LoginSign Up
← Back to all sparks
N

Nacos

DEVOPS
Velocity6.3

Dynamic service discovery and configuration management platform

nacos.io ↗

Nacos is hardening the AI registry it just built, and closing the door behind its deprecated APIs.

service-discoveryai-registryagent-infrastructuremcpsecurity-hardeningbreaking-changes
◆Current state
Nacos has finished turning a microservice registry into a registry for AI agents — MCP, Skill, Prompt and Agent resources all live under one AI Registry — and the 3.2 line is now spending its releases making that surface safe to operate. The newest patch adds server-identity authentication to internal JRaft traffic, puts MCP tool imports from private addresses behind an administrator allowlist, and returns HTTP 410 on deprecated AI APIs by default. The 2.x line runs in parallel as a JDK 8 maintenance branch that receives only backported fixes.
◆Where it's heading
Two threads are running at once: 3.3.0-BETA is extending the registry to protocol-neutral agent registration and vector-based resource discovery, while 3.2.x closes off the compatibility and security debt that the fast AI-registry build-out accumulated. The breaking notice in 3.2.4 — an irreversible JRaft authentication transition and 410s on legacy endpoints — reads as the project deciding the AI surface is stable enough to stop carrying old shapes. Operator-facing work, not new capability, is where the 3.2 series is heading.
◆Prediction
Expect 3.3.0 to go final on the agent-registration and vector-discovery work while 3.2.x keeps shipping security hardening; the temporary nacos.core.api.compatibility.enabled switch is the obvious next thing to be removed.

◆Recent moves

  1. 20d ago

    Deprecated AI APIs return 410; JRaft gains server-identity auth

    A security and hardening patch for the 3.2 line that carries a real breaking notice: deprecated Pipeline and legacy MCP import APIs now return 410 Gone, MCP tool imports from private or local targets require an administrator allowlist, and JRaft gRPC traffic gains server-identity authentication in a transition that cannot be rolled back once every member enforces it. This is the cleanup bill for the fast AI Registry build-out rather than new surface.

    View source ↗
  2. 20d ago

    Two 3.2.4 fixes backported to the JDK 8 maintenance line

    Two fixes from the same day's 3.2.4 release backported to the JDK 8 maintenance branch — hardened database result resolution and health-check address validation. It confirms the 2.x line is receiving only what the 3.x line already shipped, with none of the AI Registry work.

    View source ↗
  3. 1mo ago

    Protocol-neutral agent registration and agentic resource discovery

    ⚡ SPARK

    The beta that extends the AI Registry past MCP and Skill into agents themselves, with protocol-neutral registration, endpoint discovery and legacy A2A routing. It is the origin of the arc the 3.2.x patches are now hardening around.

    View source ↗
  4. 2mo ago

    Nested Skill packages supported; Raft leader metrics added

    Nested Skill package uploads that preserve SKILL.md files as resources, plus per-Raft-group leader and term metrics and a run of Config namespace isolation fixes. The Skill work extends the AI Registry's packaging model; the rest is the operability groundwork the later hardening releases build on.

    View source ↗
  5. 2mo ago

    2.x line gets JDK 8-compatible security and client stability fixes

    Security and client stability fixes for the JDK 8 branch, shipped the same day as the 3.2.3 release it draws from. The 2.x line continues to receive protection but none of the AI Registry direction.

    View source ↗
  6. 3mo ago

    AI resources importable from external registries; Skill discovery added

    AI Registry gains imports from operator-configured external registries, Skill well-known discovery and Skill subscription, alongside broad console work across Config, Naming and MCP. This is the release where the registry started treating AI resources as something to federate rather than only to host.

    View source ↗