AgentScope 2.0: Alibaba’s model-led agent framework for production systems

Agent frameworks have evolved from simple wrappers to complex orchestration systems, but many still impose rigid pipelines that limit the potential of modern large language models (LLMs). Enter AgentScope 2.0, a production-ready agent framework from Alibaba DAMO Academy designed to shift the paradigm. Instead of constraining LLMs with predefined workflows, AgentScope 2.0 empowers models to drive reasoning and tool use natively, while providing the infrastructure required for real-world deployment.

This release marks a significant departure from earlier versions. AgentScope 2.0 introduces a suite of production-grade systems—including an event bus, fine-grained permissions, multi-tenant isolation, and sandbox execution—ensuring agents can operate safely, scalably, and transparently in enterprise environments. The framework’s philosophy is clear: when LLM reasoning is robust, the framework should step back and let the model’s capabilities shine.

Why AgentScope 2.0 redefines agent frameworks

Traditional agent frameworks like LangChain and AutoGen focus on orchestrating agent behavior through structured pipelines or conversational flows. While effective for demonstrations, these approaches often introduce friction in production environments by forcing LLMs into predefined paths. AgentScope 2.0 flips this model by prioritizing model-led reasoning over rigid execution paths.

The framework’s core insight is that as LLMs grow more capable, their native reasoning and tool-use abilities should guide agent behavior, not the other way around. AgentScope 2.0 provides the scaffolding—event handling, permission controls, and sandboxed execution—so developers can build agents that are not only functional but also reliable and secure. This shift positions AgentScope 2.0 as a compelling alternative for teams seeking to deploy agents at scale without sacrificing flexibility.

Core systems behind AgentScope 2.0’s production readiness

AgentScope 2.0 is built on five foundational systems that address the challenges of real-world agent deployment. Each system is designed to integrate seamlessly while maintaining modularity and extensibility.

1. Event system: a unified control plane for agent workflows

The event system acts as a centralized nervous system for the agent, broadcasting real-time updates across every stage of the reasoning loop. Developers can subscribe to specific events—such as model calls, tool invocations, or text generation start/end—to monitor, intervene, or log activity. For example:

from agentscope.message import EventType

async def monitor_agent(agent):
    async for evt in agent.reply_stream(user_message):
        if evt.type == EventType.TOOL_CALL_START:
            print(f"[ALERT] Tool {evt.tool_name} invoked")
        elif evt.type == EventType.TEXT_BLOCK_DELTA:
            print(evt.delta, end="", flush=True)

This system enables human-in-the-loop workflows, allowing operators to pause agent execution at critical junctures—such as tool calls—request manual approval, and resume operation. It’s a critical feature for environments where safety and oversight are non-negotiable.

2. Permission system: granular control over tool execution

AgentScope 2.0’s permission system lets developers define approval rules for tool calls based on sensitivity, cost, or risk. Tools like file writes or shell commands can be configured to require explicit approval, while safer operations—such as reads—can execute automatically. For instance:

from agentscope.permission import PermissionConfig, ApprovalMode

config = PermissionConfig(
    Write=ApprovalMode.ALWAYS,      # Files require approval
    Bash=ApprovalMode.ALWAYS,       # Shell commands require approval
    Read=ApprovalMode.NEVER,        # Reads execute automatically
    default_cost_threshold=0.10     # Operations over $0.10 require approval
)

This granularity ensures agents operate within defined boundaries, reducing the risk of unintended actions while maintaining operational efficiency.

3. Multi-tenancy: isolating agents for security and scalability

In multi-user environments, tenant isolation is paramount. AgentScope 2.0’s FastAPI-based service layer provides production-grade isolation for agent instances across tenants, ensuring that one user’s agents remain invisible to another. Key features include:

• Session-level context management for personalized experiences
• Concurrent request handling across multiple users
• Built-in authentication for secure access

This system is particularly valuable for SaaS platforms or enterprise deployments where data privacy and performance are critical.

4. Workspace and sandbox execution: isolating tool use safely

AgentScope 2.0 supports three backend options for executing tools, each tailored to different use cases:

• Local: Fastest for development and testing, ideal for prototyping
• Docker: Balances speed and isolation, suitable for production with controlled dependencies
• E2B: Cloud-based sandboxing for the highest security, ensuring tools run in isolated environments

Developers can switch between backends without modifying agent code, allowing them to adapt to changing security or performance requirements seamlessly.

5. Middleware: extending agent behavior without core modifications

Middleware hooks allow developers to inject custom logic—such as logging, guardrails, or retry policies—into the agent’s reasoning loop. For example:

from agentscope.middleware import LoggingMiddleware, GuardrailMiddleware

agent = Agent(
    ...
    middlewares=[
        LoggingMiddleware(log_tool_calls=True),
        GuardrailMiddleware(blocked_patterns=["rm -rf", "DROP TABLE"]),
    ]
)

This modular approach enables teams to enforce policies, monitor behavior, and extend functionality without altering the core agent logic, reducing maintenance overhead.

Agent Team: coordinating multi-agent workflows

AgentScope 2.0 introduces the Agent Team pattern, a leader-worker architecture that simplifies coordination for complex tasks. The leader agent decomposes objectives, creates worker agents, and aggregates results—all via built-in team tools. This pattern is particularly effective for tasks like research, debugging, or multi-step problem-solving.

For example, a leader agent tasked with analyzing a codebase could:

• Delegate sub-tasks to specialized worker agents
• Monitor progress and aggregate findings
• Present a consolidated report to the user

This approach leverages parallelism and specialization while maintaining a single point of control, making it ideal for enterprise workflows.

Positioning: how AgentScope 2.0 compares to alternatives

AgentScope 2.0 distinguishes itself from frameworks like LangChain and AutoGen through its model-led philosophy and production-first design. While LangChain excels in chain-based orchestration and AutoGen in multi-agent conversation, AgentScope 2.0 focuses on enabling LLMs to drive behavior while providing the infrastructure for safe deployment.

• LangChain: Best for pipeline-based workflows with structured prompts
• AutoGen: Ideal for conversational multi-agent systems
• AgentScope 2.0: Optimized for production agents that prioritize model reasoning and safety

This positioning makes AgentScope 2.0 a strong choice for teams building agents that need to operate autonomously in real-world environments.

Ecosystem and future roadmap

AgentScope 2.0 is part of a growing ecosystem that includes:

• AgentScope Runtime: A service layer for deploying agents in production
• ReMe: A model evaluation toolkit for assessing agent performance
• OpenJudge: A benchmarking suite for multi-agent systems
• Trinity-RFT: A framework for fine-tuning agents with reinforcement learning

With over 27,100 GitHub stars and continuous updates, the framework is rapidly gaining traction. The team behind AgentScope 2.0—led by researchers including Dawei Gao, Zitao Li, and Yaliang Li—has published multiple papers exploring the framework’s theoretical and practical foundations. As LLMs continue to evolve, AgentScope 2.0 is poised to play a pivotal role in bridging the gap between academic research and real-world deployment.

The future of agent frameworks lies not in rigid pipelines, but in systems that empower models to reason, adapt, and act with minimal constraints. AgentScope 2.0 is a step toward that future—one where agents are not just tools, but trusted collaborators in the digital workspace.