Known limitations

These are not defects: they are how 1.2.0 works. The defects that are still open are in Known issues. Each limitation links to the page that explains it.

• .NET 10 only. MentorAgent does not run on .NET 8 or .NET 9: see Prerequisites.
• Prerelease dependencies and pinned versions. Some packages that MentorAgent uses have no stable release yet, and with the Azure OpenAI Responses API one package version must be pinned: see Prerelease dependencies and Package versions to pin.
• Roles come from claims; finer rules are your code. The role check reads the user's role claims. A permission per company or per record, or a rule on the arguments, is an action policy that you write (IMentorActionPolicy), and MentorAgent applies it on every surface. See What stays in your code.
• Hosted tools skip MentorAgent's checks. A hosted tool is a tool that the model provider runs for you, such as web search or the code interpreter (HostedTools). It never passes through MentorAgent, so roles, policies, confirmation, OnToolResult and the per-tool metrics do not apply to it. You control what the provider may do: which tools you declare, which vector stores file search reads, and which tools of a hosted MCP server are allowed or need approval.
• Methods with only [Description] run without confirmation. A [MentorAction] that is not read-only asks for confirmation by default. A method with only [Description] runs without asking. MentorAgent publishes it on /mcp, and with tool filtering on, it can reach the model on any message. Use [MentorAction] for every method that changes data.
• Endpoints open by default. The SignalR hub, Server-Sent Events, /mcp and /a2a answer everyone until you protect them. See Secure the endpoints.
• Session snapshots without sign-in. On a host without authentication, every visitor is the same anonymous user. A snapshot from /mentor/session is protected, so nobody can read or edit it. But any connection of the application can restore it.
• Safety checks and limits are off by default. The safety check on messages is off by default. When it is on and gives no verdict, for example after a timeout, it lets the message through (SafetyCheckFailure = Allow). The per-user message limit, RateLimitPerUser, is 0 by default, which means no limit. See Limits and safety checks.
• A2A chains and remote agents. A chain of MentorAgent hosts, such as A → B → C, is not supported. When a task arrives over A2A, the host that receives it answers the task. The host never passes the task on to its own remote agents. A remote agent has no role check of its own: any user of the host can reach it. See A2A server and MentorRemoteAgent.