docker/cagent v1.140.0 scopes MCP callbacks per request and adds eight lint cops enforcing its own conventions
Released 2026-09-15, the headline correctness change is request-scoped MCP callbacks for elicitation, sampling and OAuth via a new HandlerScope type, which prevents cross-request callback collisions, plus safe MCP routing and multi-subscriber event delivery. It also defers GatewayToolset temp-file creation to Start/Restart so secrets are not written to disk until the subprocess launches. The eight new lint rules encode rules the team was otherwise repeating in review: require tools.UnmarshalToolArguments over raw json.Unmarshal, reject branching on err.Error() string content, ban os.Stdout writes in pkg/ libraries, enforce the DOCKER_AGENT_ env prefix over legacy CAGENT_*, require atomicfile.Write for marshalled state, flag bare &http.Client{} with no explicit Transport, sync the Toolset schema enum with DefaultToolsetCreators, and route state paths through pkg/paths instead of hard-coded .cagent literals.
Source
↳ Follow the thread