AI platforms spent the week tightening access control around agents, MCP and tenants.

The week in ai-ml-platforms

The dominant move this week was access control. RAGFlow added tenant roles and permissions in a dev build, LiteLLM put default-deny agent access into its 1.107 release candidate and switched stdio MCP servers off by default in 1.106.0, and MLflow carried resource-level permissions with explicit DENY through 3.17. Four platforms, four different stacks, one direction: the control plane for agents is being locked down before it is widened.

The second pattern is that observability and evaluation tooling keeps absorbing agent concerns. Arize Phoenix now exports its own server logs over OTLP and documents tracing for Claude Managed Agents, while MLflow records which dataset, scorers and agent produced each evaluation run. Lineage is becoming a default field rather than an add-on.

Leaders

RAGFlow shipped the week's only spark. Its 1.0 RC2 removes the four thinking levels from chat and replaces them with an Agentic chat mode, restores Team/Me sharing, unifies parsers and adds arm64 images. The Go rewrite that began with RC1 at the end of September is now getting permission work on top, with tenant roles and permissions landing in the dev-20261021 build.

LiteLLM runs three release lines at once. 1.106.0 went stable with stdio MCP disabled by default; 1.107.0-rc.1 adds default-deny agent access and stateless MCP. The 1.106.1 patch fixes dropped Anthropic signed thinking blocks and gpt-5.4+ tool calls landing on choices[1], and asks vector-store users to run a cleanup script.

MLflow 3.17.2 records dataset, scorer and agent lineage on every mlflow.genai.evaluate run and fixes Optuna integration bugs. It follows 3.17.1, which brought Decision API support to make_judge().

Wildcards

Arize Phoenix is the quiet one: 20.22 and 20.23 landed a day apart, and the headline item is the server exporting its own logs over OTLP, a self-observability move rather than a user-facing feature. A Bedrock tool-result passthrough in the playground and a tracing guide for Atomic Agents round out the release.

Themes that compounded

• Permission models tightened in RAGFlow, LiteLLM and MLflow, each adding finer-grained or default-deny rules.
• MCP handling was hardened in LiteLLM: stdio off by default, scoped OAuth and stateless operation in the candidate.
• Agent tracing and lineage expanded in Arize Phoenix and MLflow.
• Multiple concurrent release lines at LiteLLM mean fixes are being back-ported rather than waiting for the next minor.

Watch this week

LiteLLM 1.107.0 is in release candidates and RAGFlow is iterating through dev builds toward a 1.0 final after RC2, so a stable cut from either is the most likely next event. Watch whether RAGFlow's tenant roles settle without another schema migration, and whether MLflow follows its mandatory 3.17 schema upgrade with further permission changes. The common thread to track is whether default-deny settings in LiteLLM generate patch releases from users hitting blocked MCP and agent calls.