Getting Started with AgentScope 2.0: Core Capabilities of the Agent Development Framework

What Is AgentScope? The Leap from Chatbot to Agent

Before diving into AgentScope, it's worth clarifying a key concept: what actually separates an Agent from an ordinary chatbot? A chatbot has a simple job — you ask a question, it answers, end of story. An Agent, by contrast, doesn't just converse — it can think autonomously, call tools, and execute tasks.

Consider a typical scenario: you give an Agent a task — analyze today's sales data, generate a report, and email it to the company manager. Once assigned, the Agent reads the sales data on its own, invokes a Python analysis function, generates the report, and then calls an email tool to send it out. The entire process requires chaining together multiple capabilities and autonomously completing a series of actions.

This naturally raises a question: as Agents become increasingly capable, how should developers build, control, and ensure they don't go off the rails — and when something goes wrong, how do you pinpoint which step failed? This is precisely the core problem that agent development frameworks are designed to solve, and AgentScope is one such framework. Put simply, AgentScope is a development framework that helps developers build, deploy, manage, and run Agents — essentially an engineering toolkit for managing agents.

Why Learn 2.0 Instead of 1.0

AgentScope previously released a 1.0 version, but 2.0 involves a massive overhaul — many APIs have been deprecated, and the scale of changes has been described by instructors as "catastrophic." If you learned 1.0, picking up 2.0 will feel like starting over from scratch.

The conclusion is clear: beginners don't need to start with 1.0 — go straight to 2.0, which has already reached production-grade readiness. The official documentation is available in both Python and Java editions; this course focuses on Python, though Java developers can follow the official docs to self-study. Documentation supports both Chinese and English, so developers with strong self-learning ability can extend their knowledge directly from the official site.

Core Capability 1: ReAct Agent

The first core capability of AgentScope is the ReAct Agent. Note that this has nothing to do with the frontend framework React — it's a combination of the first letters of Reasoning and Action.

Using a weather example to illustrate: you ask an Agent to check today's weather in Beijing and remind you to bring an umbrella if it's raining. The underlying model doesn't inherently know whether it's raining in Beijing, so the Agent first "thinks" — to answer the umbrella question, I need to know the weather first; then "acts" — calls a weather lookup tool; receives the result and "thinks" again — it's raining, I should remind you to bring an umbrella; and finally returns the answer to the user.

This cycle of "think → act → observe result → think again" is the ReAct pattern. And it doesn't run just once — for complex tasks, it iterates repeatedly: calling tools, reading web pages, executing Python code to analyze data, until the task is complete and a final result is returned. ReAct is a core Agent construction pattern in AgentScope, and the framework builds around it to provide tool invocation, streaming execution, pause-and-resume, and other capabilities suited for complex task scenarios.

ReAct was first proposed by a Google Research team in the 2022 paper "ReAct: Synergizing Reasoning and Acting in Language Models." Its core insight is that pure reasoning models (like Chain-of-Thought) are prone to hallucination because they only "think" internally within the model; pure action models lack logical chaining and tend to act blindly. ReAct combines both, forming an alternating cycle of "Thought → Action → Observation." Each "Observation" is real external information returned by a tool, which is written back into the context so the model's next reasoning step is grounded in real data — effectively suppressing hallucinations. In engineering terms, the framework needs to parse "action instructions" from the model's output, dispatch the corresponding tool for execution, and inject the result back into the context. This dispatch mechanism is one of the core values of frameworks like AgentScope.

Core Capability 2: Three-Layer Security Defense

Security concerns become more pronounced as Agent capabilities grow. An Agent that only answers weather questions carries almost no security risk — but when an Agent has elevated permissions to delete files, execute code, run shell commands, manipulate databases, send emails, or access internal company systems, would you still trust it to operate fully autonomously?

Imagine this scenario: you ask an Agent to clean up unused files in a project. It judges a file to be unnecessary and runs rm -rf — and deletes the wrong thing. Agents will always have some error rate, and a bad judgment call can have fatal consequences in a production environment. AgentScope addresses this with three layers of defense:

Tool Auditing

Not every tool can be called freely. Ordinary tools like weather lookups can execute directly, but if a tool would delete database contents, it should be inspected before invocation — just in case.

Human-in-the-Loop Collaboration

Agents can work independently, but humans have the final say on critical steps. When an Agent is about to execute a high-risk operation like DELETE FROM, it pauses execution and escalates to an administrator for approval or rejection. Approve and it continues; reject and it stops or adjusts. This approach doesn't eliminate Agent autonomy — it preserves human authority over high-risk actions.

Secure Sandbox Isolation

Even if human review fails in the human-in-the-loop stage, there's still a final line of defense. A sandbox provides the Agent with an isolated execution environment where it can run code and process files without affecting external systems. This mechanism exists in many frameworks — deep agent has a similar design, for example.

Each layer has a distinct role: tool auditing addresses "can it be done," human-in-the-loop addresses "does a human allow it," and the sandbox addresses "where can it be done safely." All three can be used together to handle more complex scenarios.

A sandbox is a technology for isolating execution environments. Its principle is to restrict a process's system call permissions, file access paths, and network access scope so it cannot affect the host system. In Agent scenarios, sandboxes are typically implemented using containerization technology (such as Docker) or OS-level namespace isolation. Code executed by the Agent inside the sandbox can freely read and write the sandbox's virtual file system, but has no direct access to the host machine's real disk, database, or network interfaces. If the Agent's code execution fails or produces destructive operations, the damage is contained within the sandbox boundary — the host environment is unaffected. The trade-off is performance overhead and configuration complexity, so not every task needs a sandbox; it's typically only activated for high-risk tools involving code execution or file operations.

Core Capability 3: Systematic Context Management

Imagine an Agent that has been working for two hours — it has searched 20 web pages, called tools 30 times, and read dozens of files. Each tool response might be five thousand to ten thousand characters, and the context keeps accumulating and growing.

But a large model's context window is not unlimited. When the context bloats beyond a certain point, critical information gets buried. AgentScope therefore provides systematic context management — an essential capability for long-running task scenarios.

A large model's context window refers to the maximum text length the model can process in a single pass, measured in tokens. Mainstream models range from tens of thousands to hundreds of thousands of tokens — which seems large, but long tasks still face two core problems: first, when the window limit is exceeded, early information gets truncated and lost; second, even within the limit, excessively long contexts cause the model's attention to scatter, significantly reducing its utilization of early key information — a phenomenon known as the "Lost in the Middle" effect. Common strategies for systematic context management include: sliding windows (retaining only the most recent N turns of conversation), summary compression (periodically summarizing historical conversation into a brief summary to replace the original), memory retrieval (storing historical information in a vector database and retrieving relevant fragments on demand), and tool result trimming (keeping only key fields from excessively long tool responses). The core goal of all these strategies is the same: within a limited window, keep the most relevant information consistently in the model's "attention focus."

Summary: An Engineering Framework for Production-Ready Agents

AgentScope's overall approach is clear: as Agents grow more capable and can autonomously complete complex tasks, that autonomy also introduces security risks, long-context challenges, and a host of other engineering concerns. AgentScope is built specifically around these problems, offering a complete set of Agent engineering capabilities — from the ReAct construction pattern, to the three-layer security defense, to systematic context management — collectively forming a development framework for production-grade intelligent applications. For developers looking to systematically learn Agent development, jumping straight into version 2.0 is the more efficient path.