v1.0.3

Every MCP surface moves to MCP 2.0, TealTiger governance gains prompt injection detection, ACP hosts can answer a served agent's human-input requests, and human-input failures now surface instead of hanging.

---

MCP 2.0

Breaking change. Every MCP surface has been ported to MCP 2.0, and the dependency bound is now mcp>=2.0.0,<3. If you pin mcp yourself, or depend on a package that pins it below 2.0, you will need to update that pin before upgrading.

• Ported to MCP 2.0 — Every MCP surface in AG2, client and server, now targets the 2.0 protocol.
• Server metadata — MCP servers can now expose metadata about themselves.
• Conversation handling — Conversation handling updated for the MCP 2.0 model.

Documentation

TealTiger governance: prompt injection detection

TealTigerMiddleware puts deterministic guardrails in front of every tool call an agent makes. There is no LLM in the governance path: each check is an in-process glob or precompiled regex over the serialized tool arguments. It ships with AG2 — no extra package and no API key.

New in this release: prompt injection detection joins the policy set, alongside the existing tool allowlist, PII detection, secret detection and cost limits.

The extension is also now fully documented, covering:

• Three governance modes — ENFORCE blocks violations, MONITOR records what would have been blocked, OBSERVE passes through while tracking cost. Shadow-test in staging, then promote.
• Kill switch and budget — Freeze an agent by name so it can neither take turns nor call tools, and set a hard spending ceiling checked before any policy runs.
• Audit trail — Every decision carries reason codes, a risk score and running cost; every tool evaluation emits a TEEC receipt, executed or blocked.
• Shared across agents — One governance instance can back several agents, sharing decisions, receipts, cost and frozen agents between them.

Contributed and maintained by @nagasatish007.

Documentation / Website

ACP and human input

Two changes that work together: a host can now answer on a served agent's behalf, and a request that nobody can answer fails cleanly rather than stalling.

• Hosts can answer human-input requests — When an AG2 Agent is served over ACP, the host driving it can answer human-input requests the agent raises mid-task.
• Unanswerable requests fail the turn — If no one is in a position to answer a human-input request, the turn now fails rather than waiting on an answer that is not coming.
• ACP 0.12.1 — Upgraded to the current protocol version.

Documentation

Extensions

• Serply search toolkit — A new community search extension.

---

Fixes

• Subagents — persistent_stream() reuses a single stream object rather than creating one per call.
• Evaluations — Async scorer results are awaited.
• Usage accounting — Corrected the sources usage is accounted from.
• Typing — Context manager returns are annotated as Generator rather than Iterator.

---

Documentation and project

• AG-UI Channels — New page in the AG-UI user guide covering Slack bots via CopilotKit Channels.
• A2UI — The minimal server example in a2a.mdx now uses build_card(extensions=...).
• Broken user guide links, directory links, and heading anchors repaired across the site.
• Dependencies audited, with artifacts orphaned by the 1.0 rewrite removed.

---

What's Changed

• docs: add Channels page to AG-UI user guide (Slack bots via CopilotKit Channels) by @mme in #3153
• docs(extensions): add TealTiger governance middleware documentation by @nagasatish007 in #3158
• update acp to 0.12.1 by @vvlrff in #3175
• chore(deps): bump the github-actions group with 2 updates by @dependabot[bot] in #3174
• feat(acp): let a host answer a served agent's human-input request by @marklysze in #3177
• refactor: annotate contextmanager returns as Generator, not Iterator by @vvlrff in #3176
• fix(subagents): reuse one stream object in persistent_stream() by @uuzzrm in #3160
• docs: fix broken user guide links by @Excelius-Wang in #3195
• docs(website): fix directory links and broken heading anchors by @vvlrff in #3196
• fix: await async scorer results by @binaydhakal in #3191
• feat(extensions/tealtiger): add prompt injection detection to governance middleware by @nagasatish007 in #3193
• chore: audit dependencies and remove artifacts orphaned by the 1.0 rewrite by @Lancetnik in #3159
• chore(deps): bump the github-actions group with 2 updates by @dependabot[bot] in #3205
• chore(deps): bump uv dependencies by @vvlrff in #3206
• feat(mcp)!: port every MCP surface to mcp 2.0 and raise the bound to >=2.0.0,<3 by @vvlrff in #3192
• fix: usage accounting sources by @vvlrff in #3161
• feat(mcp): server metadata by @vvlrff in #3199
• feat(extensions/search): add Serply search toolkit by @googio in #3211
• docs(a2ui): use build_card(extensions=...) in a2a.mdx Minimal Server example by @zhj12395 in #3198
• fix(hitl): fail the turn when nobody can answer a human-input request by @vvlrff in #3179
• feat(mcp): implement modern era conversation handling by @vvlrff in #3212
• Version bump to 1.0.3 by @marklysze in #3213

New Contributors

• @mme made their first contribution in #3153
• @Excelius-Wang made their first contribution in #3195
• @binaydhakal made their first contribution in #3191
• @googio made their first contribution in #3211
• @zhj12395 made their first contribution in #3198

Full Changelog: v1.0.2...v1.0.3