How to Choose and Secure Agent Frameworks for Production AI Applications

What Happened

Recent agent-tooling releases emphasize operational controls rather than a new orchestration pattern. One agent SDK added delegation steering, run and request timeouts, configurable model retries, new provider and realtime integrations, and step stores that avoid duplicating full message histories in every snapshot. It also fixed cancellation, parallel-tool-call, streaming, and credential-refresh issues [3].

Claude Code releases improved resumed workflows, subagents, worktrees, MCP behavior, cloud sessions, and self-hosted runners. They also added diagnostics and tool-policy controls. A regression affecting requests through Vertex, Bedrock, and some gateways was fixed by retrying without tool search when it is rejected [1][4].

The clearest security finding was an MCP telemetry vulnerability: provider-native configuration could place server URLs, authorization tokens, custom headers, or URL-embedded credentials in OpenTelemetry traces even when content capture was disabled. Fixed versions are v2.58.0 and v1.107.8; v2.58.0 also fixed a UI-adapter path that could invoke tools not requiring approval with client-chosen arguments [2][3]. These notes do not establish new releases or comparative performance claims for LangChain, LangGraph, LlamaIndex, AutoGen, CrewAI, DSPy, Semantic Kernel, or the OpenAI Agents SDK.

Why It Matters to Businesses

Framework selection affects more than prompt composition. Production agents need bounded execution, recoverable state, enforceable tool permissions, and telemetry that does not leak credentials. The fixes to workflow resume, parallel tool calls, and cancellation show why an agent that works in a short demonstration may still fail under retries, handoffs, or long-running sessions [1][3].

Stored workflow state also makes upgrades a deployment decision. Changing an MCP identifier can rename Temporal activities while workflows are in flight; affected DBOS Planning workflows likewise require an upgrade plan [2][3].

Kimbodo Engineering Perspective

Choose tooling by the application’s control requirements, not by the breadth of its agent abstractions. Use a simple tool-calling loop when tasks are short and recoverable. Add graph or workflow orchestration when durable checkpoints, explicit handoffs, or human approval are necessary. Evaluate LangChain, LangGraph, LlamaIndex, AutoGen, CrewAI, PydanticAI, DSPy, Semantic Kernel, and the OpenAI Agents SDK against the same task and failure cases rather than treating their APIs as interchangeable.

Claude Code is useful as an engineering agent, but its workspace, shell, and MCP access warrant a separate permission model. In particular, enabling Linux nested user namespaces supports tools such as Chromium and rootless Podman but allows commands to bypass sandbox file protections [1].

How We Would Implement It

• Define the execution contract: specify permitted tools, approval points, maximum run time, request timeouts, retry limits, and what constitutes a completed response. For realtime integrations, use response-specific end events where exchange-level completion is insufficient [3].
• Separate orchestration from tools: keep business operations behind narrowly scoped APIs with server-side argument validation and authorization. Do not rely on a UI approval state alone to constrain tool execution [3].
• Persist only necessary state: use a durable step store for resumable work, with retention and access policies for messages and traces. Test cancellation, replay, parallel tool calls, and recovery after a worker restart [3].
• Roll out compatibly: version workflow definitions and MCP identifiers deliberately. Let affected in-flight Temporal or DBOS workflows finish, or follow the documented application-version migration path, before changing their execution identity [2][3].
• Test representative failures: include gateway rejection of tool search, credential refresh, unavailable MCP servers, denied approvals, and resumed sessions in acceptance tests [1][3].

Risks, Costs and Security

Patch affected SDK versions, restrict access to historical telemetry, and rotate credentials that may have appeared in MCP traces; setting include_content=False alone did not prevent this exposure [2][3]. Treat trace destinations, tool arguments, and MCP configuration as sensitive data.

Retries, delegated work, and unattended sessions can increase model usage and duplicate side effects unless tools are idempotent and limits are enforced. Durable state and observability add storage and operational cost, while broader sandbox permissions increase the blast radius of a compromised tool. Budget for those controls before expanding agent autonomy [1][3][4].

Sources

1. [1] v2.1.305
2. [2] v1.107.8 (2026-10-19)
3. [3] v2.58.0 (2026-10-19)
4. [4] v2.1.304