This release includes 1 security fix for security teams reviewing exposed deployments.
Published 28d
AI Agents & Assistants
✓ No known CVEs patched
This release patches 1 known CVE
Topics
agents
ai
ai-agents
developer-tools
python
Summary
AI summaryFixed a critical IDOR vulnerability in AgentOS MCP tool handlers.
Full changelog
Changelog
New Features:
- Gemini Multimodal File Search: Added multimodal support in the Gemini File Search API (for
google-genai≥1.75.0). See cookbook. - Context Providers: Added
GmailContextProviderandCalendarContextProviderfollowing the same pattern as existing providers (GDrive, Slack, Database). Also updatesGDriveContextProviderto support OAuth in addition to service account auth. - Scheduler: Added scheduler support for Mongo and AsyncMongo Db to run agents, teams, and workflows on a cron in AgentOS.
- Workflow Condition Step: Added
on_errorhandling to theConditionworkflow step, allowing users to control how errors are handled when sub-steps within a condition fail.
Improvements:
- LLMsTxt Tools: Added an
allowed_hostsparam so agents only fetch from hosts you trust. - SlackContextProvider: Add
enable_media_toolsflag (default:False) to control file download/upload.download_fileadded to read toolsupload_fileadded to write tools
Bug Fixes:
- MCP IDOR: Fixed to bind the
user_idon AgentOS MCP tool handlers to the authenticated JWT subject to prevent cross-tenant reads and writes. - Toolkit Instructions: Fixed
@tool(instructions=...)to take effect when used inside a Toolkit. - Metrics: Fixed to accumulate parser, output, and member metrics in team run_response.
- Workflow: Fixed to persist mid-step workflow run cancellation.
- SQLTools: Updated to include column default in
describe_table. - Slack Interface: Fixed to replace Slack bot @mention with display name instead of stripping.
- GoogleDriveTools: Fixed binary file errors + Office extraction + Shared Drive params in
GoogleDriveTools. - ChromaDb: Fixed to offload async batch upsert/insert to worker thread.
- Memory: Fixed include identity fields in
update_memoryanddelete_memorytools.
What's Changed
- fix: accumulate parser, output, and member metrics in team run_response by @ysolanky in https://github.com/agno-agi/agno/pull/7704
- fix: workflow cancellation persistance by @kausmeows in https://github.com/agno-agi/agno/pull/7732
- fix: include column default in describe_table by @Mustafa-Esoofally in https://github.com/agno-agi/agno/pull/7703
- feat: add search_messages and media tools to SlackContextProvider by @Mustafa-Esoofally in https://github.com/agno-agi/agno/pull/7702
- cookbook: frameworks quickstart for Agno + Claude Code + LangGraph + DSPy by @ashpreetbedi in https://github.com/agno-agi/agno/pull/7743
- fix: replace Slack bot @mention with display name instead of stripping by @Mustafa-Esoofally in https://github.com/agno-agi/agno/pull/7750
- fix: add allowed_hosts allowlist to LLMsTxtTools by @harshsinha03 in https://github.com/agno-agi/agno/pull/7759
- feat: add on_error handling to Condition step by @rotem-bar-cyera in https://github.com/agno-agi/agno/pull/7214
- feat: add Gmail and Calendar context providers by @Mustafa-Esoofally in https://github.com/agno-agi/agno/pull/7747
- fix: binary file errors + Office extraction + Shared Drive params in GoogleDriveTools by @Mustafa-Esoofally in https://github.com/agno-agi/agno/pull/7764
- fix: surface per-tool instructions when registered via Toolkit by @harshsinha03 in https://github.com/agno-agi/agno/pull/7798
- fix: chromadb offload async batch upsert/insert to worker thread by @basnijholt in https://github.com/agno-agi/agno/pull/7711
- fix: include identity fields in update_memory and delete_memory tools by @Mustafa-Esoofally in https://github.com/agno-agi/agno/pull/6550
- [feat] Added scheduler support for mongo by @abhi10691 in https://github.com/agno-agi/agno/pull/6938
- fix: bind MCP tool
user_idto JWT subject by @sannya-singal in https://github.com/agno-agi/agno/pull/7811 - feat: gemini file api multimodal by @kausmeows in https://github.com/agno-agi/agno/pull/7788
- chore: Release v2.6.5 by @kausmeows in https://github.com/agno-agi/agno/pull/7809
New Contributors
- @rotem-bar-cyera made their first contribution in https://github.com/agno-agi/agno/pull/7214
Full Changelog: https://github.com/agno-agi/agno/compare/v2.6.4...v2.6.5
Security Fixes
- Fixed MCP IDOR: bound `user_id` on AgentOS MCP tool handlers to the authenticated JWT subject, preventing cross‑tenant reads and writes.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]