Microsoft's Agent Framework locks down MCP sessions and skills

Microsoft shipped Agent Framework 1.19.0 for Python on September 18, tying every MCP request and session to the identity that made it. That matters for anyone running multi-tenant agents on this framework, where sessions weren't previously scoped to the invocation that created them.

Requests are also scoped by origin and ownership, alongside identity. Skill archives are now restricted to ZIP files with verified digests, closing a gap where a loaded skill package couldn't be confirmed unmodified. The release also deprecates the MCP sampling callback.

The release adds generic vector-store provider protocols, with connectors for MongoDB, Azure DocumentDB, and Azure Cosmos DB NoSQL. It also adds per-tool exposure controls, letting a session limit which tools an agent can see.

A separate batch of fixes targets compaction summaries and checkpoint round-trips, where long-running agent workflows can lose state with no error or log line. The release notes don't say how many workflows hit the bug or how long it went unfixed.