Skip to content

agentnode-sdk 0.24.0 — The container is the boundary

Choose a tag to compare

View all tags
@MylesCreator MylesCreator released this 02 Sep 17:41
· 97 commits to main since this release
v0.24.0
4329963
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release makes the execution boundary real rather than advisory. Third-party code that is merely
trusted no longer runs on your host by default, a community agent's own entrypoint cannot run on
the host at all, and the lockfile that decides what may run is integrity-checked at run time. It also
repairs a defect that breaks fresh installs of 0.23.0.

Please read the migration section before upgrading. One shipped default changes in a way you can
feel.

Fixed — you probably want this one

agentnode-sdk declared mcp>=1.0.0 with no upper bound. mcp 2.x removed mcp.server.fastmcp, so a
fresh install of 0.23.0 resolves mcp 2.1.1 and fails at import. The dependency is now
mcp>=1.0.0,<2. Support for mcp 2.x is a migration and will be its own release.

Also fixed: MCP pre-installs no longer run out of disk. Both package managers cached inside the
sandbox's deliberately small 16 MiB HOME, so pre-installing any MCP server with a real dependency
tree failed with No space left on device; the caches now live in the sandbox's own 512 MiB /tmp.
And agentnode mcp verify recognises PyPI == pins the way it already recognised npm @ pins.

Changed — the security model

  • sandbox.host_trust_policy ships as curated_only instead of default. Only AgentNode-owned
    curated code runs directly on your host; trusted third-party toolpacks, MCP servers and agents
    are sandboxed    , and are refused if no container runtime is available. There is never a silent
    fall back to host execution.
  • A community agent's own entrypoint can no longer be executed on the host. The path was removed
    structurally rather than gated: every attempt raises HostAgentExecutionUnsupported instead of
    executing the entrypoint.
  • Lockfile integrity is enforced at run time, in two stages — the per-entry _integrity field
    and a global structure_digest. A valid legacy lockfile is allowed with one migration warning;
    AGENTNODE_GUARD_STRICT=1 denies it.
  • agentnode.lock is parsed fail-closed. Duplicate keys, invalid JSON, an unreadable file, a
    non-object model or a missing/unsupported lockfile_version now raise LockfileFormatError.
  • Direct Mode passes the same gate — run_python's fail-soft fallback is gone.
  • Host Python environments are mutated under an inter-process lock, and runtime-initiated
    installation is disabled.
  • Installs are a transaction: wheel built first, environment locked, content-addressed store,
    durable quarantine, atomic compare-and-remove recovery.
  • The host-trust decision is taken once per run from a single fail-closed snapshot.

The CLI surface is unchanged: 58 subcommands before, 58 after, none added or removed.

Migration

agentnode config get sandbox.host_trust_policy
  • prints default → your config carries the key and nothing changes for you;
  • no config file at all → you now get curated_only.

An on-disk value always wins over the shipped default, and ~/.agentnode/config.json already carries
the key if you have ever run agentnode setup or agentnode config set.

To keep the previous behaviour: agentnode config set sandbox.host_trust_policy default.
To sandbox everything including curated code: … none.

Other things to know:

  • Install Docker or Podman if you use trusted third-party packs. Under curated_only they are
    refused without one. agentnode doctor tells you what is missing.
  • Community agents that relied on host execution stop working. There is no setting that
    re-enables it. Tool packs and MCP servers are unaffected by that removal.
  • A valid existing agentnode.lock keeps working — lockfile_version is unchanged at 0.1, and
    missing integrity fields are warned rather than rejected in the default mode.
  • A malformed agentnode.lock now fails. Repair it, or delete it and reinstall to regenerate.
  • Under AGENTNODE_GUARD_STRICT=1, re-seal before enabling it in CI: strict now also denies a
    missing or mismatched structure digest.

Scope of this release

124 commits since v0.23.0. The only published artefact with any change in that range is
agentnode-sdk; the LangChain/MCP/CrewAI adapters, the npm CLI and the starter packs have no changed
path and are not re-released. Backend and website changes in the range belong to separately deployed
components.

Install: pip install agentnode-sdk==0.24.0

Assets 2
Loading