What Is AG2? The Community Fork of AutoGen: Versions, Packages, Protocols and Licence Explained

AG2 is an open source Python framework for building AI agents and getting several agents to cooperate on a task, maintained by a volunteer community that forked Microsoft's AutoGen at version 0.2.35. Search results mix three things under the AG2 name: the original AutoGen-style framework (now called AG2 Classic), the rewritten AG2 1.x framework imported as ag2, and the AG2 commercial products such as AgentOS. This page separates them, sets out which package and import you need, what changed at version 1.0, which models and protocols the framework supports, and what the licence and support position is. It is written for developers, architects and the people who approve frameworks for a team. Every fact comes from AG2's own repositories, documentation, release notes and website. Last checked: 2026-11-15.

This is an independent guide from NHI Mgmt Group, based on AG2's public documentation as of November 2026. It is not sponsored or reviewed by AG2. Product features change, so confirm settings against AG2's current documentation.

Key takeaways

• Two frameworks share the name. AG2 Classic keeps the autogen import and ConversableAgent, GroupChat and swarms; AG2 1.x is imported as ag2 and is built around Agent and the Network.
• Version 1.0 is not a drop-in upgrade. The v1.0.0 release notes (27 July 2026) say so directly: the agent model, orchestration and imports all changed, and the classic code moved to the ag2-classic repository.
• Classic is in maintenance mode. The classic repository states it receives security and critical bug fixes only, with no new features, so new projects start on 1.x.
• Apache 2.0, with MIT heritage. Both repositories carry the Apache License 2.0; the NOTICE file says portions that came from the original AutoGen repository remain under the MIT licence.
• Protocol support is broad. AG2 1.x ships optional extras for MCP, A2A, AG-UI, A2UI and ACP, plus OpenTelemetry tracing and Prometheus metrics.

What is AG2?

The AG2 README describes the project as "an open-source programming framework for building AI agents and facilitating cooperation among multiple agents to solve tasks", with support for tool use, many model providers, autonomous and human-in-the-loop workflows and multi-agent conversation patterns. The project's tagline is "Open-Source AgentOS for AI Agents". The ag2.ai website calls it "the open-source Python framework for building, orchestrating, and scaling multi-agent AI systems".

Where it came from: the NOTICE file states that the project is a fork of microsoft/autogen, created from version v0.2.35 of the original project. The classic repository's announcement for 11 November 2024 reads that AutoGen was "evolving" into AG2, with a new GitHub organisation, AG2AI, created "to host the development of AG2 and related projects with open governance". Project administrators named in the README are Chi Wang and Qingyun Wu, and the MAINTAINERS file lists volunteers from organisations including Penn State University, Meta, Google, IBM and airt.ai. The ag2.ai website describes the team as "from the creators of AutoGen".

The 2026 split: in version 1.0 the protocol-driven framework that had been developed as autogen.beta became the mainline package, imported as ag2. Everything built on the original agent classes moved to a separate repository with its own documentation site.

As of 15 November 2026, from the two repositories' README files.

Key facts at a glance

As of 15 November 2026, from the AG2 repositories, documentation and ag2.ai.

Plans and pricing

The framework costs nothing to use. Both repositories are Apache-2.0 licensed and installed from PyPI. Running agents costs what the chosen model provider charges, plus any sandbox or hosting you add.

The ag2.ai website also describes two commercial products, with the line "Open source at the core. Enterprise-ready at scale.":

• AG2 AgentOS: described as a runtime for coordinating agents built in different frameworks, with three areas named Orchestrator, Studio and Applications.
• AG2 Space: a macOS app that places people and their agents in shared rooms for context sharing, handoffs and approvals; the site says it "Works with Claude Code or Codex".

Availability: as of 15 November 2026 the ag2.ai website offers these products through request-access and early-access forms. Prices, plans and a hosted tier are not stated by AG2.

Models available

AG2 does not ship a model. Each provider has a configuration class in ag2.config and a matching install extra, and each class reads the provider's standard environment variable so keys do not need to be written into code. The Models and Providers page lists these classes as of 15 November 2026:

Self-hosted and compatible servers: the docs point vLLM, LM Studio and similar servers at OpenAICompletionsConfig with a custom base_url, and use extra_body for provider-specific request fields. VertexAIConfig accepts a service account key file, Application Default Credentials or a credentials object, and the docs name the Vertex AI User role (roles/aiplatform.user).

Deprecation to note: OpenAIConfig is a deprecated alias for Chat Completions, and the docs say that in 1.4.0 it is scheduled to become an alias for OpenAIResponsesConfig, which means renaming parameters such as max_completion_tokens to max_output_tokens.

A remote A2A agent can also stand in for a model: A2AConfig plugs into a local Agent so it talks to a remote A2A endpoint as if it were a provider.

Features and modes

The README groups AG2 1.x around a small set of concepts. The table lists them with the classes the documentation uses.

Network channel types

The README describes four channel shapes. conversation is free-form between two parties and never closes on its own. consulting is one question and one reply, then closes. discussion is round-robin across several agents with no turn cap. workflow is driven by a declarative TransitionGraph with a hard turn cap, and the README calls it the closest analogue to a classic GroupChat. Graphs are JSON-serialisable and survive Hub.hydrate(), according to the migration guide.

Moving from GroupChat to the Network

The group chat migration guide maps the classic names to their 1.x equivalents. The most common ones:

Protocols

• MCP: MCPToolkit connects to local stdio servers (MCPStdioServerConfig) and remote streamable HTTP servers (MCPServerConfig), with allowed_tools, blocked_tools and tool_name_prefix. The mcp extra requires the MCP SDK 2.x (mcp>=2.3.0,<3). AG2 can also serve MCP, MCP-UI and MCP Apps.
• A2A: A2AServer exposes an agent over JSON-RPC, REST or gRPC and publishes its card at /.well-known/agent-card.json; ag2.a2a.security offers bearer, API key, OAuth2, mTLS, HTTP and OpenID Connect schemes, and the docs cover card signing.
• AG-UI and A2UI: serve agents to front ends, including human input and approvals as client interrupts.
• ACP: serve AG2 agents to, and drive, CLI coding agents through the Agent Client Protocol.
• NLIP: listed among the new protocols in the v1.0.0 release notes.

Supported IDEs and platforms

• Runtime: any environment with Python 3.11 or later; the README gives install commands for Windows, Linux and macOS.
• Installation: pip install ag2 installs minimal dependencies; provider extras such as ag2[openai], ag2[anthropic], ag2[gemini], ag2[ollama] and ag2[bedrock] add model clients, and protocol extras add a2a, ag-ui, a2ui, acp, mcp and mcp-ui.
• Code execution environments: the Sandbox Shell docs name LocalEnvironment, DockerEnvironment, DaytonaEnvironment and TenkiEnvironment.
• Coding assistants: the user guide has an "AI Coding Assistants" section, and the ACP integration lets CLI coding agents work with AG2 agents.
• Learning resources: the AG2 Playground, the build-with-ag2 examples repository and the documentation's code examples.

Enterprise and admin controls

AG2 is a library, so there is no admin console: controls are set in code by the team that builds the agent. The documented ones:

• Approval-required tools: @tool(middleware=[approval_required()]) asks a person before the tool runs. Without a hitl_hook the turn ends with HumanInputNotProvidedError and the tool does not run. allow_always defaults to True, so a user can approve a tool for the rest of the conversation; timeout defaults to None (wait indefinitely). Over A2A and AG-UI the reserved approval keys are stripped in both directions so remote callers cannot pre-approve tools.
• Sandbox Shell policy: allowed, blocked, ignore and readonly=True switch the tool into restricted mode, where commands run without a shell. Defaults are a 60 second per-command timeout and 100,000 characters of output.
• MCP tool filtering: allowed_tools and blocked_tools limit which server tools the agent sees; MCPAnswerPolicy controls which server input requests are answered.
• A2A authentication: the require() builder declares the schemes an agent card requires, and signed cards can be verified on the client.
• Network audit trail: the Hub keeps a write-ahead log that can be replayed with read_wal().
• Task lifecycle: ask() and run() accept ttl_seconds, and the Tasks guide covers cancellation.

Data handling and privacy

Agents run inside your own process, and prompts go to whichever model provider you configure, under that provider's terms. AG2 does not describe a hosted service for the framework, so retention and training use for the open source library are not stated by AG2. Three documented behaviours matter for data handling:

• Trace content is captured by default. TelemetryMiddleware emits OpenTelemetry spans following the GenAI semantic conventions (invoke_agent, chat, execute_tool, await_human_input), and includes message content, tool arguments, tool results and human input unless you pass capture_content=False. The docs warn that captured content appears in the tracing backend.
• Persistent memory is opt-in. DiskKnowledgeStore keeps what the agent remembers after the process exits, so it needs the same care as any other data store.
• Middleware descriptions hide values. The middleware docs say descriptions must not expose credentials and that option values are not reported.

The ag2.ai products have their own access forms; data terms for them are not stated on the pages checked.

Release history

As of 15 November 2026, from the classic repository announcements, the NOTICE file and the GitHub release notes.

Limits and known constraints

• Breaking upgrade path: moving from Classic to 1.x means rewriting agent definitions and orchestration; the README tells Classic users to pin the classic distribution rather than ag2>=1.0.
• Breaking changes inside 1.x: releases 1.0.3, 1.1.1 and 1.1.2 each carry changes marked breaking (MCP 2.0, Bedrock client, AG-UI 1.0), so pin versions and read release notes before upgrading.
• Async only: AG2 1.x is "async throughout", so synchronous code bases call it through an event loop.
• Shell filters have limits: the docs state that blocked cannot stop programs that launch other programs (such as sh -c, env or xargs) and recommend allowed or an isolated backend for a hard boundary.
• Default local shell: with no arguments the Sandbox Shell uses LocalEnvironment, which the docs say gives the agent direct access to the file system and the ability to run arbitrary commands.
• Some channels never stop on their own: conversation and discussion channels need the application to bound and close them.

Security guidance

This page describes what AG2 is and how it is packaged. The wider discipline is in the Securing Agent Frameworks Guide. In AG2 terms, start with the controls the framework documents: gate irreversible or sensitive tools with approval_required(), and consider allow_always=False and a finite timeout where a standing approval would be too broad. Run shell and code tools in DockerEnvironment or another isolated backend rather than LocalEnvironment, and use allowed or readonly=True when prompts may be untrusted; the AI Agent Sandboxing and Code Execution Guide covers the isolation choices. Limit MCP servers with allowed_tools and see the MCP Security Guide. Require authentication and signed cards on A2A endpoints, as covered in the Multi-Agent and A2A Security Guide. Keep provider keys in environment variables or a secrets store, and set capture_content=False or restrict tracing backend access where traces would carry sensitive data. Apply AG2 security updates promptly: several 2026 releases include security fixes.

Practitioner checklist

• Search code for import autogen, ConversableAgent and GroupChat to find which services are on AG2 Classic.
• Pin Classic services to the classic distribution and plan any move to 1.x as a rewrite, using the group chat migration guide.
• Confirm Python 3.11 or later before adopting ag2 1.x, and pin exact versions in lock files.
• Read release notes for every 1.x upgrade, since several minor releases are marked breaking.
• Wrap sensitive tools in approval_required() and decide deliberately whether allow_always stays on.
• Run shell and code tools in an isolated environment and set allowed or readonly for untrusted input.
• Decide on telemetry content capture per environment and restrict who can read traces.
• Record the Apache 2.0 licence and the MIT-licensed portions from AutoGen in your open source register.

Standards and references

• AG2: ag2ai/ag2 repository and README
• AG2: NOTICE (fork and licence history)
• AG2: ag2ai/ag2-classic repository and README
• AG2: GitHub releases
• AG2: Models and providers
• AG2: Migrating from group chat
• AG2: Approval required tools
• AG2: Agent telemetry

Related NHI Mgmt Group resources: Securing Agent Frameworks Guide · AI Agent Sandboxing and Code Execution Guide · Multi-Agent and A2A Security Guide · Human-in-the-Loop for AI Agents Guide · OpenTelemetry GenAI Semantic Conventions for Security Teams