Dev & Engineering event-streamingpermission-controlmulti-tenant-servingsandbox-executionfastapiraglong-term-memory

AgentScope 2.0

A Python framework for building, running, and serving observable, controllable agents.

FollowAgents review · FARS-2.1
Use with care
70/ 100 5-point scale 3.5 / 5
1 2 3 4 5 6
Per-dimension scores and reasoning
1Trust16 / 29 · 2.8/5

Evidence shows the framework provides a permission system (Permission & HITL) and sandbox isolation (Workspace/Sandbox), supporting tool-level permission control and user confirmation, but lacks default least-privilege configuration or mandatory confirmation, hence 2. Data flow transparency: event system streams reasoning and tool calls, but data flow and storage locations are not clearly documented, hence 2. Sensitive data handling: API keys are passed via environment variables, but no encryption or redaction is mentioned, hence 1. Dependency security: dependency list is clear but no vulnerability scanning or lock files, hence 1. External effects: tools can execute shell commands and file operations, but controlled via permission system, hence 2. Rollback: no mention of state rollback or undo mechanisms, hence 1. Source attribution: license and third-party code attribution are clear, hence 2.

2Reliability9 / 14 · 3.2/5

Self-consistency: README and pyproject.toml descriptions are consistent, tests show internal consistency, hence 2. Dependency availability: dependency list is clear with optional extras, but no lock files, hence 2. Failure messages: tests show error handling (e.g., invalid timezone fallback), but no user-friendly error message documentation, hence 2.

3Adaptability14 / 18 · 3.9/5

Audience and scenarios: README clearly targets developers and researchers, with multiple scenarios (agent service, RAG, team collaboration), hence 3. Capability boundaries: documentation lists building blocks and features, but no explicit limitations or boundaries, hence 2. Trigger precision: event system provides precise event types, but trigger conditions are not documented, hence 2. Environment fit: supports multiple Python versions and OS, but no containerized deployment instructions, hence 2.

4Convention14 / 18 · 3.9/5

Information architecture: README is well-structured with rich documentation links, hence 3. Install notes: provides PyPI and source installation steps, hence 3. Naming stability: API naming is consistent, but no naming convention documentation, hence 2. Examples and FAQ: provides multiple examples and documentation links, but no FAQ, hence 3. Known limitations: no explicit list of known limitations, hence 1. License: Apache-2.0 license is complete, hence 3. Versioning and changelog: has NEWS.md but no detailed changelog, hence 2. Maintenance responsibility: has contribution guide and community channels, but no explicit maintainers, hence 2.

5Effectiveness12 / 13 · 4.6/5

Output usability: provides event streams and structured output for easy integration, hence 3. Marginal value: provides rich building blocks and features, offering unique value compared to other frameworks, hence 3. Cost-benefit: open-source and free, but deployment and running costs are not documented, hence 2.

6Verifiability5 / 8 · 3.1/5

Claim traceability: feature claims in README have documentation and example links, hence 2. Cross-source corroboration: has arXiv papers and documentation, but not independently verified, hence 2. Fact-inference separation: documentation distinguishes feature descriptions and examples, but does not explicitly separate facts and inferences, hence 2.

Evidence confidence: Low Reviewed Aug 09, 2026 Reviewed revision 29b592358c2e
The upstream repository has new commits since this review. The score still applies to the reviewed revision shown and may not cover the latest changes.
Before you use it
  • No default least-privilege configuration; users must configure the permission system themselves.
  • Sensitive data handling (e.g., API keys) lacks encryption or redaction measures.
  • Dependencies lack lock files, posing supply chain risks.
  • Known limitations are not explicitly listed, potentially affecting production deployment decisions.
  • No rollback mechanism provided; state changes may be irreversible.
Review evidence [1][2][3][4][5][6][7][8]
See the full review method →

What does this agent do, and when should you use it?

AgentScope 2.0 is a production-oriented Python agent framework with core Agent, model, tool, message, and event abstractions. An agent can return an event stream through reply_stream, allowing callers to handle reply lifecycle, model calls, and incremental text. The framework documents permissions, middleware, workspaces, and sandboxes with local, Docker, E2B, OpenSandbox, and Daytona backends. It also includes a FastAPI-based multi-tenant, multi-session agent-service example and a prebuilt Web UI under examples/web_ui. The README additionally documents examples or support for Agent Team, RAG, and long-term memory.

A developer constructs an Agent with DashScopeChatModel, DashScopeCredential, and a Toolkit containing Bash, Grep, Glob, Read, Write, and Edit. Calling agent.reply_stream(UserMsg("Tony", "Hi, Friday!")) asynchronously yields events that an application can use to process EventType.REPLY_START, MODEL_CALL_START, TEXT_BLOCK_START, TEXT_BLOCK_DELTA, and TEXT_BLOCK_END. For service deployment, python main.py in examples/agent_service starts the FastAPI backend, while pnpm dev in examples/web_ui starts the Web UI. In the documented Agent Team mode, a leader agent spawns workers and coordinates them through built-in team tools.

  1. A Python developer building a chat interface that needs to react separately to model calls, reply lifecycle events, and streamed text.
  2. An application team that wants an agent to use Bash and file-reading, writing, and editing tools while controlling access to tools and resources.
  3. A backend team serving isolated agent conversations for multiple tenants and sessions through a FastAPI-based example service.
  4. A developer who needs tools or code to run in local, Docker, E2B, OpenSandbox, or Daytona workspace and sandbox environments.
  5. A prototyping team exploring a leader agent that delegates work to worker agents and coordinates a multi-step task.
  6. An agent application developer evaluating the repository's RAG, Agentic Memory, Mem0, or ReMe long-term-memory examples.

What are this agent's strengths and limitations?

Pros
  • A unified event stream exposes reply, model-call, and text-delta states for UI or application integration.
  • It documents a fine-grained, configurable permission system for tools and resources, and shows a bypass mode for unpaused execution.
  • Workspace and sandbox support spans local, Docker, E2B, OpenSandbox, and Daytona backends.
  • It includes a FastAPI multi-tenant, multi-session service example plus a companion Web UI instead of only a single-process agent snippet.
  • The README explicitly names examples or support for RAG, Agent Team, Agentic Memory, Mem0, and ReMe.
Limitations
  • The only complete model setup shown uses DashScopeCredential, DASHSCOPE_API_KEY, and qwen3.6-plus; the supplied material does not document setup for other providers.
  • The library requires Python 3.11+, and the example Web UI additionally requires pnpm.
  • Tools such as Bash, Read, Write, and Edit can execute commands or modify files, so deployments need their own permission policy and sandbox boundary.
  • Multi-tenancy, multi-session serving, RAG, and long-term-memory extensions are named as capabilities, but the supplied material does not provide production configuration, capacity, or recovery details.
  • The README shows normal event types but does not specify error events, retry behavior, or semantics for model-call failures.

How do you install or deploy this agent?

Python 3.11 or later is required.

Install from PyPI:

uv pip install agentscope

Or:

pip install agentscope

Install from source:

git clone -b main https://github.com/agentscope-ai/agentscope.git
cd agentscope

uv pip install -e .

The first README example uses the DASHSCOPE_API_KEY environment variable, so that credential must be supplied before running it.

How do you use this agent?

After setting DASHSCOPE_API_KEY, run this minimal streaming invocation:

import os, asyncio
from agentscope.agent import Agent
from agentscope.credential import DashScopeCredential
from agentscope.model import DashScopeChatModel
from agentscope.message import UserMsg

async def main() -> None:

agent = Agent(

name="Friday",
system_prompt="You're a helpful assistant named Friday.",

model=DashScopeChatModel(

credential=DashScopeCredential(api_key=os.environ["DASHSCOPE_API_KEY"]),
model="qwen3.6-plus",
),
)
async for evt in agent.reply_stream(UserMsg("Tony", "Hi, Friday!")):

print(evt.type)
asyncio.run(main())

To start the example service from the repository root:

cd examples/agent_service
python main.py

In another terminal, start the Web UI:

cd examples/web_ui
pnpm install
pnpm dev

FAQ

What credentials does the documented example need?
The Hello AgentScope example requires DASHSCOPE_API_KEY and passes it to DashScopeChatModel through DashScopeCredential.
Can it run as a web service?
Yes. python main.py in examples/agent_service starts the README-described FastAPI multi-tenant, multi-session service, and pnpm dev in examples/web_ui starts its UI.
How are tool permissions controlled?
The README documents a fine-grained, configurable permission system for tools and resources, but the supplied material does not show its policy configuration format.
Must tools run on the local machine?
No. The README lists local, Docker, E2B, OpenSandbox, and Daytona as workspace or sandbox backends.
How are streaming or model-call failures handled?
The supplied README lists normal event types but does not document error events, retries, or recovery behavior; those should be validated for the target model and runtime.

Compare agents like this one

The same FARS review applied across the shortlist this agent qualifies for.

Related agents