The AI Toolchain — issue 016, September 4, 2026

Adds verify_ssti, accepting a hypothesis_id (or url) plus parameter, to confirm server-side template injection via randomized operands — {{a*b}} for Jinja2/Twig/Nunjucks and ${a*b} for Freemarker/JSP-EL/Velocity — proving evaluation when the computed product appears in the probe response but not the baseline. On confirmation it records exploit-proven evidence in the ledger and has the agent report High CWE-1336, mirroring the existing verify_sqli / verify_xss / verify_oob workflow; it respects scan session auth, rate policy, cancellation, scope-checking on internal host resolution, and is disabled in passive mode.

$ verify_ssti(hypothesis_id="<hypothesis_id>", parameter="<parameter>")

$ verify_ssti(url="<url>", parameter="<parameter>")

Adds the Z.AI (standard API) provider (https://api.z.ai/api/paas/v4) and Z.AI Coding Plan provider (https://api.z.ai/api/coding/paas/v4), both selectable in first-run setup and Settings → LLM provider list and authenticated by API key. glm-* model IDs are routed to Z.AI automatically, and any-case GLM IDs are normalised to lowercase before sending (e.g. GLM-5.3 → glm-5.3) so newly released model IDs aren't rejected as Z.AI's catalog evolves.

oz run get --conversation and oz run conversation get now print the raw conversation transcript for third-party harness runs, instead of returning operation_not_supported as before.

$ oz run conversation get <run-id>

$ oz run get --conversation <run-id>

The create_file tool now accepts allow_overwrite: true, letting an agent fully replace an existing file's contents in one step instead of failing and requiring a separate edit operation.

Daytona sandboxes now support Cursor Self-Hosted Machines, letting Cursor Cloud Agent workers run inside Daytona sandboxes instead of Cursor-hosted machines, using Linux containers, Linux VMs via the daytona-vm-medium snapshot, or Windows VMs via the windows-medium snapshot. Each agent request gets its own isolated sandbox created on demand from a defined snapshot, with the repository set as the workspace origin and a Cursor-minted short-lived GitHub token used for checkout so no long-lived credentials are stored in the snapshot. Three sandbox classes are supported per pool — Linux containers built from an included Dockerfile, Linux VMs from daytona-vm-medium, and Windows VMs from windows-medium — with pools defined per-snapshot. The controller ships in the lab channel of the Cursor CLI and requires a Cursor Enterprise team with a service-account API key.

The read_file command now reads Word, PowerPoint, Excel, OpenDocument, RTF, EPUB, and PDF documents, converting them to Markdown with windowed delivery for both single and multi-file reads. Scanned PDFs are handled by identifying image-only pages by name and emitting the pdftoppm command needed to render them, and the document converter installs on-demand into the user cache on first use rather than shipping bundled with the CLI.

$ read_file report.pdf slides.pptx data.xlsx notes.docx

Groups sessions into tag folders in the desktop sidebar, with tag groups supporting a name and colour. Folders can be renamed via right-click, entering a new name and picking a colour to distinguish them from other groups.

Adds GPT-6 Astra to the Codex model picker and pricing table, adds Claude Fable 5.1 to the model pickers and pricing table, and offers Codex max and ultra reasoning efforts in the agent model picker.

Adds the guardian_thread_context feature flag (disabled by default) to the configuration schema, enabling thread-owned context for Guardian reviewers with persistent verified question-and-answer pairs that survive compaction, resume, and rollback.

GPT-6-Astra was added to the bundled model catalog and made accessible via the API with its own prompts, policies, and unified_exec shell type, without becoming the visible default model or appearing in the model picker. It was also added to the Amazon Bedrock model catalog as openai.gpt-6-astra, including global and US cross-region variants in the Bedrock Runtime catalog.

MCP tool discovery errors are now surfaced directly in server status and the tool UI. MCP 401 Unauthorized responses carrying WWW-Authenticate headers are converted into tool errors with mcp/www_authenticate metadata, preserving authentication challenges for interactive login flows.

Hardens the macOS Seatbelt sandbox against terminal input injection by denying the TIOCSTI ioctl, preventing a sandboxed child process from queuing input into the parent shell.

A text form of /advisor is now usable in the desktop app, Remote Control, and headless sessions (-p / Agent SDK): /advisor, /advisor <model>, and /advisor off.

$ /advisor claude-fable-5-1
# or to disable:
/advisor off

Adds oidc.scope_on_refresh to the Claude apps gateway config for IdPs that only return an id_token on refresh when openid is explicitly requested again, and adds userPluginMarketplacesEnabled and userPluginUploadsEnabled keys to desktop policy blocks in the same config.

On Amazon Bedrock, input tokens for aborted requests are now counted with AWS's free CountTokens API (requires bedrock:CountTokens grant) instead of a one-token request.

Adds likely-cause diagnostics for prompt-cache misses (e.g. tool definitions changed, system prompt changed, idle past TTL) to /cost output and the prompt_cache field in the status line.

Commands typed at the ! bash-mode prompt now run outside the sandbox even when sandbox.allowUnsandboxedCommands: false is set.

The self-hosted runner's --kill-session-after-min flag now releases sessions waiting on user input (paused/resumable) rather than killing them and reporting failure.

/ultrareview and claude ultrareview now wait up to 45 minutes (previously 30) for long-running cloud reviews.

For 1M-context models, Opus and Fable sessions now compact shortly before the 1M-token limit, and recovery compaction on very large contexts no longer times out at 10 minutes.

ctrl+l / cmd+k in fullscreen mode now clears the transcript view like a terminal clear, with earlier messages still accessible by scrolling up.

A live diff panel now shows uncommitted changes as Claude edits code in fullscreen mode, toggled with /diff.

$ /diff

Adds a --system flag to goose session that injects an additional system prompt, giving interactive sessions the same customization goose run already had.

$ goose session --system 'You are a penetration tester. Limit all responses to findings in scope for the current project.'

Adds an on_failure block for PreToolUse hooks enabling fallback behavior when a pre-tool check fails, a new PreToolUseResult event, and a stable tool_call_id propagated across the full tool lifecycle for hook authors and extension developers.

Adds Z.ai GLM-5.3, replacing GLM-5.2; adds OpenAI GPT-5.6 (sol/terra/luna) via Bedrock; adds GPT-5.6 follow-up support for Codex and the Responses API; and adds ACP thinking-effort derivation and forwarding to downstream providers.

Adds an interactive git branch indicator in the chat bottom bar; sessions are now titled by subject rather than workflow step; scheduled job sessions are collapsed into an accordion in chat history; the chat footer model picker now shows recently used models; configured providers are sorted to the top of the provider list; and saved recipes can now be selected when creating a schedule.

Cline discovers and runs Agent Plugins from ~/.agents/plugins, validating each plugin's plugin.json, exposing Agent Skills to the agent, and auto-starting stdio / Streamable HTTP / SSE MCP servers. Plugins are listed separately from Cline Plugins under Settings → Customize with descriptions, badges, contributed tools, and per-plugin enable/disable managed by the Hub; workspace-level .agents/plugins directories are intentionally ignored, so only the home-directory path is discovered.

Suppresses the 'Cline Hub was updated' dialog when the Hub is running the same core version, and the build-mismatch dialog now waits until an app update is actually staged. Dismissing with 'Later' now persists across session switches, reloads, and relaunches.

Visual Edits lets users click any element in the running app to open a per-element toolbar supporting font size (by pixel or size picker), text styling, lists, links, and in-place copy editing; the color picker only offers colors already in use in the app's rendered palette. All approved element changes across a session are batched into a single instruction set sent to the currently selected model in one round trip, rather than one prompt per change. Selected elements show plain-language names instead of raw HTML tags like div and h1, and first use (via the 'Select' button, marked 'new') triggers a one-time walkthrough dismissed per browser. Available to all users on free and paid plans as of September 3, 2026.

Self-Hosted Machines let teams run Cursor cloud agents on their own infrastructure. A machine is registered as a worker with the new agent worker start CLI subcommand, which opens a long-lived outbound HTTPS connection to the Cursor cloud for agent tool execution. Two configurations are supported: 'My Machines' for single-device personal use, and 'Pools' — named queues of workers that auto-scale with demand and can serve any repository from a single pool. This lets cloud agents run on custom hardware such as GPUs, Apple silicon Macs (for iOS/macOS builds), Kubernetes, and other managed VM environments that are impractical to package as a Cursor-hosted Cloud Agent build.

$ cursor agent worker start

Adds native integrations with AWS Lambda, Cloudflare, Coder, Daytona, E2B, Modal, Namespace, and Vercel as supported sandbox providers, letting teams host workers on these platforms without building a custom sandbox layer.

Canvas Apps Beta (v1.16.0) lets teams add custom pages and browser-based tools to Agent Canvas that make authenticated HTTP requests to the active Agent Server. Apps are managed per backend and installed as disabled by default so the source can be inspected before enabling.

Provider Connections store a provider key and optional base URL once, letting multiple LLM profiles share credentials; profiles show when a linked connection is missing.

Automation cards, Home, and the Activity Log now display live PENDING, RUNNING, or FAILED phases; those phases are also included in CSV and JSON exports.

A recommended rail on the new-conversation page surfaces automation templates before users need to search. Recommended automations can now define form fields (such as repository or workflow-specific configuration) so users configure them without a setup conversation. Imported automations now show their name, trigger, prompt, and plugins before they can be enabled. An automation dashboard brings run activity, failures, durations, details, and recent trends into one operational view.

Adds child conversation launching from a parent task, supporting manager-style workflows with Cloud-backed sandboxes and worktrees.

A new nooa-acp / nooa[acp] package serves durable coding sessions over the Agent Client Protocol (ACP), enabling use with ACP hosts such as Zed. Installed via uv add nooa-acp.

$ uv add nooa-acp

Adds support for the OpenAI gpt-6-astra model, making it available as a drop-in model string across agents, e.g. Agent('openai:gpt-6-astra') with no other code changes required.

from pydantic_ai import Agent

agent = Agent('openai:gpt-6-astra')
result = agent.run_sync('Summarize the threat landscape for Q3.')
print(result.output)

New browser_use.beta.Agent class, backed by the Rust terminal runtime, accepts BrowserProfile and BrowserSession arguments for headless, headed, CDP-attached, or cloud browser sessions. BrowserProfile exposes cdp_url, user_agent, headless, user_data_dir, window_size, and allowed_domains; BrowserSession exposes use_cloud, cloud_profile_id, cloud_proxy_country_code, and keep_alive to drive Browser Use Cloud sessions from Python.

import asyncio
from browser_use.beta import Agent, BrowserSession, ChatOpenAI

async def main():
    agent = Agent(
        task="Open Hacker News and summarize the top 5 stories.",
        llm=ChatOpenAI(model="gpt-5.5"),
        browser_session=BrowserSession(
            use_cloud=True,
            cloud_proxy_country_code="US",
            keep_alive=False,
        ),
    )
    history = await agent.run(max_steps=12)
    print(history.final_result())

asyncio.run(main())

New browser command launches an interactive TUI to watch, interrupt, steer, and resume AI-driven browser sessions; browser-use-terminal run-openai, run-anthropic, run-openrouter, and run-deepseek subcommands run one-shot scriptable browser tasks with --model selection; the --config flag accepts inline overrides such as browser.headless=true and browser.window_size={width=1440,height=900}. Installs via curl -fsSL https://browser-use.com/terminal/install.sh | sh, providing the browser and browser-use-terminal executables.

$ export OPENAI_API_KEY=...
browser-use-terminal \
  --config 'browser.headless=true' \
  --config 'browser.window_size={width=1440,height=900}' \
  run-openai --model gpt-5.5 \
  "Go to https://news.ycombinator.com and return the top stories with points"

browser-use-terminal secrets set --domain <domain> --name <name> --stdin with a --totp flag stores credentials and TOTP seeds so the agent can fill logins without exposing raw values to the model; secrets import pulls saved logins from 1Password via the op CLI, and secrets list displays credential metadata. In the TUI, the /secrets palette command (Ctrl-O shortcut) and /import-passwords command manage the same credentials and 2FA TOTP keys interactively.

$ printf '%s' "$TOTP_SEED" | browser-use-terminal secrets set \
  --domain example.com \
  --name otp \
  --totp \
  --stdin

browser-use-terminal skill install writes a browser-automation skill into ~/.claude/skills/, ~/.codex/skills/, ~/.config/opencode/skills/, and ~/.agents/skills/ so assistants like Claude Code and Codex can drive the browser. The browser-use-terminal browser exec subcommand accepts a Python heredoc of page-interaction helpers (new_tab(), wait_for_load(), page_info(), capture_screenshot()), and a --session <name> flag isolates artifact directories, event logs, and managed browsers across parallel workstreams.

Adds Pay with Link: when an agent reaches checkout, it requests human approval via the Link app, which issues a one-time virtual card valid for a single purchase and limited time. Supports the Link Pay Token on Stripe checkouts that advertise agent payments, so the agent pays without ever handling a card number. Connect Stripe Link via the Integrations panel on cloud.browser-use.com, with a per-task Pay with Link toggle to enable the flow.

New browser-use-terminal domains allow, domains deny, domains list, and domains clear subcommands enforce per-session site allow/block policy from the CLI, and the TUI /domains command lets you allow or block sites the agent can visit without leaving the session.

Adds @sandbox decorator (from browser_use) with a cloud_profile_id parameter to run agents in managed cloud sandboxes with persistent auth and cookies.

from browser_use import Browser, sandbox, ChatBrowserUse
from browser_use.agent.service import Agent
import asyncio

@sandbox(cloud_profile_id='your-profile-id')
async def production_task(browser: Browser):
    agent = Agent(
        task="Log in and check alerts",
        browser=browser,
        llm=ChatBrowserUse(),
    )
    await agent.run()

asyncio.run(production_task())

Adds ChatBrowserUse class, importable from browser_use, as a browser-automation-optimized LLM backend, configured via BROWSER_USE_API_KEY set in .env.

BROWSER_USE_API_KEY=<your-key>

from browser_use import Browser, sandbox, ChatBrowserUse
from browser_use.agent.service import Agent
import asyncio

@sandbox(cloud_profile_id='your-profile-id')
async def production_task(browser: Browser):
    agent = Agent(
        task="Log in and check alerts",
        browser=browser,
        llm=ChatBrowserUse(),
    )
    await agent.run()

asyncio.run(production_task())

Introduces Agent(task=..., llm=..., browser=...) as the core agent construction API, accepting any supported LLM class and an optional Browser instance. Adds ChatGoogle, ChatOpenAI, and ChatAnthropic classes importable directly from browser_use for multi-provider LLM support, and a uvx browser-use install subcommand to install the Chromium browser dependency after package installation.

$ uv venv --python 3.12 && source .venv/bin/activate && uv pip install browser-use && uvx browser-use install

Honors the BROWSER_USE_HEADLESS environment variable in BrowserProfile, letting library users control headless mode without code changes.

$ BROWSER_USE_HEADLESS=true python simple.py

New browser-use-terminal browser recover stop-owned-browser and stop-owned-remote commands shut down persistent managed and cloud browsers; events browser-cli-<session> streams the full event log for a named session; browser preference use local|cloud|managed-headless sets the remembered browser connection preference.

The TUI adds /context to inspect context-window attribution for the current task, /email to give the agent a disposable inbox for sign-ups and verification codes, /goal to set or view the goal for a long-running task, and /sync-cookies to sync local browser cookies into the agent session.

New Python model classes ChatOpenAI, ChatAnthropic, ChatLiteLLM, ChatDeepSeek, and ChatOpenRouter in browser_use.beta configure the LLM provider passed to Agent.

Adds 1Password and TOTP integration for Cloud API tasks: auto-fill passwords and TOTP codes using secret bindings for v4 runs or a vault ID for v2/v3 tasks.

Adds x402 agent wallet support, enabling agent-native payments via AgentCash (local wallet, MCP) or Coinbase's Agentic Wallet (hosted wallet, CLI).

Adds blockedHostnames to the SSRF policy config to block configured hosts for browser automation, web fetch, and webhooks, hardening shared Gateway deployments against SSRF.

blockedHostnames:
  - internal.corp.example
  - metadata.internal

Adds agents.defaults.cwd and per-agent cwd config keys to set agent working directories, plus a global worktreeRoot key; supports up to 100 managed worktree checkouts.

$ openclaw config set agents.defaults.cwd /workspaces/myproject --dry-run --expect-current-absent

Updates openclaw update to automatically roll back the npm candidate when the post-update Doctor fails, and adds a --no-restart flag for upgrades on systems without a service manager. Users on v2026.8.2 without a service manager must run openclaw update --no-restart once after upgrading, since the new flow otherwise refuses to proceed without one.

Adds --expect-current-json, --expect-current-absent, --dry-run, and --strict-json flags to config set, letting operators preview a change and catch conflicts with the current value before applying it.

$ openclaw config set agents.defaults.cwd /workspaces/myproject --dry-run --expect-current-absent

Adds the channels.<id>.enabled: false config key to prevent a channel plugin from loading, without uninstalling it.

channels:
  my-slack-channel:
    enabled: false

Adds the openclaw skills library command for personal skill libraries on shared Gateways, with ZIP archive import and per-identity share/publish support.

Fresh installs, including via npx openclaw@latest, gain a quick-start lane that detects existing Claude Code or Codex logins and API keys, verifies them live, and automatically opens the web dashboard.

Mermaid blocks now render as interactive diagrams in the Control UI and the native macOS, iOS, and Android apps, with enlarge previews and a mobile retry option when rendering fails.

Feishu and Matrix channels now deliver action buttons from agent replies; LINE reports which buttons it renders and supports group-mention routing.

Adds the langchain.mcp namespace and MCPAdapter class, enabling Model Context Protocol (MCP) support directly in LangChain agents and chains. An MCP-compatible tool server can be connected to an agent via from langchain.mcp import MCPAdapter.

from langchain.mcp import MCPAdapter

An agent declares the full set of tools it plans to use and hands that set to Arcade, which returns one approval link per service so all OAuth consents are cleared in a single pass before the job begins. Each pre-authorization stays demand-scoped to the specific user, specific scopes, and specific tools the current job requires, and Arcade's per-action enforcement still evaluates every action at runtime.

Runs move out of the session JSON blob into a dedicated agno_runs table (columns session_id, run_type, agent_id, team_id, workflow_id, user_id, parent_run_id, status, run_index) alongside new agno_jobs and agno_tool_results tables, enabling direct run APIs: db.get_run(), db.get_runs(session_id=..., status=..., limit=..., page=...), db.upsert_run(), db.delete_run(), db.delete_runs() (sync + async), db.get_session(runs_limit=N), and db.get_sessions(include_runs=False). Migration is mandatory before v3.0 serves traffic: run MigrationManager(db).up() (or POST /databases/all/migrate) to non-destructively copy legacy runs, then reclaim old data with db.cleanup_legacy_runs_column() or db.cleanup_legacy_runs_field(); an unmigrated database raises MigrationRequiredError or SchemaMismatchError, surfaced by AgentOS as error_id: 'migration_required_error'.

from agno.storage.migrations import MigrationManager

# Run before starting v3.0 traffic
MigrationManager(db).up()

# After verifying data integrity, reclaim the legacy column
db.cleanup_legacy_runs_column()

AgentOS(queue_config=QueueConfig(durable=True)) commits accepted runs to the database before they start so they survive crashes and deploys, supports cancellation while queued, bounds concurrency at 32 by default (configurable via the AGNO_BACKGROUND_MAX_CONCURRENCY env var), deduplicates via Idempotency-Key, and returns 429 when the queue is full. New queue REST endpoints: GET /queue/jobs, GET /queue/jobs/{job_id}, POST /queue/jobs/{job_id}/requeue, and GET /queue/stats; AgentOS can also bound concurrent batches and schedule endpoints.

from agno.agentos import AgentOS, QueueConfig

os = AgentOS(
    queue_config=QueueConfig(durable=True),
)
os.serve()

import os
os.environ["AGNO_BACKGROUND_MAX_CONCURRENCY"] = "16"

from agno.agent_os import AgentOS
from agno.agent_os.queue import QueueConfig

app = AgentOS(
    queue=QueueConfig(durable=True),
    db=db,
)

offload_tool_results (a bool or ResultStore instance) on Agent/Team redirects tool outputs over 16,000 characters to AgentFS, leaving a short envelope (preview, size, result_id) in the message; agents retrieve the full result with read_result or search_result (plus async variants). ResultStore(threshold_chars=..., ttl_seconds=...) configures offload threshold and retention, and None/False control team inheritance of the setting.

Flat human-in-the-loop kwargs (requires_confirmation, confirmation_message, on_reject, requires_user_input, user_input_message, user_input_schema, requires_output_review, output_review_message, requires_iteration_review, iteration_review_message, on_error, hitl_max_retries, hitl_timeout, on_timeout) are removed from Step/Steps/Loop/Condition/Router in favor of human_review=HumanReview(...) from agno.workflow.types, with hitl_max_retries renamed max_retries and hitl_timeout renamed timeout. continue_run/acontinue_run drop updated_tools in favor of a requirements list of RunRequirement from the paused run output.

DuckDuckGoTools.duckduckgo_search is renamed web_search and duckduckgo_news to search_news. Flat Google tool modules (agno.tools.gmail, agno.tools.googlesheets, agno.tools.googlecalendar, agno.tools.google_maps, agno.tools.google_drive, agno.tools.google_bigquery) are deleted in favor of agno.tools.google.*, with creds_path renamed credentials_path and auth_port renamed oauth_port; GDriveContextProvider is renamed GoogleDriveContextProvider. SQLTools's enable_list_tables, enable_describe_table, and enable_run_sql_query become bare method names, FileTools.check_escape moves to Toolkit._check_path, and the StudioTool alias is removed in favor of StudioTools.

Agent parameters are renamed: enable_user_memories→update_memory_on_run, search_session_history→search_past_sessions, num_history_sessions→num_past_sessions_to_search, num_past_session_runs→num_past_session_runs_in_search. eval_id is renamed run_id across eval classes (the {eval_id} template placeholder becomes {run_id}, and POST /eval-runs now returns run_id). Learn aliases are removed: MemoriesConfig→UserMemoryConfig, MemoriesStore→UserMemoryStore, Decision→DecisionLog. Model.classify_error is removed in favor of ModelProviderError.classify(error), and the agno.models.metrics module/Metrics alias are removed — import RunMetrics from agno.metrics.

media_storage on Agent, Team, and Workflow uploads images, audio, video, and files to local disk, S3, or GCS before persistence, storing a MediaReference (key, bucket, mime type, size, hash) in the session row instead of raw base64 — a 113 KB JPEG drops from ~151,000 chars to 2,897.

New toolkits: AdvisorTools (escalate to heavier models by name or broadcast to all advisors, mixing providers freely), OpenRouteServiceTools (routing distances, drive times, turn-by-turn directions via a free ORS_API_KEY), StudioRunnerTools (identity-aware dispatch that lists and runs Studio components by ID with no create/edit/delete access, executing as the calling user), FinanceTools (prices, fundamentals, and market data with swappable providers), AtomicMailTools (an inbox for registering, sending, and reading mail), WaveSpeedTools (image and video generation), SerplyTools (web, news, and scholar search), GandrTools (text-to-speech via the Gandr TTS API), and MiniMax video generation support. MCPTools gains a headers= argument for connect-time authentication against remote MCP servers, and every toolkit gains a stable id field so AgentOS tool references survive restarts and deploys regardless of load order.

CodeMode(tools=[...]) gives an agent a persistent IPython kernel that survives across a session, letting models write Python and call tools as awaitable handles with variables, loops, and helpers instead of round-tripping through the transcript. Requires pip install 'agno[code]' for ipykernel, jupyter_client, and dill.

Studio 3.0 makes create_* calls write a private DRAFT until publish_component is called; published versions are immutable with rollback, archive, restore, tombstoned deletes, and dependent-tracking. Compare-and-set guards return typed 409 responses on stale writes, and across all StudioTools calls (26–31 tools depending on release) responses come back as a machine-readable envelope with ok, status, data, error, and warnings.

Per-user isolation now covers metrics, schedules, evals, knowledge, components, entity memory, and 17 vector databases, with metrics aggregated per user per day; unowned components and knowledge remain shared and readable by all (editable by admin). Entity memory under namespace='user' is now isolated per user, and EntityMemoryStore.delete/get require a keyword-only user_id in that namespace.

Adds Ramp Router as a model provider and xAI SuperGrok with device-code OAuth authentication, plus Synthorai as a model provider; Claude models now work with anthropic 1.0.0. Default models change: Cerebras moves to gpt-oss-120b, Gemini defaults to 3.7 Flash, and Groq migrates its deprecated llama-3.3-70b-versatile to openai/gpt-oss-120b. OpenAI integration now accepts the full value sets for reasoning_effort, reasoning_summary, service_tier, and verbosity.

GET /models is removed; model data moves to GET /config under available_models, and GET /info becomes the single unauthenticated metadata endpoint.

Agno adds a built-in MCP server at /mcp that exposes agents, teams, workflows, and custom tools to any MCP-compatible client, plus an AgentOS MCP Server that does the same through AgentOS. Configuration was consolidated from enable_mcp_server and mcp_config into a single mcp_server= parameter on AgentOS.

MultiMCPTools (and its allow_partial_failure option) is deleted; use one MCPTools per server instead. Separately, MCPToolbox drops auth_tokens/auth_headers in favor of auth_token_getters.

Adds torch.linalg.polar for polar decomposition, implemented via cuSOLVER QDWH with backward support on CPU, CUDA, and MPS, and torch.linalg.matrix_sqrth for computing the matrix square root of symmetric or Hermitian positive-definite matrices.