Framework Watch: Agent Framework 1.25 Puts a Ceiling on MCP Discovery and Binds Runs to One User

Microsoft Agent Framework Python 1.25.0

Published on November 7, 2026, this release contains several breaking changes that tighten defaults:

• Bounded MCP discovery. Tool and prompt discovery is limited to 100 pages and 1,000 items per catalog, and framework-owned requests default to a 30-second timeout. A malicious or broken server can no longer feed a client an endless catalog. The escape hatch is setting the limit to None, which the notes reserve for a trusted server.
• One authorization scope per run. Live workflow agent executors and their sessions are bound to one authorization scope, and cross-scope execution is rejected before any model call. Users must supply a factory that creates new workflows for each call, because a shared builder still reuses its executors.
• No shared MCP sessions. The declarative handler now creates and closes a fresh protocol session for every invocation, to prevent state leaking across workflows.
• Quieter sandboxes. Host-tool exception details are redacted before generated code resumes. Code that matched specific exception types now sees a generic RuntimeError unless a trusted channel opts in.
• Python 3.11 minimum. Python 3.10 environments need upgrading before they can install this release.

Two smaller fixes matter for long-running agents: unreadable memory state is quarantined instead of failing every turn, and sessions stay pending after a partial memory consolidation.

ADK main branch

These commits are on main and do not appear in the 2.14.0 release notes, so treat them as unreleased.

• Eval metrics and thoughts. A November 7 fix stops judge and Vertex metrics from reading parts marked thought=True. Before it, with include_thoughts or PlanReActPlanner, "the model's internal reasoning was scored as if the user had seen it". Scores from such setups may have been measuring the wrong text, so teams should re-baseline after upgrading.
• Toolset reference counting. Runner.close() now closes a toolset only when no other active Runner holds it, which prevents parallel runs from losing a stateful toolset mid-flight.
• A2A task results. A November 8 fix resolves finish_task arguments for unary A2A responses, as already worked for streaming ones.

ADK Java added an experimental Classifier interface and an LlmClassifier backed by BaseLlm on November 7. Gemini CLI changed how its ACP path handles mid-stream retries, to prevent text concatenation, on November 6.

What remains uncertain. We have read the release notes and commit messages and have not exercised these changes. The ADK fixes may change before their next tagged release.

Analysis: A release that breaks your code to enforce a limit is often doing you a favour. If Jenya's returns assistant at Belgavi's Book Store shares one workflow builder across users, 1.25 will require a per-call factory, and that is the correct shape anyway, because no customer's session should be reachable from another's executor. Add a test that attempts cross-scope execution, so a later refactor cannot quietly restore it.

Sources and evidence

• Agent Framework python-1.25.0 release notes (GitHub, November 7)
• fix(eval): stop judge and Vertex metrics from scoring model thoughts (ADK Python)
• fix: refcount toolsets on Runner so close() waits for last holder (ADK Python)
• feat(classifiers): add LlmClassifier backed by BaseLlm (ADK Java)
• fix(acp): handle mid-stream retries to prevent text concatenation (Gemini CLI)