ag2
AG2 (formerly AutoGen): The Open-Source AgentOS.Join us at: https://discord.gg/sNGSwQME3x
No outside reports on file
AG2 can run code and access external APIs, so treat it like untrusted code: isolate it, limit its permissions, and never give it access to sensitive data or high-value API keys.
Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachConnects to outside service APINOTED
- CredentialsRequires API key or tokenREVIEW
- Package sourceGitHub (ag2ai/ag2)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/ag2ai/ag2 ↗
About Ag2
AG2 is an open-source framework for building AI agents that can work together to solve problems. It lets you create multiple AI assistants that communicate with each other and complete tasks through conversation and code execution.
Who it’s for
Developers and researchers building multi-agent AI systems who want an open-source alternative to proprietary platforms. Teams experimenting with collaborative AI workflows.
Alternatives
- LangChain: Popular framework for chaining LLM operations and building agents
- LlamaIndex: Specializes in connecting AI to your data for retrieval-augmented generation
- Anthropic Claude SDK: Direct SDK for building with Claude AI (some multi-agent patterns supported)
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README at https://github.com/ag2ai/ag2 (opens external site) for installation and configuration instructions, as setup varies based on your use case and which LLM backend you choose.
Why this grade
Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 5k
- Listing last refreshed
- 2026-10-29
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Security reports
No reports found for this package in our research (last checked 2026-10-29).
Risks to watch for
- Code execution: AG2 can run Python code to complete tasks, so malicious prompts or injected text could execute harmful commands on your machine
- API key exposure: If agents interact with external services, your API keys could leak through logs, error messages, or agent conversations
- Data in conversations: Chat histories and agent interactions may contain sensitive information that gets stored or logged
- LLM prompt injection: Untrusted input fed to agents could trick the AI into revealing system information or bypassing safety guardrails
- Dependency vulnerabilities: The framework depends on other packages that could contain security flaws
How to lower the risk
Least-privilege permissions
- Run AG2 in a sandboxed environment or container with no access to sensitive files
- Give agents only the API keys and credentials they absolutely need
Network isolation
- Restrict outbound network access to only required services
- Run behind a firewall that logs all external connections
Monitoring
- Log all code execution and external API calls agents make
- Review conversation logs regularly for suspicious patterns
Red flags to watch for
- Agents making unexpected API calls or network requests
- Code execution errors that reveal system paths or environment variables
- Unusual token consumption or API usage spikes
Questions
How do I install Ag2?
Ag2 does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/ag2ai/ag2.
Are there security reports about Ag2?
No reports found for this package in our research (last checked 2026-10-29). Ag2 currently holds Grade B (Some risk signals) based on public adoption and transparency signals. Key risk areas to watch include code execution, api key exposure, data in conversations.
Is Ag2 actively maintained?
Ag2 has 5k GitHub stars. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/ag2ai/ag2 before pinning it in production.
What are alternatives to Ag2?
Notable alternatives to Ag2 include LangChain (Popular framework for chaining LLM operations and building agents), LlamaIndex (Specializes in connecting AI to your data for retrieval-augmented generation), Anthropic Claude SDK (Direct SDK for building with Claude AI (some multi-agent patterns supported)). You can also compare Ag2 side by side with other MCP servers in the Related tools section on this page.
Community questions about Ag2
- AG2 0.5 upgrade breaks `from autogen import ...` — how to fix?
- How to use context variables in AG2 OnCondition handoff strings?
- AG2 + Gemini function calling: 400 "function response turn must come immediately after a function call turn"
- ag2 LLMConfig.where(tags='tool') fails when tags is a list in OAI_CONFIG_LIST
- How to get structured outputs from Bedrock in ag2 when response_format is ignored?
README badge and team notes
Maintain or use Ag2? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/ag2ai-ag2)HTML embed:
<a href="https://agentarmorhq.com/skills/ag2ai-ag2"><img src="https://agentarmorhq.com/api/badge/ag2ai-ag2" alt="AgentArmorHQ Risk Grade for Ag2" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "ag2ai-ag2"Share with your security lead
Need sign-off to use ag2? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: ag2
- **Listing URL:** https://agentarmorhq.com/skills/ag2ai-ag2
- **Type:** App connector
- **Risk Grade:** Grade B (Some risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 5k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** Requires API key or token
- **Package source:** GitHub (ag2ai/ag2)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/ag2ai/ag2
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- ag2ai
- Source code
- github.com/ag2ai/ag2
- Est. context load
- ~850 tokens / turn (~5 tool schemas, 0.43% of 200k context)
- Popularity
- 5k GitHub stars
- Last updated
- 2026-10-29
- Last graded
- 2026-10-21
Community
Discussions for Ag2
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude