Microsoft Agent Framework Python 1.23 tightens MCP and AG-UI boundaries
Microsoft Agent Framework Python 1.23.0 introduced breaking MCP 2.x lifecycle and transport changes, required explicit AG-UI authorization scope or a single-user declaration, and marked extra Docker shell arguments as unsafe. It also added allowlisted A2A metadata forwarding and repaired atomic memory writes, approval matching, MCP isolation and several provider adapters.
Why it matters: The release changes the authority and lifecycle boundary around agent endpoints, MCP clients, shell tools and inter-agent metadata. Teams upgrading without testing can either break integrations or accidentally preserve broader trust assumptions than the new…