AgentScope 2.0 Framework Deep Dive: Core Capabilities for Multi-Agent Development

What Is AgentScope

As AI application development grows increasingly complex, agents are no longer just simple chatbots. A regular chatbot's job is to answer questions — you ask, it answers, nothing more. But an agent's capability boundary is far broader: it can reason autonomously, invoke tools, and execute tasks.

Consider a typical scenario: you give an agent the instruction — "Analyze today's sales data, generate a report, and email it to the company manager." The agent will independently read the sales data, call a Python analysis function, generate the report, and finally invoke an email tool to deliver the results. The entire chain involves multiple tool calls and task orchestration.

Problems naturally follow: as agents become capable of doing more and more, how do we develop them, control them, ensure they don't "go rogue," and trace which step went wrong when something breaks? These engineering demands gave rise to a class of agent development frameworks — and AgentScope is one of them.

In short, AgentScope is a development framework that helps developers build, deploy, manage, and run agents, with "managing agents" as its core value proposition.

Why Start Directly with Version 2.0

AgentScope 1.0 was released earlier, but version 2.0 represents a massive departure — a large number of APIs have been deprecated, and the architecture has been almost entirely rebuilt from the ground up. For anyone who learned 1.0, much of that knowledge feels wasted. There's no reason to start with 1.0 today; 2.0 is already production-ready, so jumping straight to 2.0 is the right move.

Core Capability #1: The ReAct Agent

ReAct here has nothing to do with the frontend React framework. It's a combination of Reasoning + Acting, representing a loop pattern of "think while doing."

Imagine this scenario: you tell an agent, "Check today's weather in Beijing — if it's raining, remind me to bring an umbrella." The LLM itself has no idea whether it's raining in Beijing, so the agent first reasons — to complete this task, it needs to check the weather. It then acts, invoking a weather tool. The tool returns "rain in Beijing," and the agent reasons again — rain means it should remind about an umbrella. Finally, it returns the conclusion to the user.

This "think → act → observe → re-think" loop doesn't run just once. For complex tasks, the agent may cycle repeatedly: think, call a tool, observe the result, realize it needs to read a web page, finish reading, then run some Python to analyze data — advancing layer by layer until the task is complete, at which point it returns the final result.

AgentScope adopts ReAct as its core agent-building approach, providing tool invocation, streaming execution, pause-and-resume, and other capabilities around it — making it well-suited for complex task scenarios.

The ReAct pattern was first introduced in the 2022 paper "ReAct: Synergizing Reasoning and Acting in Language Models" by researchers from Google and Princeton University. The researchers found that purely "thinking" (e.g., Chain-of-Thought reasoning) was prone to hallucinations, while purely "acting" (directly calling tools) lacked flexible reasoning. ReAct combines both: at each step, the model outputs a reasoning trace (Thought), decides on a next action (Action), and then observes the tool's return value (Observation) — cycling until the task is complete. This design makes the model's reasoning chain traceable and debuggable, allowing developers to clearly understand why an agent made a particular decision rather than facing an opaque black box. In practice, ReAct has become the de facto standard paradigm in mainstream agent frameworks, with corresponding implementations in LangChain, AutoGen, and others.

Core Capability #2: The Three-Layer Security Defense

When an agent is just answering weather questions, security is not a serious concern. But once an agent gains high-privilege capabilities — deleting files, executing code, running shell commands, manipulating databases, sending emails, calling internal company systems — would you still feel comfortable letting it run completely autonomously?

An agent's judgment will always have some probability of error. Imagine you ask it to "clean up unused files in the project" and it mistakenly flags a critical file, then executes rm -rf on it. A single mistake could have fatal consequences for a production environment. AgentScope's security design is built precisely for this risk, and consists of three layers:

Tool Review

Not all tools should be freely callable by an agent. When an agent is about to invoke a sensitive tool, the framework performs a check. A simple weather-query tool can be passed through immediately; but operations involving things like deleting database records require an additional review before they can proceed.

Human-in-the-Loop

The agent can work autonomously, but humans have the final say on critical steps. For example, if the agent decides to execute a DELETE FROM operation, the framework pauses execution and hands it off to an administrator for approval or rejection. Approved — it continues. Rejected — it stops or adjusts. This mechanism doesn't prevent the agent from making decisions autonomously; it simply reserves final authority over high-risk actions for humans.

Secure Sandbox Isolation

Even if the human-in-the-loop approval step fails, or the agent's own decision is flawed, we can't allow it to run arbitrary code on the host machine. A sandbox provides the agent with an isolated environment to execute code and handle files, minimizing impact on external systems. This mechanism has similar implementations across many mainstream frameworks.

All three layers can work together to handle complex scenarios: tool review addresses whether something can be done; human-in-the-loop addresses whether it should be allowed; sandbox isolation addresses where it can be safely done. Together, they form a complete three-dimensional security defense.

Sandbox isolation is a technique that physically or logically separates a program's runtime environment from the host system. Common implementations include Docker containers, virtual machines, and process-level isolation mechanisms such as seccomp and namespaces. In agent scenarios, the core value of a sandbox is blast radius containment — even if the agent executes dangerous code, the damage is confined within the sandbox and cannot spread to production databases or the host filesystem. With Docker, for instance, an agent executing rm -rf / inside a container only wipes the container itself; the host machine is completely unaffected. Sandboxes also restrict network access and system call permissions, preventing an agent that has been compromised via prompt injection from launching attacks externally. The trade-off is some performance overhead and increased environment configuration complexity, which is why sandboxes are typically not enabled for low-risk tools — tiered, on-demand application is the more common engineering practice.

Core Capability #3: Systematic Context Management

Consider another real-world problem: an agent has been running continuously for two hours, having searched 20 web pages, made 30 tool calls, and read dozens of files. Each tool invocation can return thousands or even tens of thousands of words, and as this information accumulates, the context grows enormously.

An LLM's context window is not unlimited. When the context becomes excessively bloated, important information gets "drowned out," directly degrading the quality of the agent's judgments. This is why AgentScope needs systematic context management — controlling and optimizing context through multiple strategies, a topic that will be covered in depth in subsequent lessons.

A large model's context window refers to the maximum number of tokens the model can process in a single pass. GPT-4, for example, started with a context window of around 8K tokens, later expanded to 128K or beyond — but a larger window doesn't mean the model pays equal attention to everything. Research shows that models are more sensitive to information at the beginning and end of the context, and tend to "forget" content in the middle, a phenomenon known as the "Lost in the Middle" problem. For long-running agent scenarios, common context management strategies include: sliding windows (discarding the earliest history), summarization compression (condensing conversation history into a summary), and vector retrieval (storing historical information in a vector database and retrieving relevant segments on demand). Each strategy involves trade-offs between information retention completeness and token efficiency. AgentScope's systematic management provides a structured solution to navigate this complex balancing act.

Production-Grade Engineering Capabilities

Putting it all together, the logic becomes clear: as agents grow more capable and can autonomously complete complex tasks, they also introduce security risks from that autonomy, along with a host of problems stemming from long context windows. AgentScope is designed around exactly these pain points, providing a complete set of agent engineering capabilities and laying the groundwork for building production-grade intelligent applications.

Worth noting: AgentScope provides both a Python version and a Java version of the framework, with official documentation available in both Chinese and English. The mainstream learning path currently focuses on the Python version; Java developers can follow the corresponding official documentation for self-study. For developers with strong self-learning ability, the official docs are an excellent resource for deeper exploration.

Overall, AgentScope 2.0 uses the ReAct agent as its core building paradigm, paired with a three-layer security defense and systematic context management, forming a production-ready engineering solution for multi-agent development.