v2.7.0

# Changelog

## New Features:

- **Service Accounts (PATs):** Expose any AgentOS as a Model Context Protocol server and connect it to your coding agent in one command. `uvx agno connect` mints per-client tokens, writes the MCP config into each client, and verifies the handshake — no manual JSON config editing. Tokens are `agno_pat_...` machine identities: SHA-256-hashed storage, scoped per-user, revocable via `agno tokens revoke`, and enforced across every deployment mode.
- **agnoctl (`agno` CLI)**: New CLI distributed as `agnoctl` on PyPI, invoked as `agno`. `uvx agno connect` provisions PATs and wires up coding-agent MCP clients in one command.
    - `agno connect` — discover an AgentOS, mint per-client PATs (`--name` for a shared token), write MCP config for Claude Code, Claude Desktop, Cursor, Codex, and ChatGPT, then verify each connection.
    - `agno tokens create/list/revoke` — mint, inventory, and rotate PATs.
    - `agno create` — scaffold a new AgentOS project from a template (`agentos-<provider>`).
    - `agno up`/`down`/`restart`/`status` — lifecycle management for local AgentOS deployments.
- **Eval Suite Runner**: New `agno.eval` package: `Case`, `run_cases`, and CLI runner with team subjects and numeric judge scoring.
- **`GET /info` Discovery Endpoint**: Reports `agno_version`, `mcp: {enabled, path}`, and `auth_mode` so external tooling (e.g. `agnoctl`) can discover an AgentOS's capabilities before touching it.

## Improvements:

- **MCP Interface v2**: New 8-tool operator surface at `/mcp`: `get_agentos_config`, `run_agent`, `run_team`, `run_workflow`, `continue_run`, `cancel_run`, `get_sessions`, `get_session_runs`. Trimmed run results (with `result_mode="full"` escape hatch), MCP progress notifications for long-running tools, HITL continue/cancel lifecycle.
- **Single Auth Layer:** One `AuthMiddleware` on the parent app covers REST, `/mcp`, and WebSocket transports — no more per-transport drift. `JWTMiddleware` is preserved as an alias for backward compatibility.
- **Scope Enforcement**: `check_route_scopes` used identically by JWT, service-account, and MCP paths, with a data-driven `get_resource_context_from_path` (replacing hardcoded substring matches). Every MCP built-in tool maps onto its REST-equivalent route for scope checks.
- **A2A Authorization**: A2A/AGUI routes now enforce authorization alongside authentication; scope-mappings are merged per-interface at the mount prefix so custom prefixes are gated too.

## Bug Fixes:

- **User Isolation for Traces**: `GET /traces/{trace_id}` now enforces per-user ownership (returns 404 on mismatch, matching listing behavior).
- **A2A Authentication**: `_add_auth_middleware` no longer excludes A2A interface routes — Slack/Telegram/WhatsApp self-authenticate their own inbound requests, but A2A did not and was previously bypassing the single auth layer.
- **MCP `get_agentos_config` Db-List Deduping**: The reported `databases` list is now deduplicated across agent/team/workflow db references.
- **`get_db` Guard**: Now raises a clear 400 "No database is configured on this AgentOS" when no db is registered, instead of raising bare `StopIteration`.

## Breaking Changes:

- **MCP Surface Shrunk from 19 → 8 Tools**: Session-write and memory-CRUD tools are no longer exposed via MCP. `MCPServerConfig(include_tags={"memory"})` now fails Pydantic validation. Users who relied on these tools must call REST endpoints instead.
- **MCP Run Results Trimmed by Default**: Clients that consumed the raw `RunOutput` shape must either handle the new trimmed shape or set `result_mode="full"` in `MCPServerConfig`.
- **`AgentOS(authorization=True)` Without JWT Keys Fails Fast**: Previously this configuration silently served an OPEN instance (JWT and anonymous requests fell through unauthenticated). Now raises `ValueError` at construction. Set `JWT_VERIFICATION_KEY`/`JWT_JWKS_FILE` env vars or pass `verification_keys`/`jwks_file` via `authorization_config`.
- **`AGENTOS_URL` Env Var:** Renamed from `AGNO_OS_URL`. Migration: update any environment or CI config that referenced the old name.

## What's Changed
* cookbook: Add BGPT MCP cookbook example for evidence-grounded paper search by @connerlambden in https://github.com/agno-agi/agno/pull/8740
* feat: v2.7 — service accounts, MCP interface v2, agnoctl, and eval suites by @ashpreetbedi in https://github.com/agno-agi/agno/pull/8747
* release: v2.7.0 by @kausmeows in https://github.com/agno-agi/agno/pull/8775

## New Contributors
* @connerlambden made their first contribution in https://github.com/agno-agi/agno/pull/8740

**Full Changelog**: https://github.com/agno-agi/agno/compare/v2.6.22...v2.7.0