1. Docs
  2. Changes and releases
  3. AI Agents

AI Agents

  • AI Agents agent-platform v4.107.0

    Added

    • A serving preset’s ConfigMap names the chart version that published it (giantswarm/model-manager#216). agent-platform-serving-preset-<name> carries the annotation agent-platform.giantswarm.io/chart-version with the connectivity chart’s version verbatim (Helm’s + build metadata included, which the helm.sh/chart label cannot carry), and model-manager reports it as the preset’s chartVersion, so a benchmark records the release that shipped its preset instead of a hand-typed one. make verify-serving-slice asserts the annotation on every preset ConfigMap; verify-gpu-pool leaves it out of the GOLDEN_REF comparison, as it does the image references.
  • AI Agents muster v5.35.0

    Added

    • oauth.server.allowPrivateIPClientMetadataHosts lets a listed CIMD host resolve to a private address, and the CIMD fetch trusts --extra-ca-file. A CIMD client on a private hostname (an internal load balancer, a VPN-only platform) needed allowPrivateIPClientMetadata, which lifts the SSRF guard for every host, and one served under an internal CA failed TLS verification even with that CA in --extra-ca-file. The new list (Helm: muster.oauth.server.allowPrivateIPClientMetadataHosts, empty by default) lifts the guard for the hostnames listed only, mirroring trustedIssuers[].allowPrivateIPJWKSHosts; every other host keeps it, at validation and at connection time. The CIMD fetch now verifies against the --extra-ca-file pool, the system roots plus the operator’s CA, as the forwarded-token JWKS client already did; without --extra-ca-file it keeps the system roots. Prefer the list over the bool, which stays for an installation where every hostname is private. Requires mcp-oauth v1.6.0. (#1396)
  • AI Agents muster v5.34.18

    Fixed

    • The capability store’s expiry test no longer fails on a slow machine. TestInMemoryCapabilityStore_ListSessions_skipsExpired gave the store a 10 ms TTL, so under load the session it had just set as fresh had expired by the time it listed the sessions, and the test (and with it a release’s tag pipeline) failed. The stale session is rewound explicitly; the TTL is now a minute.
  • AI Agents muster v5.34.17

    Fixed

    • muster get prompt <name> and muster get resource <uri> find every aggregated prompt and resource, and their completion offers them. Both looked the item up in the native prompts/list and resources/list of the CLI’s session, which carry muster’s own resources (auth://status) but none of the aggregated servers’ items, so they answered prompt not found / resource not found for every prompt and resource of a backend, and completion offered none. get prompt now reads the prompt through describe_prompt and get resource through describe_resource, which report the server and a prompt’s arguments; muster’s own items, which only the native listing has, are still found there. The detail shows the server. A URI several servers expose answers with the servers’ names and is picked with the new muster get resource <uri> --server <name>. Completion lists through list_prompts and list_resources, as muster list prompt|resource does, and the completion of get, call and start asks the aggregator --endpoint and --context (or MUSTER_ENDPOINT, MUSTER_CONTEXT) name instead of always the default context. (#1393)
  • AI Agents muster v5.34.16

    Fixed

    • muster list resource keeps muster’s own auth://status, and muster list prompt -o wide counts an aggregated prompt’s arguments. Listing through list_resources dropped the resources only the native listing carries, muster’s own auth://status among them; they are listed again, without a server. The wide ARGS column showed - for every aggregated prompt, which the native listing does not carry; the wide listing now reads their arguments with describe_prompt. (#1252)
  • AI Agents muster v5.34.15

    Fixed

    • describe_tool forwards a downstream tool’s title and outputSchema. The detail named the tool’s input but not the shape of the structuredContent it returns nor its display name, so a client had no contract for the result it reads. describe_tool now adds outputSchema (raw or typed, as the tool declared it) and title (the tool’s own, else its annotations’ title, the MCP fallback) next to the annotations it already forwards; each key is omitted when the tool does not set it, and list_tools stays minimal. (#973)
  • AI Agents muster v5.34.14

    Fixed

    • A backend tool call, and a muster agent call, returns once answered instead of up to 90 s late. muster serve’s streamable-http clients to backends, the transport probe and muster agent could hold a call that its server had answered until the pooled connection’s 90 s idle timeout, then fail with context deadline exceeded. mcp-go closes an SSE response body while its reader is still blocked in Read, and again when the call returns. When the stream ends inside Go’s post-close drain, the reader waits for the connection’s read loop while holding the body’s lock, the connection goes back to the pool, and the second close and the next response on that connection wait until it is reaped. These clients now never close an SSE body under a blocked reader: the close returns at once, a stream that ends within 100 ms ends cleanly and keeps its connection, and one that stays open is cancelled, which discards the connection and releases the reader. Tests drive the frame through each client; they fail before the change and pass under -race. (#1388)
  • AI Agents muster v5.34.13

    Fixed

    • (test) Serve the Valkey stand-in on its reserved listener in #1384 by @teemow
    • (oauth) Keep a forwarded token’s session across a refresh in #1385 by @teemow

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.34.12...v5.34.13

  • AI Agents agent-platform v4.106.0

    Fixed

    • The agent-manager migrate run no longer races its network policy or stalls the connectivity upgrade (giantswarm/agent-platform#378). The connectivity chart rendered agent-manager-migrate-<hash> as a Job of the release: Helm applies the CRD-backed CiliumNetworkPolicy that gives it egress after the Job, so on a cluster with Cilium policyEnforcementMode: always the pod reached nothing and exhausted its retries, and a Failed Job stalled every upgrade (failed early due to stalled resources) — Helm’s readiness check reads a Failed Job as Failed with or without disableWaitForJobs. The release now carries the suspended CronJob agent-manager-migrate (never scheduled, always Current) and a post-install,post-upgrade hook that, as the tenant identity in the kagent namespace under the migration’s own policy, creates the run agent-manager-migrate-<hash> from it once the release’s manifests are applied, unless a run of that hash exists. The hook ends before the run does, so a failed migration leaves the release Ready and shows in its Job, its log and the agent-manager-migrate-report ConfigMap. A re-run is kubectl create job --from=cronjob/… (UPGRADE.md). make verify-migration asserts, in both network policy flavours, no Job of the release, the suspended CronJob, the start hook’s events, identity, policy label and script, and the run’s policy as a regular object.
  • AI Agents muster v5.34.12

    Fixed

    • A stdio MCPServer’s tool calls run under its spec.timeout. The client factory applied the server’s timeout to the streamable-http and SSE clients only, so every request to a stdio server, a tool call above all, was cut at the 30 s default whatever its spec.timeout said: a bridge waiting on a remote tool, or a local server doing a slow read, failed with a deadline its definition allowed it to outlast. The factory now sets the budget once for every transport it builds, so a stdio server with spec.timeout: 60 completes a 45 s tool call and one that outlasts it fails with no answer within the server's timeout of 1m0s. The field’s documentation in the CRD says it bounds every operation of every server type. (#1297)