v0.17.0 — MCP network isolation

MCP network isolation (fail-closed)

Community MCP servers no longer have an open default-network path. A community MCP runs only when it is pinned and preinstalled into a sealed volume — with no network by default, or a sealed egress allowlist when it declares mcp_allowed_domains — and non-preinstalled runtime-fetch servers are refused.

Changed

• Community MCP servers run only when pinned + preinstalled (sealed volume): --network none by default, or a sealed egress allowlist when the package declares mcp_allowed_domains.

Hardened

• Removed the open-network runtime-fetch path for community MCPs. Non-preinstalled / floating (npx/uvx/latest/git/url) community MCPs are refused fail-closed. The old network_level→open grant path is no longer honored for community MCP runtime execution.

⚠️ BREAKING / Upgrade Notes

• Community MCP servers that ship only an mcp_command (floating npx/uvx runtime fetch) are now refused instead of running with an open network. To migrate: declare an exact pinned mcp_install so the server is preinstalled into a sealed volume, and declare mcp_allowed_domains for any runtime egress; without declared domains the server runs with no network.
• The credentialed MCP secret flow is unchanged. Curated/trusted MCP behavior is unchanged.

Install: pip install -U agentnode-sdk==0.17.0 · PyPI