microsoft/agent-governance-toolkit v2.3.0

Agent Governance Toolkit v2.3.0

Repository: microsoft/agent-governance-toolkit

Tag: v2.3.0

Published: 2026-03-26T04:15:23Z

Prerelease: no

Release notes:

Agent Governance Toolkit v2.3.0

> [!IMPORTANT] > Community Preview Release — All packages published from this repository (PyPI, npm, NuGet) > are community preview releases for testing and evaluation purposes only. They are not > official Microsoft-signed releases. Official Microsoft-signed packages published via ESRP > Release will be available in a future release.

Plugin governance, developer tooling, and hardened security — 97 commits since v2.2.0.

This release introduces a full plugin governance layer (MCP server allowlist/blocklist, schema adapters, trust tiers), developer-facing tooling (policy linter CLI, pre-commit hooks, GitHub Actions action), runtime reliability primitives (event bus, task outcomes, graceful degradation, budget policies), and 14 new tutorials. It also includes significant security hardening across the entire codebase and two PyPI package renames to avoid namespace collisions.

🚀 What's New

Plugin Governance & MCP Server Controls

• MCP server allowlist/blocklist — Enforces marketplace-level policies on which MCP servers

plugins can use through MCPServerPolicy with allowlist/blocklist modes. Validates plugin manifests and rejects non-compliant plugins during registration (#425, #426, #434)

• Plugin trust tiers — Classify plugins into trust levels (e.g., verified, community,

untrusted) with tier-based policy enforcement (#434)

• Plugin schema adapters — Auto-detects and adapts Copilot-style and Claude-style plugin

manifest formats to the canonical PluginManifest schema, enabling multi-format plugin support with capability extraction (#424, #429, #433)

• Batch plugin evaluation — Evaluate multiple plugins against governance policies in a single

call for marketplace-scale validation (#429, #433)

• Reference integration example — Complete example showing plugin marketplace governance

integration end-to-end (#427, #435)

Developer Tooling

• Governance policy linter CLI — New agent-compliance lint-policy command validates

YAML policy files for required fields, unknown operators/actions, deprecated names, and conflicting rules with JSON/text output options (#404, #432)

• Pre-commit hooks — Two new hooks for local development: validate-plugin-manifest (checks

plugin.json schema compliance) and evaluate-plugin-policy (evaluates manifests against governance policies before commit) (#428, #431)

• GitHub Actions action — Composite action at action/action.yml wrapping governance

verification commands (governance-verify, marketplace-verify, policy-evaluate, all) with configurable inputs, structured outputs, and support for plugin marketplace PR workflows (#423, #430)

• JSON schema validation — Governance policy files are now validated against a formal JSON

schema, catching structural errors before runtime (#305, #367)

Runtime Reliability & Observability

• Event bus — Cross-gate publish/subscribe system (GovernanceEventBus) enabling loose

coupling between governance gates (PolicyEvaluator, TrustGate, CircuitBreaker) with standard event types for policy violations, trust changes, circuit state, and budget overages (#398, #415)

• Task outcomes — TaskOutcomeRecorder tracks agent task successes/failures with

severity-based scoring, diminishing returns on success boosts, time-based score recovery, and per-agent trust state management (#396, #415)

• Diff policy — Evaluate only the delta between previous and current policy state to reduce

overhead on incremental policy updates (#395, #415)

• Sandbox provider — Pluggable sandbox provider abstraction for swapping isolation backends

(#394, #415)

• Graceful degradation — agent_os.compat module provides no-op fallbacks

(NoOpPolicyEvaluator, NoOpGovernanceMiddleware) allowing consumers to optionally depend on the toolkit without try/except boilerplate (#410, #414)

• Budget policies — BudgetPolicy dataclass defines resource consumption limits (max tokens,

tool calls, cost, duration) with BudgetTracker for monitoring usage and detecting overages with detailed violation reasons (#409, #414)

• Audit logger — Structured audit logging for governance decisions with pluggable backends

(#400, #414)

• Policy evaluation heatmap — Visual heatmap added to the SRE dashboard showing policy

evaluation patterns and hotspots (#309, #326)

• Compliance grading — compliance_grade() method added to GovernanceAttestation for

calculating compliance scores (#346)

Tutorials & Learning Paths

• 14 new tutorials (07–20) — Launch-ready tutorials covering all toolkit features including

plugin governance, budget policies, event bus, graceful degradation, MCP server controls, and more

• Tutorials landing page — New README with structured learning paths guiding users from

beginner to advanced topics (#422)

CI/CD & ESRP

• PR review orchestrator — Collapses multiple agent review comments into a single unified

summary on pull requests (#345)

• Dependency confusion pre-commit hook — Detects unregistered package names before commit,

plus weekly CI audit job (#350)

• Markdown link checker — CI workflow to catch broken links in documentation (#323)
• ESRP NuGet signing — Updated NuGet signing config with Client ID and Key Vault

integration (#359, #361, #363, #365)

⚠️ Breaking Changes

PyPI Package Renames

Two PyPI packages have been renamed to avoid namespace collisions:

| Old Name | New Name | Reason | |----------|----------|--------| | agent-runtime | agentmesh-runtime | Name collision with AutoGen team's agent-runtime package (#444) | | agent-marketplace | agentmesh-marketplace | Consistent agentmesh namespace alignment (#439) |

Migration: Update your requirements.txt or pyproject.toml:

- agent-runtime
+ agentmesh-runtime

- agent-marketplace
+ agentmesh-marketplace

🔒 Security

• Fork RCE hardening — Hardened pull_request_target workflows against fork-based remote

code execution [MSRC-111178] (#353)

• Dependency confusion — Comprehensive remediation across the entire codebase: replaced all

unregistered PyPI package names, added weekly audit CI, added pre-commit detection hook (#325, #328, #349, #350, #351, #352)

• MD5 → SHA-256 migration — All cryptographic hash...