Make tools release compatible with Kagent 1.0 GA MCP versions #111

Problem

kagent v1.0.0 / v1.0.1 (GA) pins the kagent-tools chart at 0.3.0. That release ships the non-object outputSchema for kubescape_get_vulnerability_details (#87). Strict MCP clients reject the whole tools/list response, so they get no tools at all. The fix (#101) is on main, and its follow-up (#108) is still open, but neither has been released yet. kagent 0.10.x users on tools 0.3.x hit the same bug.

The tools line is also shared by two kagent lines that have diverged. This is the kagent-tools chart version each kagent release pins, taken from helm/kagent/Chart-template.yaml and go/go.mod at each tag:

The MCP library used by each tools release:

The MCP spec versions come from latestProtocolVersion / supportedProtocolVersions in go-sdk mcp/shared.go, and from LATEST_PROTOCOL_VERSION / ValidProtocolVersions in mcp-go mcp/types.go. The client and server negotiate a spec version during initialize. tools v0.3.x supports every spec version kagent 0.10.x and 1.x use, so protocol negotiation is not the compatibility problem. The bug in #87 is an output-schema problem.

Proposal

kagent 0.10.5 – 0.10.6 and kagent 1.0 GA both run tools 0.3.x on go-sdk, and tools v0.3.x supports every MCP spec version either of them negotiates. A separate support branch is not needed right now.

1. Release v0.3.2 from main with fix: use object output schema for Kubescape vulnerability details #101, fix(security): pass the passthrough token via a per-call kubeconfig, never argv #107 and fix: address object output schema review feedback #108.
   • Open PRs in kagent-dev/kagent to bump the kagent-tools chart dependency to 0.3.2 on both main (1.x) and the 0.10.x line.
   • The release notes must call out the structuredContent change for kubescape_get_vulnerability_details, from an array to {"matches": [...]}.
2. Keep main aligned with ADK 2.x Go and kagent 1.x GA. Track modelcontextprotocol/go-sdk at the same version kagent and adk/v2 pin (currently v1.8.0 in both).
3. Cut a release/v0.3 branch only when it's actually needed, from the latest v0.3.x tag. That happens the first time main takes a change kagent 0.10.x can't consume, such as a go-sdk bump past what 0.10.x negotiates, removed or renamed tools, or a v1.0.0 tag.
4. kagent 0.10.0 – 0.10.2 (tools 0.2.1, mcp-go) get no backports. Users should upgrade to kagent 0.10.5+.
5. Document the compatibility matrix (tools ↔ kagent ↔ MCP SDK/spec) in README.md / docs/release-notes.md.

Open questions

• Is the structuredContent shape change in fix: use object output schema for Kubescape vulnerability details #101 acceptable in a patch release for kagent 0.10.x users? It fixes tools/list for strict clients, but consumers that read the old array shape will need to change.
• Is there a known upcoming main change that would force the release branch soon?

Related: #87, #91, #101, #107, #108