The Register / Multi-agent frameworks / Agno

Agno

Name: Agno
Author: Agno Inc. (agno-agi)

Agno Inc. (agno-agi) · Multi-agent frameworks

Agno (formerly Phidata) is an Apache-2.0 Python SDK with three primitives: agents, teams and workflows, plus 100+ toolkits. AgentOS serves agents as a REST API and MCP server backed by the user's own database, and a hosted control plane (free locally, paid for live deployments) provides chat, traces, approvals and scheduling. Version 3.0 shipped on 24 August 2026.

agno.com Source repository Docs Pricing Add to compare

What reviewers and users praise

Frequently described by users as simpler and easier to learn than LangGraph (r/LangChain comments, BenchClaw review)
Users praise its documentation and customisability (r/LangChain comments)
Very active release cadence: 44 GitHub releases in the 90 days to 2026-09-26

What they criticise

Independent benchmark measured 59% higher median wall time than LangGraph on the same tool-calling task (BenchClaw, Aug 2026)
Some developers find it heavy or immature for complex cases (r/LangChain comments)
Three high/critical CVEs in 24 months (session-state leak, eval injection, SQL injection)
An HN user reported inconsistent APIs and outdated function signatures from the docs chatbot

Rating · evidence to 26 Sept 2026

Provisional
Trust B
Open source

Adoption83

Experts—

Crowd58

Experts vs the crowdneeds both scores

Experts—

Crowd58

Price	Free, paid from $150
Use it via	API, MCP server, Web app, Chat apps
Runs on	macos, linux, windows
Licence	Apache-2.0
Updated	Evidence collected 26 Sept 2026

How the rating was worked out

Weights for Multi-agent frameworks: adoption 45%, experts 30%, crowd 25%. Pillars without enough evidence are left out and the others re-weighted. The method.

Adoption & momentumweight 45%	83	GitHub stars `42k` → 80 · PyPI monthly downloads `1.7M` → 70 · `44` releases in 90 days → 100 reach × 0.7 + momentum × 0.3
Expertsindependent reviews · weight 30%	—	Only 1 independent review (3 needed)
Crowdcommunity sample · weight 25%	58	12 dated posts from reddit, hackernews: 7 positive · 1 mixed · 4 negative (positive + ½ mixed) ÷ n, averaged toward 50 for small samples
Rating	74	Provisional: low confidence (2 of 3 pillars, 12 community posts).

Editorial adjustment. Incident-history grade reviewed under methodology revision 2 (see the trust section).

Trust & safety

Seven dimensions graded A–D from documented facts. Overall: B.

Permission model

Tools run automatically by default; human approval (pause runs for user confirmation, block tools needing admin approval) is available but configured per tool. No default sandbox for tool execution. source

n/e

Data access scope

Access depends on the toolkits the developer attaches; AgentOS documents JWT-based RBAC and multi-tenant isolation. Not enough documented detail on tool-level scoping to grade. source

Data storage

Self-hosted: README says sessions, memory, knowledge and traces are stored in your own database (Postgres via AgentOS). A per-run telemetry event is sent to Agno by default; README says prompts, messages and outputs are never sent; disable with AGNO_TELEMETRY=false. source

n/e

Data retention & training

Model-agnostic; retention and training policies follow whichever model provider the developer uses. Agno telemetry excludes prompts and outputs per README. source

Incident history (24 months)

Three high/critical advisories in 24 months (repeated). Two list patched versions; the SQL injection advisory lists no patched version in the GitHub Advisory Database as of 2026-09-26. Kept at D under revision 2: the SQL-injection advisory lists no patched version in the GitHub Advisory Database as of 26 Sep 2026 (unresolved). source

n/e

Compliance

No SOC 2 / ISO 27001 attestation found in this pass; Enterprise plan lists security reviews. Not established. source

Transparency

Apache-2.0 open source with public GitHub releases (44 in the last 90 days). source

The experts

1 named independent reviews found; dated reviews from the last 12 months are scored.

mixed
Agno’s median wall time (4.27 s) is 59% slower than LangGraph (2.68 s) and 18% slower than Pydantic AI (3.62 s).Jordan Reeves (BenchClaw) · 31 Aug 2026 · benchclaw.io

The crowd

12 coded posts from reddit, hackernews.

7 positive1 mixed4 negative

positive
Agno runtime is faster in prod, comparison to LangGraph, also agno is quite easy to learn. LangGraph has a steep learning curve.r/LangChain · 9 Sept 2026 · reddit.com
positive
I use Agno, allows me much more customization tbh. And it’s docs were way better at timer/LangChain · 24 Jul 2026 · reddit.com
positive
You can try agno. The documentation is pretty good and it's easier to integrate compare to LangChain/Langgraph.r/LangChain · 11 Jun 2026 · reddit.com
negative
Also tried Agno but found it a little heavy. Die a quick test with pydantic ai and it was very solid.r/LangChain · 10 Jun 2026 · reddit.com
positive
Agno is the most underrated framework everr/LangChain · 10 Jun 2026 · reddit.com
negative
Agno, Smolagents, etc. : niche, fine for narrow cases, not enough maturity to bet a Friday recommendation.r/LangChain · 28 Apr 2026 · reddit.com
positive
If you build simple agent, check Agno or Pydantic-AIr/LangChain · 21 Mar 2026 · reddit.com
mixed
Yeah they are awesome very active. Give it a run. The only downside is now dynamic configuration, though that is in the roadmap.r/LangChain · 4 Jan 2026 · reddit.com

Pricing

As published, checked 26 Sept 2026.

Plan	Price	Notes
Free	Free	Open-source SDK and AgentOS, local deployment, full control plane against a local AgentOS.
Pro	$150 / monthly	One live AgentOS connection, three seats; extra seats $30, connections $95, SAML SSO $300.
Enterprise	Custom	Audit logs, custom RBAC, security reviews, dedicated support.

Recent changes

24 Aug 2026
Agno 3.0.0 released (major version; migration guide published). source
20 Jul 2026
v2.8.0 released; July work included agnoctl CLI for AgentOS and a FileSystem store (per team's July roundup). source
29 May 2026
SQL injection advisory CVE-2026-10105 published. source
2 Apr 2026
Critical eval-injection advisory CVE-2026-35002 published (fixed in 2.3.24). source

Sources

Every figure above traces to one of these, observed up to 26 Sept 2026.