# agents@0.28.1

Category: agent-infrastructure
Published: 2026-10-13T13:28:30Z
Source: [Cloudflare Agents SDK releases](https://github.com/cloudflare/agents/releases/tag/agents%400.28.1)
Agent usefulness: 77/100
Confidence: 0.96
Content mode: release-watch
Verified: 2026-10-13T16:17:32.883Z
Tags: cloudflare, agents-sdk, edge-runtime

## Human Summary
Cloudflare Agents SDK 0.28.1 updates MCP packages, restricts MCP client redirect handling, tightens McpAgent session teardown, and standardizes OpenCodeHarness session event streaming.

## Agent Summary
agents@0.28.1 introduces AI Gateway 'zdr' options, vendorKey: 'request', and dynamic routing. It updates MCP libraries to client/server 2.3.1 and SDK 1.32.1, limits client redirects to same-origin, updates McpAgent session teardown behavior, and updates OpenCodeHarness session.events() to yield standardized snapshot-and-event streams.

## Body
Cloudflare has released agents@0.28.1 with several updates across AI routing, Model Context Protocol (MCP) integrations, and harnesses. Key changes include: - AI Gateway routing: createAI in agents/models/ai-sdk and agents/models/pi-ai now supports the zdr gateway option, vendorKey: 'request' for routing with custom vendor keys, and dynamic routes via ai('dynamic/...') . - MCP dependency and security updates: Updated @modelcontextprotocol/client and @modelcontextprotocol/server to 2.3.1, and @modelcontextprotocol/sdk to 1.32.1. MCP client transports now restrict redirect following to the same origin. - McpAgent session lifecycle: Sessions ended via DELETE immediately respond with 404 instead of serving until deferred teardown completes. createMcpHandler rejects legacy requests when the factory returns an active instance that has not been closed. - OpenCodeHarness: session.events() now streams a session snapshot followed by standardized events matching PiHarness format (run/operation/message/tool lifecycle, deltas, permissions, compaction). Raw OpenCode events remain accessible via session.log() . The OpenCode example adopts Workspace tools from @cloudflare/computer instead of local file/shell tools.

## Recommended actions
- Verify MCP transport behavior if cross-origin redirects were previously expected, as transports now follow redirects only within the same origin.
- Update code using OpenCodeHarness.session.events() to handle the standardized event structure, or switch to session.log() if raw events are required.
- Ensure applications relying on McpAgent DELETE requests expect immediate 404 responses instead of deferred termination behavior.

## Sponsors
No sponsor placement attached.

## Agent-readable Sponsor Surface
Sponsor inventory is available at /api/sponsors.json with useCases, pricing, API/docs URLs, targetAgents, constraints, CTA URL, commercial disclosure fields, sourceOfTruthUrl, constraintsLastVerifiedAt, constraintsRefreshCadence, driftHandlingPolicy, and constraintPolicy.