# Known limitations

> What MentorAgent does not do by design, as opposed to a defect: platforms, hosted tools, open endpoints, default checks and A2A chains.

- URL: https://docs.mentoragent.net/reference/known-limitations
- Verified with: MentorAgent 1.2.0
- Last updated: 2026-11-07
- Packages: Novior.MentorAgent, Novior.MentorAgent.Server

These are not defects: they are how 1.2.0 works. The defects that are still open are in [Known issues](https://docs.mentoragent.net/reference/known-issues). Each limitation links to the page that explains it.

- **.NET 10 only.** MentorAgent does not run on .NET 8 or .NET 9: see [Prerequisites](https://docs.mentoragent.net/get-started/prerequisites#requirements).
- **Prerelease dependencies and pinned versions.** Some packages that MentorAgent uses have no stable release yet, and with the Azure OpenAI Responses API one package version must be pinned: see [Prerelease dependencies](https://docs.mentoragent.net/reference/known-issues#prerelease-dependencies) and [Package versions to pin](https://docs.mentoragent.net/reference/known-issues#package-versions-to-pin).
- **Roles come from claims; finer rules are your code.** The role check reads the user's role claims. A permission per company or per record, or a rule on the arguments, is an action policy that you write (`IMentorActionPolicy`), and MentorAgent applies it on every surface. See [What stays in your code](https://docs.mentoragent.net/concepts/governance#what-stays-in-your-code).
- **Hosted tools skip MentorAgent's checks.** A hosted tool is a tool that the model provider runs for you, such as web search or the code interpreter ([`HostedTools`](https://docs.mentoragent.net/reference/options#hostedtools)). It never passes through MentorAgent, so roles, policies, confirmation, `OnToolResult` and the per-tool metrics do not apply to it. You control what the provider may do: which tools you declare, which vector stores file search reads, and which tools of a hosted MCP server are allowed or need approval.
- **Methods with only `[Description]` run without confirmation.** A `[MentorAction]` that is not read-only asks for confirmation by default. A method with only `[Description]` runs without asking. MentorAgent publishes it on `/mcp`, and with [tool filtering](https://docs.mentoragent.net/reference/options#enabletoolfiltering) on, it can reach the model on any message. Use `[MentorAction]` for every method that changes data.
- **Endpoints open by default.** The SignalR hub, Server-Sent Events, `/mcp` and `/a2a` answer everyone until you protect them. See [Secure the endpoints](https://docs.mentoragent.net/configure/secure-endpoints).
- **Session snapshots without sign-in.** On a host without authentication, every visitor is the same anonymous user. A snapshot from `/mentor/session` is protected, so nobody can read or edit it. But any connection of the application can restore it.
- **Safety checks and limits are off by default.** The safety check on messages is off by default. When it is on and gives no verdict, for example after a timeout, it lets the message through (`SafetyCheckFailure = Allow`). The per-user message limit, `RateLimitPerUser`, is `0` by default, which means no limit. See [Limits and safety checks](https://docs.mentoragent.net/configure/production#limits-and-safety-checks).
- **A2A chains and remote agents.** A chain of MentorAgent hosts, such as A → B → C, is not supported. When a task arrives over A2A, the host that receives it answers the task. The host never passes the task on to its own remote agents. A remote agent has no role check of its own: any user of the host can reach it. See [A2A server](https://docs.mentoragent.net/configure/a2a-server#when-to-choose-it) and [`MentorRemoteAgent`](https://docs.mentoragent.net/reference/options#mentorremoteagent).

---

- Previous: [Glossary](https://docs.mentoragent.net/reference/glossary.md)
- Next: [Known issues](https://docs.mentoragent.net/reference/known-issues.md)