_SERVER\";")
+
+import "oaidl.idl";
+import "ocidl.idl";
+
+[
+    uuid(4f92949d-e1b6-468d-b6ba-731b591edccf),
+    version(1.0),
+    pointer_default(unique)
+]
+interface IGVmAgentRpcApi
+{
+    const UINT32 GspMaxClearSize = 64;
+    const UINT32 GspMaxCipherSize = 512;
+    const UINT32 GspMaxCount = 2;
+    const UINT32 StatusFlagNoError = 0x0;
+    const UINT32 StatusFlagStateRefreshRequest = 0x1;
+    const UINT32 StatusFlagSupportsAgentRequired = 0x2;
+
+    typedef struct
+    {
+        UINT32 Length;
+        BYTE   Buffer[GspMaxClearSize];
+    } GspClear;
+
+    typedef struct
+    {
+        UINT32 Length;
+        BYTE   Buffer[GspMaxCipherSize];
+    } GspCipher;
+
+    typedef struct
+    {
+        GspClear  NewGsp;
+        GspCipher EncryptedGsp[GspMaxCount];
+        UINT32    SupportedStatusFlags;
+    } GspRequestInfo;
+
+    typedef struct
+    {
+        GspCipher EncryptedGsp;
+        GspClear  DecryptedGsp[GspMaxCount];
+        UINT32    ResponseStatusFlags;
+    } GspResponseInfo;
+
+    HRESULT
+    RpcIGVmAttest(
+        [in]    handle_t                    BindingHandle,
+        [in]    GUID                        VmId,
+        [in]    GUID                        RequestId,
+        [in,  ref, string]
+                LPCWSTR                     VmName,
+        [in, range(0, 2048)]
+                UINT32                      AgentDataSize,
+        [in,  ref, size_is(AgentDataSize)]
+                BYTE*                       AgentData,
+                UINT32                      ReportSize,
+        [in,  ref, size_is(ReportSize)]
+                BYTE*                       Report,
+        [in, range(0, 65536)]
+                UINT32                      ResponseBufferSize,
+        [out]   UINT32*                     ResponseWrittenSize,
+        [out, ref, size_is(ResponseBufferSize), length_is(*ResponseWrittenSize)]
+                BYTE*                       Response
+        );
+
+    HRESULT
+    RpcVmGspRequest(
+        [in]    handle_t                BindingHandle,
+        [in]    GUID                    VmId,
+        [in,  ref, string]
+                LPCWSTR                 VmName,
+        [in]    GspRequestInfo*         RequestData,
+        [out]   GspResponseInfo*        ResponseData
+        );
+}
diff --git a/vm/devices/get/test_igvm_agent_rpc_server/src/main.rs b/vm/devices/get/test_igvm_agent_rpc_server/src/main.rs
new file mode 100644
index 0000000000..f4f98cf153
--- /dev/null
+++ b/vm/devices/get/test_igvm_agent_rpc_server/src/main.rs
@@ -0,0 +1,89 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Standalone executable that hosts the IGVM agent Windows RPC façade.
+
+#[cfg(target_os = "windows")]
+mod rpc;
+
+use cfg_if::cfg_if;
+use clap::Parser;
+use get_resources::ged::IgvmAttestTestConfig;
+use std::process::ExitCode;
+
+/// IGVM Agent RPC Server
+#[derive(Parser, Debug)]
+#[clap(name = "test_igvm_agent_rpc_server")]
+#[clap(about = "Test IGVM Agent RPC Server for attestation testing")]
+struct Args {
+    /// Test configuration to use for the IGVM agent
+    #[clap(long, value_enum)]
+    test_config: Option<TestConfig>,
+}
+
+/// Test configuration options
+#[derive(Debug, Clone, Copy, clap::ValueEnum)]
+enum TestConfig {
+    /// Test AK cert retry after failure
+    AkCertRequestFailureAndRetry,
+    /// Test AK cert persistency across boots
+    AkCertPersistentAcrossBoot,
+}
+
+impl From<TestConfig> for IgvmAttestTestConfig {
+    fn from(config: TestConfig) -> Self {
+        match config {
+            TestConfig::AkCertRequestFailureAndRetry => {
+                IgvmAttestTestConfig::AkCertRequestFailureAndRetry
+            }
+            TestConfig::AkCertPersistentAcrossBoot => {
+                IgvmAttestTestConfig::AkCertPersistentAcrossBoot
+            }
+        }
+    }
+}
+
+fn main() -> ExitCode {
+    cfg_if! {
+        if #[cfg(target_os = "windows")] {
+            use tracing_subscriber::fmt;
+            use tracing_subscriber::EnvFilter;
+            use test_igvm_agent_lib::IgvmAgentTestSetting;
+
+            let args = Args::parse();
+
+            let filter = EnvFilter::try_from_default_env()
+                .unwrap_or_else(|_| EnvFilter::new("test_igvm_agent_rpc_server=info"));
+
+            let _ = fmt()
+                .with_env_filter(filter)
+                .with_writer(std::io::stderr)
+                .try_init();
+
+            tracing::info!("launching IGVM agent RPC server binary");
+
+            // Install test plan if a configuration was provided
+            if let Some(test_config) = args.test_config {
+                let igvm_config: IgvmAttestTestConfig = test_config.into();
+                let setting = IgvmAgentTestSetting::TestConfig(igvm_config);
+                rpc::igvm_agent::install_plan(&setting);
+                tracing::info!(?test_config, "installed test configuration");
+            } else {
+                tracing::info!("no test configuration provided, using default behavior");
+            }
+
+            if let Err(err) = rpc::run_server() {
+                tracing::error!(%err, "failed to run IGVM agent RPC server");
+                return ExitCode::FAILURE;
+            }
+
+            tracing::info!("IGVM agent RPC server exited successfully");
+
+            ExitCode::SUCCESS
+        }
+        else {
+            eprintln!("IGVM agent RPC server is only supported on Windows hosts.");
+            ExitCode::FAILURE
+        }
+    }
+}
diff --git a/vm/devices/get/test_igvm_agent_rpc_server/src/rpc/handlers.rs b/vm/devices/get/test_igvm_agent_rpc_server/src/rpc/handlers.rs
new file mode 100644
index 0000000000..5390199ecc
--- /dev/null
+++ b/vm/devices/get/test_igvm_agent_rpc_server/src/rpc/handlers.rs
@@ -0,0 +1,333 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+use crate::rpc::igvm_agent;
+use guid::Guid;
+use std::ffi::c_void;
+use std::mem::size_of;
+use std::ptr;
+use std::slice;
+use winapi::shared::winerror::E_FAIL;
+use winapi::shared::winerror::E_INVALIDARG;
+use winapi::shared::winerror::E_OUTOFMEMORY;
+use winapi::shared::winerror::E_POINTER;
+use winapi::shared::winerror::HRESULT;
+use winapi::shared::winerror::S_OK;
+use windows_sys::Win32::System::Rpc::RPC_S_SERVER_UNAVAILABLE;
+use windows_sys::Win32::System::Rpc::RpcRaiseException;
+
+#[unsafe(no_mangle)]
+/// Allocator shim invoked by the generated MIDL stubs.
+/// # SAFETY
+/// Define FFI to fullfil the linker requirement
+pub unsafe extern "C" fn MIDL_user_allocate(size: usize) -> *mut c_void {
+    use windows_sys::Win32::System::Com::CoTaskMemAlloc;
+    // SAFETY: make an FFI call
+    unsafe { CoTaskMemAlloc(size) }
+}
+
+#[unsafe(no_mangle)]
+/// Deallocator shim invoked by the generated MIDL stubs.
+/// # SAFETY
+/// Define FFI to fullfil the linker requirement
+pub unsafe extern "C" fn MIDL_user_free(ptr: *mut c_void) {
+    use windows_sys::Win32::System::Com::CoTaskMemFree;
+    if !ptr.is_null() {
+        // SAFETY: make an FFI call
+        unsafe {
+            CoTaskMemFree(ptr);
+        }
+    }
+}
+
+// Constants from IDL
+const GSP_MAX_CLEAR_SIZE: usize = 64;
+const GSP_MAX_CIPHER_SIZE: usize = 512;
+const GSP_MAX_COUNT: usize = 2;
+
+/// GSP clear text buffer (matches IDL GspClear)
+#[repr(C)]
+pub struct GspClear {
+    pub length: u32,
+    pub buffer: [u8; GSP_MAX_CLEAR_SIZE],
+}
+
+/// GSP encrypted buffer (matches IDL GspCipher)
+#[repr(C)]
+pub struct GspCipher {
+    pub length: u32,
+    pub buffer: [u8; GSP_MAX_CIPHER_SIZE],
+}
+
+/// VM GSP request payload descriptor provided by the RPC caller (matches IDL GspRequestInfo).
+#[repr(C)]
+pub struct GspRequestInfo {
+    pub new_gsp: GspClear,
+    pub encrypted_gsp: [GspCipher; GSP_MAX_COUNT],
+    pub supported_status_flags: u32,
+}
+
+/// VM GSP response buffer descriptor owned by the RPC caller (matches IDL GspResponseInfo).
+#[repr(C)]
+pub struct GspResponseInfo {
+    pub encrypted_gsp: GspCipher,
+    pub decrypted_gsp: [GspClear; GSP_MAX_COUNT],
+    pub response_status_flags: u32,
+}
+
+// Compile-time size checks to ensure structures match IDL definitions
+// GspClear: 4 (length) + 64 (buffer) = 68 bytes
+const _: () = assert!(size_of::<GspClear>() == 68);
+// GspCipher: 4 (length) + 512 (buffer) = 516 bytes
+const _: () = assert!(size_of::<GspCipher>() == 516);
+// GspRequestInfo: 68 (GspClear) + 1032 (2 x GspCipher) + 4 (flags) = 1104 bytes
+const _: () = assert!(size_of::<GspRequestInfo>() == 1104);
+// GspResponseInfo: 516 (GspCipher) + 136 (2 x GspClear) + 4 (flags) = 656 bytes
+const _: () = assert!(size_of::<GspResponseInfo>() == 656);
+
+fn write_response_size(ptr: *mut u32, value: u32) -> Result<(), HRESULT> {
+    if ptr.is_null() {
+        Err(E_POINTER)
+    } else {
+        // SAFETY: memory access
+        unsafe {
+            *ptr = value;
+        }
+        Ok(())
+    }
+}
+
+/// Copies `buffer` to the destination pointer `dest`.
+///
+/// # Safety Requirements
+/// The caller must ensure:
+/// - `dest` is valid for writes of `buffer.len()` bytes
+/// - `dest` does not overlap with `buffer`
+fn copy_to_buffer(buffer: &[u8], dest: *mut u8, dest_size: usize) {
+    debug_assert!(
+        buffer.len() <= dest_size,
+        "buffer length {} exceeds destination size {}",
+        buffer.len(),
+        dest_size
+    );
+    debug_assert!(!dest.is_null() || buffer.is_empty());
+
+    if !buffer.is_empty() {
+        // SAFETY: Caller guarantees dest has sufficient space (verified by debug_assert above).
+        unsafe {
+            ptr::copy_nonoverlapping(buffer.as_ptr(), dest, buffer.len());
+        }
+    }
+}
+
+fn format_hresult(hr: HRESULT) -> String {
+    format!("{:#010x}", hr as u32)
+}
+
+fn read_guid(ptr: *const Guid) -> Option<Guid> {
+    if ptr.is_null() {
+        None
+    } else {
+        // SAFETY: memory access
+        Some(unsafe { *ptr })
+    }
+}
+
+fn read_utf16(ptr: *const u16) -> Option<String> {
+    const MAX_LEN: usize = 1024;
+
+    if ptr.is_null() {
+        return None;
+    }
+
+    // SAFETY: The caller (RPC runtime) is responsible for providing valid pointers.
+    // This is a test server, so we trust the RPC infrastructure to provide valid data.
+    unsafe {
+        let mut len = 0usize;
+
+        // Scan for null terminator with bounds checking
+        while len < MAX_LEN {
+            if *ptr.add(len) == 0 {
+                break;
+            }
+            len += 1;
+        }
+
+        // If we hit MAX_LEN without finding a null terminator, truncate
+        if len == MAX_LEN {
+            len = MAX_LEN - 1;
+        }
+
+        let slice = slice::from_raw_parts(ptr, len);
+        String::from_utf16(slice).ok()
+    }
+}
+
+/// Entry point that services `RpcIGVmAttest` requests for the test agent.
+// SAFETY: FFI
+#[unsafe(export_name = "RpcIGVmAttest")]
+pub extern "system" fn rpc_igvm_attest(
+    _binding_handle: *mut c_void,
+    vm_id: *const Guid,
+    request_id: *const Guid,
+    vm_name: *const u16,
+    agent_data_size: u32,
+    _agent_data: *const u8,
+    report_size: u32,
+    report: *const u8,
+    response_buffer_size: u32,
+    response_written_size: *mut u32,
+    response: *mut u8,
+) -> HRESULT {
+    let vm_id_str = read_guid(vm_id).map(|g| g.to_string());
+    let request_id_str = read_guid(request_id).map(|g| g.to_string());
+    let vm_name_str = read_utf16(vm_name);
+
+    tracing::info!(
+        vm_id = vm_id_str.as_deref().unwrap_or("<null>"),
+        request_id = request_id_str.as_deref().unwrap_or("<null>"),
+        vm_name = vm_name_str.as_deref().unwrap_or("<unknown>"),
+        agent_data_size,
+        report_size,
+        response_buffer_size,
+        "RpcIGVmAttest request received"
+    );
+
+    if let Err(err) = write_response_size(response_written_size, 0) {
+        tracing::error!(
+            hresult = format_hresult(err),
+            "failed to clear response size"
+        );
+        return err;
+    }
+
+    // SAFETY: memory access
+    let report_slice = unsafe {
+        if report_size == 0 {
+            &[][..]
+        } else if report.is_null() {
+            tracing::error!("report pointer is null while report_size > 0");
+            return E_INVALIDARG;
+        } else {
+            slice::from_raw_parts(report, report_size as usize)
+        }
+    };
+
+    tracing::debug!(
+        payload_bytes = report_slice.len(),
+        "invoking attest igvm_agent"
+    );
+
+    let payload = match igvm_agent::process_igvm_attest(report_slice) {
+        Ok(payload) => payload,
+        Err(err) => {
+            tracing::error!(?err, "igvm_agent::process_igvm_attest failed");
+            return E_FAIL;
+        }
+    };
+
+    let payload_len = payload.len() as u32;
+
+    if payload_len > response_buffer_size {
+        tracing::warn!(
+            required = payload_len,
+            available = response_buffer_size,
+            "response buffer too small for attest payload"
+        );
+        return E_OUTOFMEMORY;
+    }
+
+    if payload_len > 0 {
+        if response.is_null() {
+            tracing::error!("response buffer pointer is null while payload_len > 0");
+            return E_INVALIDARG;
+        }
+        copy_to_buffer(&payload, response, response_buffer_size as usize);
+    }
+
+    if let Err(err) = write_response_size(response_written_size, payload_len) {
+        tracing::error!(hresult = format_hresult(err), "failed to set response size");
+        return err;
+    }
+
+    tracing::info!(
+        response_size = payload_len,
+        "RpcIGVmAttest completed successfully"
+    );
+
+    S_OK
+}
+
+/// Entry point that services `RpcVmGspRequest` calls for the test agent.
+///
+/// This function is currently disabled and will raise RPC_S_SERVER_UNAVAILABLE.
+// SAFETY: FFI
+#[unsafe(export_name = "RpcVmGspRequest")]
+pub extern "system" fn rpc_vm_gsp_request(
+    _binding_handle: *mut c_void,
+    _vm_id: *const Guid,
+    _vm_name: *const u16,
+    request_data: *const GspRequestInfo,
+    response_data: *mut GspResponseInfo,
+) -> HRESULT {
+    // Log the request parameters before raising the exception
+    let vm_id_str = read_guid(_vm_id).map(|g| g.to_string());
+    let vm_name_str = read_utf16(_vm_name);
+
+    // Now we can safely dereference the structures since they match the IDL definitions
+    let (new_gsp_len, encrypted_gsp_count, supported_flags) = if !request_data.is_null() {
+        // SAFETY: memory access
+        let request = unsafe { &*request_data };
+        let encrypted_count = request
+            .encrypted_gsp
+            .iter()
+            .filter(|gsp| gsp.length > 0)
+            .count();
+        (
+            request.new_gsp.length,
+            encrypted_count,
+            request.supported_status_flags,
+        )
+    } else {
+        (0, 0, 0)
+    };
+
+    let (response_encrypted_len, response_decrypted_count, response_flags) =
+        if !response_data.is_null() {
+            // SAFETY: memory access
+            let response = unsafe { &*response_data };
+            let decrypted_count = response
+                .decrypted_gsp
+                .iter()
+                .filter(|gsp| gsp.length > 0)
+                .count();
+            (
+                response.encrypted_gsp.length,
+                decrypted_count,
+                response.response_status_flags,
+            )
+        } else {
+            (0, 0, 0)
+        };
+
+    tracing::warn!(
+        vm_id = vm_id_str.as_deref().unwrap_or("<null>"),
+        vm_name = vm_name_str.as_deref().unwrap_or("<unknown>"),
+        new_gsp_length = new_gsp_len,
+        encrypted_gsp_count = encrypted_gsp_count,
+        supported_status_flags = supported_flags,
+        response_encrypted_length = response_encrypted_len,
+        response_decrypted_count = response_decrypted_count,
+        response_status_flags = response_flags,
+        "RpcVmGspRequest called but support is disabled - raising RPC_S_SERVER_UNAVAILABLE"
+    );
+
+    // Raise RPC_S_SERVER_UNAVAILABLE exception
+    // SAFETY: Make an FFI call
+    unsafe {
+        RpcRaiseException(RPC_S_SERVER_UNAVAILABLE);
+    }
+
+    // This line is never reached due to RpcRaiseException
+    unreachable!();
+}
diff --git a/vm/devices/get/test_igvm_agent_rpc_server/src/rpc/igvm_agent.rs b/vm/devices/get/test_igvm_agent_rpc_server/src/rpc/igvm_agent.rs
new file mode 100644
index 0000000000..0c7ad429c5
--- /dev/null
+++ b/vm/devices/get/test_igvm_agent_rpc_server/src/rpc/igvm_agent.rs
@@ -0,0 +1,51 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Shared façade that exposes the test IGVM agent through a singleton instance.
+
+use parking_lot::Mutex;
+use std::sync::OnceLock;
+use test_igvm_agent_lib::Error;
+use test_igvm_agent_lib::IgvmAgentTestSetting;
+use test_igvm_agent_lib::TestIgvmAgent;
+
+/// Errors surfaced by the test IGVM agent façade.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum TestAgentFacadeError {
+    /// The request payload could not be processed by the agent.
+    InvalidRequest,
+    /// The underlying agent reported an unexpected failure.
+    AgentFailure,
+}
+
+/// Convenience result type for façade invocations.
+pub type TestAgentResult<T> = Result<T, TestAgentFacadeError>;
+
+static TEST_AGENT: OnceLock<Mutex<TestIgvmAgent>> = OnceLock::new();
+
+fn global_agent() -> &'static Mutex<TestIgvmAgent> {
+    TEST_AGENT.get_or_init(|| Mutex::new(TestIgvmAgent::new()))
+}
+
+fn guard_agent() -> parking_lot::MutexGuard<'static, TestIgvmAgent> {
+    global_agent().lock()
+}
+
+/// Install a scripted test plan for the shared test agent instance.
+pub fn install_plan(setting: &IgvmAgentTestSetting) {
+    let mut agent = guard_agent();
+    agent.install_plan_from_setting(setting);
+}
+
+/// Process an attestation request payload using the shared test agent.
+pub fn process_igvm_attest(report: &[u8]) -> TestAgentResult<Vec<u8>> {
+    let mut agent = guard_agent();
+    let (payload, expected_len) = agent.handle_request(report).map_err(|err| match err {
+        Error::InvalidIgvmAttestRequest => TestAgentFacadeError::InvalidRequest,
+        _ => TestAgentFacadeError::AgentFailure,
+    })?;
+    if payload.len() != expected_len as usize {
+        return Err(TestAgentFacadeError::InvalidRequest);
+    }
+    Ok(payload)
+}
diff --git a/vm/devices/get/test_igvm_agent_rpc_server/src/rpc/mod.rs b/vm/devices/get/test_igvm_agent_rpc_server/src/rpc/mod.rs
new file mode 100644
index 0000000000..ca906dbcbc
--- /dev/null
+++ b/vm/devices/get/test_igvm_agent_rpc_server/src/rpc/mod.rs
@@ -0,0 +1,11 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+// UNSAFETY: Windows FFI
+#![expect(unsafe_code)]
+
+pub use server::run_server;
+
+mod handlers;
+pub mod igvm_agent;
+mod server;
diff --git a/vm/devices/get/test_igvm_agent_rpc_server/src/rpc/server.rs b/vm/devices/get/test_igvm_agent_rpc_server/src/rpc/server.rs
new file mode 100644
index 0000000000..3933257900
--- /dev/null
+++ b/vm/devices/get/test_igvm_agent_rpc_server/src/rpc/server.rs
@@ -0,0 +1,185 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+use core::ffi::c_void;
+use std::ffi::OsStr;
+use std::os::windows::ffi::OsStrExt;
+use std::ptr;
+use std::sync::atomic::AtomicBool;
+use std::sync::atomic::Ordering;
+use winapi::shared::minwindef::BOOL;
+use windows_sys::Win32::Foundation::FALSE;
+use windows_sys::Win32::Foundation::TRUE;
+use windows_sys::Win32::System::Console::CTRL_BREAK_EVENT;
+use windows_sys::Win32::System::Console::CTRL_C_EVENT;
+use windows_sys::Win32::System::Console::CTRL_CLOSE_EVENT;
+use windows_sys::Win32::System::Console::CTRL_SHUTDOWN_EVENT;
+use windows_sys::Win32::System::Console::SetConsoleCtrlHandler;
+use windows_sys::Win32::System::Rpc::RPC_C_LISTEN_MAX_CALLS_DEFAULT;
+use windows_sys::Win32::System::Rpc::RPC_C_PROTSEQ_MAX_REQS_DEFAULT;
+use windows_sys::Win32::System::Rpc::RPC_S_NOT_LISTENING;
+use windows_sys::Win32::System::Rpc::RPC_S_OK;
+use windows_sys::Win32::System::Rpc::RPC_STATUS;
+use windows_sys::Win32::System::Rpc::RpcMgmtStopServerListening;
+use windows_sys::Win32::System::Rpc::RpcServerListen;
+use windows_sys::Win32::System::Rpc::RpcServerRegisterIf3;
+use windows_sys::Win32::System::Rpc::RpcServerUnregisterIf;
+use windows_sys::Win32::System::Rpc::RpcServerUseProtseqEpW;
+
+pub const PROTOCOL_SEQUENCE: &str = "ncalrpc";
+pub const ENDPOINT: &str = "IGVM_AGENT_RPC_SERVER";
+
+pub type RpcInterfaceHandle = *mut c_void;
+
+// SAFETY: FFI handle
+unsafe extern "C" {
+    pub static IGVmAgentRpcApi_v1_0_s_ifspec: RpcInterfaceHandle;
+}
+
+fn to_wide(s: &str) -> Vec<u16> {
+    OsStr::new(s).encode_wide().chain([0]).collect()
+}
+
+/// # SAFETY
+/// The callback for the passing through FFI
+unsafe extern "system" fn rpc_bind_callback(
+    _context: *const c_void,
+    _uuid: *const c_void,
+) -> RPC_STATUS {
+    tracing::debug!("rpc_bind_callback invoked");
+    RPC_S_OK
+}
+
+static STOP_REQUESTED: AtomicBool = AtomicBool::new(false);
+
+/// # SAFETY
+/// Used by RPC handler registration.
+unsafe extern "system" fn console_ctrl_handler(ctrl_type: u32) -> BOOL {
+    match ctrl_type {
+        CTRL_C_EVENT | CTRL_BREAK_EVENT | CTRL_CLOSE_EVENT | CTRL_SHUTDOWN_EVENT => {
+            if !STOP_REQUESTED.swap(true, Ordering::SeqCst) {
+                tracing::info!("console control signal {ctrl_type} received; requesting shutdown");
+                // SAFETY: Make an FFI call.
+                let status = unsafe { RpcMgmtStopServerListening(ptr::null_mut()) };
+                if status != RPC_S_OK && status != RPC_S_NOT_LISTENING {
+                    tracing::error!("RpcMgmtStopServerListening failed: {status}");
+                }
+            }
+            TRUE
+        }
+        _ => FALSE,
+    }
+}
+
+struct ConsoleHandlerGuard;
+
+impl ConsoleHandlerGuard {
+    fn register() -> Result<Self, String> {
+        // SAFETY: Make an FFI call.
+        unsafe {
+            if SetConsoleCtrlHandler(Some(console_ctrl_handler), TRUE) == 0 {
+                return Err("SetConsoleCtrlHandler failed".to_owned());
+            }
+        }
+        tracing::info!("console control handler registered");
+
+        Ok(Self)
+    }
+}
+
+impl Drop for ConsoleHandlerGuard {
+    fn drop(&mut self) {
+        // SAFETY: Make an FFI call.
+        unsafe {
+            SetConsoleCtrlHandler(Some(console_ctrl_handler), FALSE);
+        }
+    }
+}
+
+fn register_protocol_and_interface() -> Result<(), String> {
+    tracing::info!(protocol = %PROTOCOL_SEQUENCE, endpoint = %ENDPOINT, "registering RPC protocol");
+    let mut protocol_seq = to_wide(PROTOCOL_SEQUENCE);
+    let mut endpoint = to_wide(ENDPOINT);
+
+    // SAFETY: Make an FFI call.
+    let status = unsafe {
+        RpcServerUseProtseqEpW(
+            protocol_seq.as_mut_ptr(),
+            RPC_C_PROTSEQ_MAX_REQS_DEFAULT,
+            endpoint.as_mut_ptr(),
+            ptr::null_mut(),
+        )
+    };
+
+    if status != RPC_S_OK {
+        tracing::error!(status = status, "RpcServerUseProtseqEpW failed");
+        return Err(format!("RpcServerUseProtseqEpW failed: {status}"));
+    }
+
+    tracing::info!("RPC protocol bound successfully");
+
+    // SAFETY: Make an FFI call.
+    let status = unsafe {
+        RpcServerRegisterIf3(
+            IGVmAgentRpcApi_v1_0_s_ifspec,
+            ptr::null_mut(),
+            ptr::null_mut(),
+            0,
+            RPC_C_LISTEN_MAX_CALLS_DEFAULT,
+            0,
+            Some(rpc_bind_callback),
+            ptr::null_mut(),
+        )
+    };
+    if status != RPC_S_OK {
+        tracing::error!(status = status, "RpcServerRegisterIf3 failed");
+        return Err(format!("RpcServerRegisterIf3 failed: {status}"));
+    }
+
+    tracing::info!("RPC interface registered");
+    Ok(())
+}
+
+fn unregister_interface() {
+    // SAFETY: Make an FFI call.
+    unsafe {
+        RpcServerUnregisterIf(IGVmAgentRpcApi_v1_0_s_ifspec, ptr::null_mut(), 0);
+    }
+    tracing::info!("RPC interface unregistered");
+}
+
+/// Run the IGVM agent RPC server until it is interrupted.
+pub fn run_server() -> Result<(), String> {
+    tracing::info!("starting IGVM agent RPC server");
+    register_protocol_and_interface()?;
+    let _handler = ConsoleHandlerGuard::register()?;
+
+    // Close stdout to signal that the server is ready to accept connections.
+    // The test harness waits for stdout EOF before proceeding.
+    // We must close the actual file descriptor, not just drop the Rust handle.
+    // SAFETY: Make FFI calls.
+    unsafe {
+        use windows_sys::Win32::Foundation::CloseHandle;
+        use windows_sys::Win32::System::Console::GetStdHandle;
+        use windows_sys::Win32::System::Console::STD_OUTPUT_HANDLE;
+        let stdout_handle = GetStdHandle(STD_OUTPUT_HANDLE);
+        if !stdout_handle.is_null() {
+            CloseHandle(stdout_handle);
+            tracing::info!("closed stdout to signal readiness");
+        }
+    }
+
+    // SAFETY: Make an FFI call.
+    let listen_status = unsafe { RpcServerListen(1, RPC_C_LISTEN_MAX_CALLS_DEFAULT, 0) };
+
+    unregister_interface();
+
+    if listen_status != RPC_S_OK {
+        tracing::error!(status = listen_status, "RpcServerListen failed");
+        return Err(format!("RpcServerListen failed: {listen_status}"));
+    }
+
+    tracing::info!("IGVM agent RPC server stopped cleanly");
+
+    Ok(())
+}
diff --git a/vmm_tests/petri_artifact_resolver_openvmm_known_paths/src/lib.rs b/vmm_tests/petri_artifact_resolver_openvmm_known_paths/src/lib.rs
index 2c4fa6c9c6..4a3ae06dc5 100644
--- a/vmm_tests/petri_artifact_resolver_openvmm_known_paths/src/lib.rs
+++ b/vmm_tests/petri_artifact_resolver_openvmm_known_paths/src/lib.rs
@@ -95,6 +95,10 @@ impl petri_artifacts_core::ResolveTestArtifact for OpenvmmKnownPathsTestArtifact
                 tpm_guest_tests_linux_path(MachineArch::X86_64)
             }
 
+            _ if id == host_tools::TEST_IGVM_AGENT_RPC_SERVER_WINDOWS_X64 => {
+                test_igvm_agent_rpc_server_windows_path(MachineArch::X86_64)
+            }
+
             _ => anyhow::bail!("no support for given artifact type"),
         }
     }
@@ -277,6 +281,19 @@ fn tpm_guest_tests_linux_path(arch: MachineArch) -> anyhow::Result<PathBuf> {
     )
 }
 
+/// Path to the output location of the test_igvm_agent_rpc_server executable.
+fn test_igvm_agent_rpc_server_windows_path(arch: MachineArch) -> anyhow::Result<PathBuf> {
+    let target = windows_msvc_target(arch);
+    get_path(
+        format!("target/{target}/debug"),
+        "test_igvm_agent_rpc_server.exe",
+        MissingCommand::Build {
+            package: "test_igvm_agent_rpc_server",
+            target: Some(target),
+        },
+    )
+}
+
 fn tmk_vmm_paravisor_path(arch: MachineArch) -> anyhow::Result<PathBuf> {
     let target = match arch {
         MachineArch::X86_64 => "x86_64-unknown-linux-musl",
diff --git a/vmm_tests/petri_artifacts_vmm_test/src/lib.rs b/vmm_tests/petri_artifacts_vmm_test/src/lib.rs
index fc66308285..17126a2b87 100644
--- a/vmm_tests/petri_artifacts_vmm_test/src/lib.rs
+++ b/vmm_tests/petri_artifacts_vmm_test/src/lib.rs
@@ -54,6 +54,16 @@ pub mod artifacts {
         }
     }
 
+    /// Host-side tools used by the VMM tests.
+    pub mod host_tools {
+        use petri_artifacts_core::declare_artifacts;
+
+        declare_artifacts! {
+            /// Windows x86_64 build of the `test_igvm_agent_rpc_server` executable.
+            TEST_IGVM_AGENT_RPC_SERVER_WINDOWS_X64,
+        }
+    }
+
     /// Loadable artifacts
     pub mod loadable {
         use petri_artifacts_common::tags::IsLoadable;
diff --git a/vmm_tests/vmm_tests/tests/tests/multiarch/tpm.rs b/vmm_tests/vmm_tests/tests/tests/multiarch/tpm.rs
index 7895aec8bf..1c86b6dae8 100644
--- a/vmm_tests/vmm_tests/tests/tests/multiarch/tpm.rs
+++ b/vmm_tests/vmm_tests/tests/tests/multiarch/tpm.rs
@@ -24,6 +24,54 @@ const AK_CERT_TOTAL_BYTES: usize = 4096;
 const TPM_GUEST_TESTS_LINUX_GUEST_PATH: &str = "/tmp/tpm_guest_tests";
 const TPM_GUEST_TESTS_WINDOWS_GUEST_PATH: &str = "C:\\tpm_guest_tests.exe";
 
+// Utilities for checking if the RPC server is running.
+// In CI, the RPC server is started by flowey before tests run.
+// For local development, the server can be started manually.
+#[cfg(windows)]
+pub mod windows {
+    /// Checks if any process with the given executable name is running.
+    pub fn is_process_running(exe_name: &str) -> bool {
+        use std::process::Command;
+
+        // Use tasklist to check if the process is running
+        let output = Command::new("tasklist")
+            .args(["/FI", &format!("IMAGENAME eq {}", exe_name), "/NH"])
+            .output();
+
+        match output {
+            Ok(output) => {
+                let stdout = String::from_utf8_lossy(&output.stdout);
+                // tasklist returns "INFO: No tasks are running..." if no match found.
+                // If a process is found, it shows the process info without "INFO: No tasks".
+                !stdout.contains("INFO: No tasks")
+            }
+            Err(e) => {
+                tracing::warn!("failed to run tasklist: {}", e);
+                false
+            }
+        }
+    }
+
+    /// Verifies that the RPC server is running.
+    /// In CI, the server is started by flowey before tests run.
+    /// Returns an error if the server is not running.
+    pub fn ensure_rpc_server_running() -> anyhow::Result<()> {
+        const RPC_SERVER_EXE: &str = "test_igvm_agent_rpc_server.exe";
+
+        if is_process_running(RPC_SERVER_EXE) {
+            tracing::info!(exe = RPC_SERVER_EXE, "RPC server is running");
+            Ok(())
+        } else {
+            anyhow::bail!(
+                "RPC server ({}) is not running. \
+                In CI, the server should be started by flowey. \
+                For local development, start the server manually before running tests.",
+                RPC_SERVER_EXE
+            )
+        }
+    }
+}
+
 fn expected_ak_cert_hex() -> String {
     use std::fmt::Write as _;
 
@@ -440,6 +488,10 @@ async fn tpm_test_platform_hierarchy_disabled(
 // }
 
 /// CVM with guest tpm tests on Hyper-V.
+///
+/// The test requires the test_igvm_agent_rpc_server to be running.
+/// In CI, the server is started by flowey before tests run.
+/// For local development, start the server manually before running tests.
 #[cfg(windows)]
 #[vmm_test(
     hyperv_openhcl_uefi_x64[vbs](vhd(ubuntu_2504_server_x64))[TPM_GUEST_TESTS_LINUX_X64],
@@ -454,10 +506,13 @@ async fn cvm_tpm_guest_tests<T, U: PetriVmmBackend>(
     extra_deps: (ResolvedArtifact<T>,),
 ) -> anyhow::Result<()> {
     let os_flavor = config.os_flavor();
-    // TODO: Add test IGVMAgent RPC server to support the boot-time attestation.
+
+    // Verify the RPC server is running (started by flowey in CI)
+    windows::ensure_rpc_server_running()?;
+
     let config = config
         .with_tpm(true)
-        .with_tpm_state_persistence(false)
+        .with_tpm_state_persistence(true)
         .with_guest_state_lifetime(PetriGuestStateLifetime::Disk);
 
     let (vm, agent) = config.run().await?;
@@ -473,14 +528,16 @@ async fn cvm_tpm_guest_tests<T, U: PetriVmmBackend>(
         TpmGuestTests::send_tpm_guest_tests(&agent, host_binary_path, guest_binary_path, os_flavor)
             .await?;
 
-    // TODO: Add test IGVMAgent RPC server to support AK Cert
-    // let expected_hex = expected_ak_cert_hex();
-    // let ak_cert_output = tpm_guest_tests.read_ak_cert_with_expected_hex(expected_hex.as_str()).await?;
+    // Verify AK cert with the test IGVM agent RPC server
+    let expected_hex = expected_ak_cert_hex();
+    let ak_cert_output = tpm_guest_tests
+        .read_ak_cert_with_expected_hex(expected_hex.as_str())
+        .await?;
 
-    // ensure!(
-    //     ak_cert_output.contains("AK certificate matches expected value"),
-    //     format!("{ak_cert_output}")
-    // );
+    ensure!(
+        ak_cert_output.contains("AK certificate matches expected value"),
+        format!("{ak_cert_output}")
+    );
 
     let report_output = tpm_guest_tests
         .read_report()