Agno v3.1.12 headline: Native Approvals for Harness Agents — `ClaudeAgent`/`CodexAgent`'s own permission requests (Claude's `permission_mode`, Codex's `approval_policy`) now turn into a PAUSED run inside AgentOS, showing up in the existing Chat and Approvals views; Resolve plus Continue Run sends the decision back into the same native execution without replaying the prompt, and sandboxed environments (Docker/AgentCore) keep this capability too. Also new: `Routine(enabled=False)` for a company routine a template can ship disabled and let users turn on later, and a headline number on charts.
Three things in Agno v3.1.11: (1) Harness Agents arrive — `ClaudeAgent`/`CodexAgent` can now join a `Team` directly as members or serve as a step inside `Parallel`/`Loop`/`Condition`/`Router` in a `Workflow`, each running its own model, tools, and workspace while keeping its own conversation history within a session; (2) advanced Session Search — `POST /sessions/search` supports nested AND/OR/NOT filters over sessions; (3) Company Tasks and Routines get full lifecycle management APIs (Tasks can be created or edited at any stage, Routines can be cancelled, archived, or restored).
Three things in Agno v3.1.8: (1) `PostgresCheckpointStore` lets sandbox checkpoints live in Postgres, so multi-replica deployments can restore a session without S3 or a shared filesystem; (2) a behavior change: sandboxes now keep only the 3 newest checkpoints per session by default, set `retain_checkpoints=None` to keep them all; (3) `Claude()` now defaults to `claude-sonnet-5-5`, replacing the soon-to-retire `claude-sonnet-4-5-20250929`.
The core of Agno v3.1.4 is Sandboxed Harness Agents: ClaudeAgent/CodexAgent can now run inside isolated, per-session containers (DockerSandbox or AWS Bedrock AgentCore), restoring session state from checkpoints so a lost container doesn't force a brand-new conversation; warm sandboxes make the next turn start faster. It also adds Queue Per Session — background runs on one session now default to running strictly one at a time in order, instead of the old accept-then-fail behavior. No formal breaking changes, but sandbox import paths moved, `sandbox="read-only"` was renamed to `sandbox_mode`, and old sandbox binding tables need a manual migration — all worth checking after upgrading.
Agno v3.1.3 is all about bringing external agents (ClaudeAgent / CodexAgent) up to parity with native Agent capabilities: (1) SDK conversation history now persists to the database, so a session can resume on a different machine; (2) background execution, cancellation, and checkpoint-based step replay all land; (3) retries, token/cost metrics, compaction, structured output, and file attachments are added. No formal breaking changes, but "one turn per session" now returns a 409 up front instead of accepting a second turn and failing it later.
Three things in Agno v3.1.2: (1) `Agent(compaction=True)` folds older turns into a summary stored in a new `agno_compactions` table without overwriting the original messages, so it can be triggered manually with `agent.compact()` or reverted at any time; (2) a new `CodexAgent` brings OpenAI Codex into Agno's external-agent family alongside the Claude Agent SDK, LangGraph, DSPy, and Antigravity adapters; (3) a new `HyDE` query transformer searches with a hypothetical answer instead of the raw question, while rerankers still score against the original query. No breaking changes in this release.
Three things in Agno v3.1.0: (1) a new `agno.os.authz` package gives AgentOS a native role store, scope policy, audit log, and user directory, with pluggable native and `fga` authorization engines; (2) a new `agno.fs`/`DbFileSystem` adds dedicated `/filesystem` routes to AgentOS, but existing `agno_fs` tables must be migrated offline or they raise `SchemaOutdatedError`; (3) Breaking: `MCPConfig`'s bundled default tools and lifecycle tools (`continue_run`/`cancel_run`) switch from automatically included to explicit opt-in.
Agno v3.0.10 in three points: (1) `CodingTools.run_shell` moves from enabled-by-default to requiring `enable_run_shell=True`, and restricted mode no longer routes commands through a shell at all, closing off interpreter-RCE-style shell injection; (2) `PublicSurface(authorization=True, mcp=True)` now accepts only localhost by default — non-local callers need an explicit `MCPConfig(allowed_hosts=[...])` allowlist; (3) new `AzureOpenAIResponses` model, an Elasticsearch vector database, and a `DocumentationMarkdown` transform that converts Mintlify/Fumadocs docs sites into plain Markdown.
Agno 3.0.6 highlights: (1) `MCPConfig(stateless=True)` serves `/mcp` without session tracking so any replica can answer any request, removing the need for session affinity in multi-instance deployments (at the cost of server-initiated notifications and SSE resumability); (2) `MCPTools(protocol_mode="auto")` negotiates the newest MCP protocol era both sides support, including the sessionless capability from the 2026-07-28 spec, while the default `"legacy"` mode keeps today's behavior unchanged; (3) adds an AgentOS MCP Server Card (`GET /mcp/server-card`), `.zip`/`.eml` file uploads, `AuthorizationConfig.excluded_route_paths`, and fixes for Anthropic thinking-block replay, Gemini image MIME types, and more. No breaking changes in this release.
Agno 3.0.5 highlights: (1) Knowledge ingestion no longer swallows embedding failures — a new partial status sits between completed and failed, and embedders raise EmbeddingError instead of returning an empty vector; (2) Breaking: code catching ModelProviderError around Bedrock embedding failures stops working — switch to EmbeddingError — and the content status API returns 404 for missing content again; (3) adds an opt-in embedding retry, a GandrTools text-to-speech toolkit, an llmman model provider, and an embed_before_replace guard that stops a failed re-ingest from wiping existing data.
Agno 3.0.2 highlights: (1) Agents/Teams/Workflows/Toolkits can now be published directly as individually named MCP tools via MCPConfig.tools or component.as_tool(), instead of wrapping everything in run_agent(agent_id=...); (2) three behavior changes that don't bump the major version but will bite you: metadata resolution order flips (call-site now wins over component), MCPConfig rejects unknown fields at construction, and BaseRemote.acancel_run gains a required auth_token parameter; (3) four new integrations — Synthorai model provider, WaveSpeed image/video generation, Serply search, and AtomicMail inbox — plus a naming cleanup around mcp=/MCPConfig/default_tools (old names stay as aliases until 3.1).
Agno 3.0 in three points: (1) Runs table restructuring — runs move from session JSON blobs into a dedicated agno_runs table, reducing write amplification from O(N²) to O(N); you must run MigrationManager before upgrading or you'll hit MigrationRequiredError; (2) New Tool Result Offloading and Media Offloading — tool results over 16,000 characters and images/audio/video get moved to AgentFS or S3, leaving only a slim envelope in messages; (3) Breaking changes are extensive — multiple Agent parameter renames, reasoning=True removed, DuckDuckGoTools methods renamed, etc. This is an upgrade that requires going through the migration guide item by item.
Sorted by GitHub Stars, a survey of 15 mainstream AI Agent frameworks in 2026 — their positioning, key features, and ideal use cases. Not a ranking — it's a map.