Skip to content

Release Notes v0.7.0

Release Date: August 2026

Highlights

  • AuthZEN: New authzen/ PDP client for authorization decisions, with agent-aware subject helpers (SPIFFE, delegation)
  • A2A: New a2a/ client for Google A2A agent discovery and task delegation
  • omniskill Adapter: New adapters/omniskill/ idjag verifier for omniskill's ExternalAuth seam, turning any omniskill-based MCP server into an OAuth resource server
  • Keycloak Adapter: New adapters/keycloak/ bootstrap for Keycloak 26.7's experimental identity-assertion-jwt receiver
  • MCP EMA Demo: New examples/mcp-ema/ end-to-end Enterprise-Managed Authorization demo (issuer → receiver → mcp-google resource server)

No breaking changes.

New Features

AuthZEN PDP Client (authzen/)

Client for the OpenID AuthZEN authorization API.

import "github.com/aistandardsio/agent-protocols/authzen"

client := authzen.NewClient("https://pdp.example.com")

subject := authzen.AgentSubject("code-review-agent",
    authzen.WithWorkloadID("spiffe://example.com/agent/review"),
    authzen.WithDelegator("user:alice"),
)
allowed, _ := client.IsAllowed(ctx, subject,
    authzen.NewResource("repository", "acme/backend", nil),
    authzen.NewAction("read", nil))

A2A Protocol Client (a2a/)

Discovery and task delegation client for Google A2A.

import "github.com/aistandardsio/agent-protocols/a2a"

discovery := a2a.NewDiscoveryClient()
card, _ := discovery.DiscoverAgent(ctx, "https://agent.example.com")

client, _ := a2a.NewClient(card, a2a.WithClientBearerToken("token"))
resp, _ := client.Invoke(ctx, &a2a.TaskRequest{
    CapabilityID: "security-scan",
    Input:        json.RawMessage(`{"repo": "acme/backend"}`),
})

omniskill Adapter (adapters/omniskill/)

Implements omniskill's oauth2.TokenVerifier by wrapping idjag's JWKS verifier — resolves the issuer's JWKS endpoint via discovery, verifies the bearer token, and maps the RFC 8693 delegation chain and claims into oauth2.TokenInfo. Requires omniskill's external TokenVerifier seam, released in omniskill v0.12.0.

import (
    adapter "github.com/aistandardsio/agent-protocols/adapters/omniskill"
    runtime "github.com/plexusone/omniskill/mcp/server"
)

verifier := adapter.NewVerifier(
    "https://keycloak.example/realms/agents", // issuer
    "https://mcp.example/mcp",                // expected audience
)

Keycloak Adapter (adapters/keycloak/)

Bootstraps a Keycloak 26.7 realm as an ID-JAG receiver via the admin REST API (client scopes, token-exchange policy, identity-assertion-jwt feature checks) plus a kcadm bootstrap script, and performs the RFC 8693 token exchange against it.

Experimental upstream feature

Keycloak's identity-assertion-jwt feature is experimental (introduced in Keycloak 26.7) and not for production. Developed and tested against quay.io/keycloak/keycloak:26.7 only.

MCP EMA Demo (examples/mcp-ema/)

End-to-end demo of MCP Enterprise-Managed Authorization: an IdP authorization server (issuer) exchanges an ID-JAG with a receiver — the in-process reference idjag.AuthorizationServer by default, or Keycloak (via the keycloak adapter) with KEYCLOAK_URL set — which mints an access token for an mcp-google resource server.

go run ./examples/mcp-ema

Added

  • authzen/ AuthZEN PDP client (d5bd420)
  • a2a/ A2A protocol client (337ea70)
  • adapters/omniskill/ idjag verifier adapter for omniskill ExternalAuth seam (1239f75)
  • adapters/keycloak/ Keycloak identity-assertion-jwt receiver adapter (f85c5a1)
  • examples/mcp-ema/ end-to-end MCP EMA demo (731accc)

Documentation

  • AuthZEN overview and getting-started guides (d4feb1a)
  • A2A overview and getting-started guides (ebd634f)
  • README updated with AuthZEN and A2A packages (eae7207)
  • README shields updated (157f282)
  • INIT-AGENTPROTOCOLS-001 initiative specs (PRD/TRD/PLAN/ROADMAP) (88d3c37)
  • omniskill and Keycloak adapter overview guides (4572728)

Dependencies

  • github.com/ogen-go/ogen v1.22.0 → v1.23.0 (6e339f4)
  • github.com/plexusone/omniobserve v0.11.0 → v0.12.0 (ef042c8)
  • github.com/go-faster/errors v0.7.1 → v0.8.0 (666b4e1)
  • go.opentelemetry.io/otel/metric v1.44.0 → v1.45.0 (008c1e9)
  • go.opentelemetry.io/otel/trace v1.44.0 → v1.45.0 (b4948da)
  • go.opentelemetry.io/otel v1.44.0 → v1.45.0 (e739433)
  • github.com/plexusone/omniskill v0.12.0, github.com/modelcontextprotocol/go-sdk v1.7.0, and other indirect updates (8fd1142)