Agent Stack — June 9, 2026

The read

The harness, tool surface, and delegation topology are commoditizing together. When every vendor ships MCP and orchestration, the moat is how humans wire judgment, guardrails, and institutional context into the agent loop — not whether agents can run.

What moved

• Google ADK v2.2.0 ships Workflow-to-A2A conversion, HITL state distinction, and request_input clarification tool — Google ADK Python GitHub Google Agent Development Kit v2.2.0 (June 4) adds Workflow-to-A2A serialization so ADK-defined multi-agent workflows can be exposed as A2A-compatible service endpoints; distinguishes input-required vs auth-required states in human-in-the-loop flows; preserves transparent config on live session reconnect; and introduces a request_input tool enabling agents to ask for clarification mid-execution rather than failing silently. Default model shifts from gemini-2.5-flash to gemini-3-flash-preview ahead of October 2026 sunset. Two breaking changes: GenAI SDK v2 renames turn-based helpers (convert_contents_to_turns → convert_contents_to_steps). Builder angle: Workflow-to-A2A lets you wrap an ADK multi-agent graph as an A2A service endpoint without manual protocol wiring; the input/auth HITL state distinction changes how you gate approval vs authentication interrupts in production agent loops.

• Pydantic AI v1.105.0 adds on-demand deferred tool loading; v1.101.0 brought MCP background tasks and ctx.enqueue — Pydantic AI GitHub Pydantic AI v1.105.0 (June 2) introduces on-demand deferred loading for tools, instructions, model settings, and hooks — schemas are serialized only on first invocation, cutting cold-start overhead for harnesses with large tool registries. Companion v1.101.0 (May 21) added MCP background task support for non-blocking long-lived tool calls and ctx.enqueue/agent_run.enqueue for a pending message queue across agent turns. v2.0.0b6 (June 5) mirrors all v1 changes in the ongoing v2 breaking-change beta. Builder angle: Deferred loading removes schema serialization cost at agent init; MCP background tasks change the execution model for any MCP tool that runs for more than a few seconds without blocking the main agent loop.

• Azure DevOps remote MCP server enters public preview with Streamable HTTP and Entra auth — Microsoft Learn (Azure DevOps docs) Microsoft shipped a hosted Azure DevOps MCP server in public preview that runs over Streamable HTTP transport with Microsoft Entra ID (OAuth) authentication — no local Node.js install required. Agents connect via a single mcp.json URL (https://mcp.dev.azure.com/{org}). Tool exposure is scoped at the request level via X-MCP-Toolsets headers (repos, wit, pipelines, wiki) and read-only mode is enforced via X-MCP-Readonly. Currently limited to VS Code and Visual Studio; other clients (Claude Desktop, Cursor, Codex) are blocked pending Entra OAuth dynamic client registration support. Builder angle: First Microsoft-hosted MCP server that demonstrates the Streamable HTTP + Entra auth migration pattern from stdio+PAT — changes how agents connect to ADO without local daemon setup.

Also tracking

• IETF individual draft names ‘Protocol Pivoting’ as MCP-specific lateral-movement attack class — source — Protocol Pivoting formalizes the cross-server exploit chain that MCP gateway operators must defend against when chaining multiple backend servers in an agent stack.
• Pega announces every Pega application becomes an MCP server in Infinity 26 (Q3 2026) — source — Pega’s workflow runtime joins the MCP server ecosystem as an enterprise-governed execution surface, letting agents delegate mission-critical process steps rather than model them from scratch.