agentnode-sdk 0.16.0__tar.gz → 0.17.0__tar.gz

{agentnode_sdk-0.16.0 → agentnode_sdk-0.17.0}/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 0.17.0 — MCP network isolation
+
+### Changed
+
+- Community MCP servers now run only when pinned and preinstalled into a sealed
+  volume. Preinstalled community MCPs run with no network by default, or behind a
+  sealed egress allowlist when `mcp_allowed_domains` are declared.
+
+### Hardened
+
+- Removed the open-network runtime-fetch path for community MCPs. Non-preinstalled
+  or floating community MCPs — including `npx`, `uvx`, `latest`, git, or URL-based
+  runtime fetches — are now refused fail-closed. The old `network_level`
+  open-network grant path is no longer honored for community MCP runtime execution.
+
+### BREAKING / Upgrade Notes
+
+- Community MCPs that ship only an `mcp_command` are now refused instead of running
+  with an open network. To migrate, declare an exact pinned `mcp_install` so the MCP
+  is preinstalled into a sealed volume. If runtime network access is required,
+  declare `mcp_allowed_domains`; without declared allowed domains, the MCP runs with
+  no network.
+- The credentialed MCP secret flow is unchanged. Curated/trusted MCP behavior is
+  unchanged.
+
 ## 0.16.0 — Registry providers in auth CLI and setup wizard
 
 ### Added

{agentnode_sdk-0.16.0 → agentnode_sdk-0.17.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentnode-sdk
-Version: 0.16.0
+Version: 0.17.0
 Summary: Python SDK for AgentNode — the open upgrade and discovery infrastructure for AI agents.
 Project-URL: Homepage, https://agentnode.net
 Project-URL: Repository, https://github.com/agentnode-ai/agentnode

{agentnode_sdk-0.16.0 → agentnode_sdk-0.17.0}/agentnode_sdk/__init__.py

@@ -38,7 +38,7 @@ from agentnode_sdk.runtime import AgentNodeRuntime
 Client = AgentNodeClient
 ToolError = AgentNodeToolError
 
-__version__ = "0.16.0"
+__version__ = "0.17.0"
 __all__ = [
     "AgentNode",
     "AsyncAgentNode",

{agentnode_sdk-0.16.0 → agentnode_sdk-0.17.0}/agentnode_sdk/cli/commands.py

@@ -878,11 +878,16 @@ def cmd_run(
     try:
         from agentnode_sdk.runner import run_tool
         from agentnode_sdk.guard import cli_confirmation_callback
+        from agentnode_sdk.cli.mcp_commands import cli_consent_callback
 
         is_interactive = os.environ.get("AGENTNODE_NON_INTERACTIVE", "").lower() not in ("true", "1")
         callback = cli_confirmation_callback if is_interactive else None
+        # Stage 3B-2b: dedicated consent callback for credentialed MCPs (separate from the guard
+        # bool callback). None when non-TTY ⇒ resolver requires a valid stored grant (fail-closed).
+        consent_cb = cli_consent_callback if is_interactive else None
 
-        result = run_tool(slug, tool_name=tool_name, confirmation_callback=callback, **data)
+        result = run_tool(slug, tool_name=tool_name, confirmation_callback=callback,
+                          mcp_consent_callback=consent_cb, **data)
 
         if result.mode_used == "policy_denied" and result.policy:
             _print_guard_block(slug, tool_name, result)
@@ -1148,11 +1153,15 @@ def _cmd_run_smart(
     try:
         from agentnode_sdk.runner import run_tool
         from agentnode_sdk.guard import cli_confirmation_callback
+        from agentnode_sdk.cli.mcp_commands import cli_consent_callback
 
         is_interactive_run = os.environ.get("AGENTNODE_NON_INTERACTIVE", "").lower() not in ("true", "1")
         callback = cli_confirmation_callback if is_interactive_run else None
+        # Stage 3B-2b: dedicated consent callback for credentialed MCPs (separate from guard bool).
+        consent_cb = cli_consent_callback if is_interactive_run else None
 
-        result = run_tool(target_slug, confirmation_callback=callback, **parsed.input_args)
+        result = run_tool(target_slug, confirmation_callback=callback,
+                          mcp_consent_callback=consent_cb, **parsed.input_args)
 
         if result.mode_used == "policy_denied" and result.policy:
             _print_guard_block(target_slug, None, result)