Skip to content

WSO2 Agent Manager v1.0.0-alpha1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Jul 07:00
amp/v1.0.0-alpha1
1d5d7e2

🚀 Highlights

This release introduces first-class Agent Identity (provisioning, credentials, roles, and groups for platform-hosted and external agents), agent sandboxing, a revamped MCP Proxy with per-environment endpoints and per-proxy scopes, .NET external-agent instrumentation, and a simplified one-command VM install.

Key Updates

  • Agent Identity

    • AgentID provisioning with regenerate and revoke endpoints
    • Per-agent OAuth credentials injected into platform-hosted agent pods
    • Role and group management for agents, plus external agent identity management
    • Agent Identity console UI and MCP proxy agent identity

  • Agent Sandboxing

    • Agent sandboxing introduced into Agent Manager
    • Sandboxed agent connectivity to OTEL, LLM, and MCP gateways

  • MCP Proxy

    • MCP proxy UX revamp with a per-environment endpoint model
    • Per-proxy resource-server scopes for MCP proxies
    • Refactored MCP endpoint registration
    • Observability reads and MCP tools consolidated into agent-manager-observer

  • Identity, OAuth & Gateway

    • Environment-specific identity providers (env-ThunderID)
    • Dataplane Thunder instances registered as gateway identity providers
    • Org data scoped by Thunder OU ID instead of org name
    • env-Thunder system-client secret moved to encrypted storage in the AMS database
    • API Platform Gateway isolated per org-environment namespace

  • Observability & Instrumentation

    • .NET external-agent instrumentation support
    • Instrumentation version selectable on deploy/promote and returned in the agent read path
    • Python instrumentation provider 0.4.0 with locked image dependencies

  • Agent Config & Labels

    • Agent config API key management
    • Label support for Agents and Agent Kinds
    • LLM guardrail policies sourced from the gateway manifest

  • Console & UI

    • Org settings page and refactored profile settings UX
    • Improved Environment and Gateway pages
    • Feature flags for repository and user management

  • Installation & Deployment

    • One-command VM install with a bootstrap script and tool preflight
    • Advanced VM install with cert-manager DNS-01 (Caddy/lego dropped)
    • Quick-start install resources bundled into the image
    • OpenBao tokens stored in a chart Secret instead of plaintext env

📦 Components

Component Description
amp-console React 19 + Oxygen UI web dashboard with Agent Identity management, per-environment MCP proxy UX, org settings, and feature-flagged repository/user management
amp-api Go-based backend API with Agent Identity provisioning, agent sandboxing, OpenChoreo-based org/namespace resolution, per-env gateway isolation, and encrypted secret storage
amp-observer Consolidated observability reads and MCP tools service (formerly amp-traces-observer)
amp-evaluation-monitor Evaluation monitor service, with monitors cleaned up on agent deletion
amp-python-instrumentation-provider Init container for automatic Python agent instrumentation (0.3.0 and 0.4.0 / traceloop-sdk)
amp-quick-start Quick start setup container with install resources bundled into the image
amctl CLI for managing agents, projects, deployments, observability, skills, LLM providers/configs, and MCP proxy configs

🐳 Docker Images

ghcr.io/wso2/amp-console:v1.0.0-alpha1
ghcr.io/wso2/amp-api:v1.0.0-alpha1
ghcr.io/wso2/amp-observer:v1.0.0-alpha1
ghcr.io/wso2/amp-quick-start:v1.0.0-alpha1
ghcr.io/wso2/amp-evaluation-monitor:v1.0.0-alpha1
ghcr.io/wso2/amp-python-instrumentation-provider:0.3.0-python3.10
ghcr.io/wso2/amp-python-instrumentation-provider:0.3.0-python3.11
ghcr.io/wso2/amp-python-instrumentation-provider:0.3.0-python3.12
ghcr.io/wso2/amp-python-instrumentation-provider:0.3.0-python3.13
ghcr.io/wso2/amp-python-instrumentation-provider:0.4.0-python3.10
ghcr.io/wso2/amp-python-instrumentation-provider:0.4.0-python3.11
ghcr.io/wso2/amp-python-instrumentation-provider:0.4.0-python3.12
ghcr.io/wso2/amp-python-instrumentation-provider:0.4.0-python3.13

⎈ Helm Charts

oci://ghcr.io/wso2/wso2-agent-manager:1.0.0-alpha1
oci://ghcr.io/wso2/wso2-amp-observability-extension:1.0.0-alpha1
oci://ghcr.io/wso2/wso2-amp-platform-resources-extension:1.0.0-alpha1
oci://ghcr.io/wso2/wso2-amp-thunder-extension:1.0.0-alpha1
oci://ghcr.io/wso2/wso2-amp-evaluation-extension:1.0.0-alpha1
oci://ghcr.io/wso2/wso2-amp-api-platform-gateway-extension:1.0.0-alpha1

💻 CLI (amctl)

Prebuilt amctl binaries (Linux, macOS, Windows) and checksums.txt are attached to this release.

🖥️ VM Install Bundle

amp-vm-bundle-1.0.0-alpha1.tar.gz and bootstrap.sh are attached for the one-command VM install:

curl -fsSL https://github.com/wso2/agent-manager/releases/download/amp/v1.0.0-alpha1/bootstrap.sh | sudo bash -s -- simple --host <PUBLIC_IP> --version 1.0.0-alpha1

📚 Samples

📖 Documentation

See the Quick Start Guide for installation and setup instructions.

🔧 What's Changed

Agent Identity

  • Add AgentID provisioning with regenerate and revoke endpoints by @yashed in #1251
  • Make AgentID provisioning a deployment-injected dependency by @hanzjk in #1279
  • Add MCP proxy Agent Identity by @jhivandb in #1265
  • Add AgentID identity/credentials endpoints to OpenAPI spec by @yashed in #1288
  • Inject AgentID credentials into platform-hosted agent pods by @yashed in #1274
  • UI implementation for Agent Identity by @rasika2012 in #1302
  • Fix agent identity role assignments dropping agent assignees by @jhivandb in #1323
  • Hide env-Thunder native Administrator role from agent identity APIs by @jhivandb in #1334
  • Add AgentID console guidance, fix MCP proxy security dialog, remove dead credential endpoint by @yashed in #1349
  • Refactor agent identity components for UI consistency and improved display by @rasika2012 in #1342
  • Add external agent identity management and integrate with ManageIdentityDrawer by @rasika2012 in #1353
  • Enhance AgentDetailPage with role and group management by @rasika2012 in #1363

Agent Sandboxing

  • Introduce agent sandboxing in to agent manager by @vish-mv in #1281
  • Fix sandboxed agent connectivity to OTEL, LLM, and MCP gateways by @vish-mv in #1356

MCP Proxy

  • Mcp proxy ux revamp by @Oshanath in #1258
  • Update MCP proxy docs for per-environment endpoint model by @Oshanath in #1264
  • Refactor MCP endpoint registration by @menakaj in #1296
  • Add per-proxy resource-server scopes for MCP proxies by @jhivandb in #1304
  • Include undeployed identity proxy scopes in env catalog by @jhivandb in #1314
  • Consolidate observability reads and MCP tools into agent-manager-observer by @jhivandb in #1340

Identity, OAuth & Gateway

  • feat: Introduce environment-specific identity providers (env-ThunderID) by @yashed in #1214
  • Register Dataplane Thunder instances as gateway identity providers by @AnoshanJ in #1257
  • Fix JWTAuth policy Issuer name mismatch for Dataplane IDP registrations by @AnoshanJ in #1273
  • Scope org data by Thunder OU ID instead of org name by @hanzjk in #1266
  • Update orgUid field name to orgId by @hanzjk in #1275
  • Remove deployment-mode based organization listing and resolve organization using OpenChoreo by @AnoshanJ in #1256
  • Add HeaderImpersonateOrg header for oc api calls by @hanzjk in #1341
  • Resolve namespace for ou id by @hanzjk in #1292
  • Isolate API Platform Gateway per org-environment namespace by @hanzjk in #1294
  • Consolidate AMP services onto OpenChoreo plane gateways by @RAVEENSR in #1295
  • Fix amp-api scopes by @jhivandb in #1318
  • Move env-Thunder system-client secret from OpenBao to encrypted storage in AMS's database by @yashed in #1354
  • Store OpenBao tokens in chart Secret instead of plaintext env by @jhivandb in #1330

Observability & Instrumentation

  • Add .NET external-agent instrumentation support by @RAVEENSR in #1282
  • Support instrumentation version on deploy/promote by @RAVEENSR in #1259
  • Return instrumentation version in agent read path by @RAVEENSR in #1261
  • Lock instrumentation-provider image dependencies by @RAVEENSR in #1267
  • Add default namespace for traces-observer organization queries by @AnoshanJ in #1286
  • Bind OTEL route and update quick-start on gateway readiness for agent traces by @vish-mv in #1368
  • Remove unused OTEL collector configs and add NetworkPolicy for Otel Collector ingress by @AnoshanJ in #1361

Agent Config, Labels & Guardrails

  • Agent config api key management by @Oshanath in #1195
  • Add label support for Agents and Agent Kinds by @vish-mv in #1325
  • Define SystemLabelKeyPrefixes as a configurable array by @hanzjk in #1357
  • Source LLM guardrail policies from gateway manifest instead of policy hub by @vish-mv in #1362
  • Fix agent llm configuration not injecting when creating an agent from kind by @menakaj in #1268
  • Cleanup monitors when deleting agents by @hanzjk in #1298

Build & Catalog

  • Fix build status enum to match emitted workflow phases by @hanzjk in #1299
  • Keep Open API Spec for each build by @hanzjk in #1297
  • Fetch catalog kind schema from build payload instead by @hanzjk in #1300

Console, UI & Extensions

  • Add org settings page and refactor profile settings ux by @rasika2012 in #1239
  • Improve Environment page and Gateway page by @rasika2012 in #1270
  • Add feature flags for repository and user management by @rasika2012 in #1280
  • Refactor ViewLLMProviderComponent to show pipeline environments by @rasika2012 in #1322
  • Improve Test API Keys fetching and retry logic to address intermittent 401 issues during testing by @AnoshanJ in #1260

Installation & Deployment

  • Simplify VM install: one-command bootstrap with tool preflight by @RAVEENSR in #1331
  • Advanced VM install: cert-manager DNS-01, drop Caddy/lego by @RAVEENSR in #1336
  • Fix VM install preflight abort on egress-restricted networks by @RAVEENSR in #1305
  • Store Thunder CA bundle via file to avoid E2BIG by @RAVEENSR in #1311
  • Grant the hook Role configmap access for CA publish by @RAVEENSR in #1335
  • Fix deployed-agent OTEL endpoint on VM installs by @RAVEENSR in #1338
  • Fix env-Thunder IdP host base domain on VM installs by @RAVEENSR in #1337
  • Bundle quick-start install resources into image by @RAVEENSR in #1290
  • fix: quick-start install.sh fails to find thunder-naming.sh in the packaged Docker image by @yashed in #1367

Documentation

Testing, CI & Infrastructure

👥 Contributors

Full Changelog: amp/v0.18.0...amp/v1.0.0-alpha1

Assets 10
Loading