Release 9.0.0

AxonFlow Java SDK v9.0.0

Installation

Maven:

<dependency>
    <groupId>com.getaxonflow</groupId>
    <artifactId>axonflow-sdk</artifactId>
    <version>9.0.0</version>
</dependency>

Gradle:

implementation 'com.getaxonflow:axonflow-sdk:9.0.0'

Changed (BREAKING)

• The LangGraph adapter now reports the (server, tool) identity as two
  separate wire fields instead of concatenating them into connectorType.
  MCPToolRequest#getServerName() and MCPToolRequest#getName() are threaded
  through as connector_type and the new tool field on
  mcpCheckInput/mcpCheckOutput, matching the platform's two-field
  (server, tool) MCP identity contract. mcpToolInterceptor() sends
  connectorType = serverName and tool = getName(); the default
  connectorTypeFn returns the bare serverName. MCPInterceptorOptions
  has no toolFn: the tool identity is always MCPToolRequest#getName(), so
  a caller cannot write an arbitrary tool identity into the audit trail.
  connectorTypeFn remains the escape hatch for the server/connector
  dimension only.

  Migration. Policies or per-connector settings matching the old
  concatenated value — e.g. connector_type == "filesystem.read_file" — stop
  matching after upgrade. Re-scope them to match connector_type == "filesystem" together with the tool field (e.g. tool == "read_file").
  The connectorTypeFn option is the compatibility lever: a caller can restore
  any prior connector_type value (including the old concatenated form,
  req -> req.getServerName() + "." + req.getName()) without losing the
  separate tool field.

  Missing-server edge. With the default resolver, a tool whose
  getServerName() is empty now sends connector_type="", which the platform
  rejects with HTTP 400 → the call throws and the tool is blocked (fail-closed),
  never run ungoverned. Previously the concatenated value was ".tool" (a
  non-empty string the platform accepted). Supply a connectorTypeFn for
  server-less MCP tools.

  Minimum platform. The tool field is consumed on POST /api/v1/mcp/check-input by AxonFlow platform v9.10.0+. On platforms
  below v9.10.0 the tool field is silently dropped and identity degrades to
  the bare server name — coarser than the old concatenated value — so
  upgrade the platform to v9.10.0+ before adopting this SDK major.
  Response-plane (check-output) tool scoping requires AxonFlow platform
  v9.11.0+; until then the SDK sends it forward-compatibly and older
  platforms ignore it.

Fixed

• examples/basic passes on enterprise (JWT-validating) stacks. It
  omitted the user token entirely (SDK falls back to anonymous), which
  DEPLOYMENT_MODE=enterprise rejects — and the rejection was swallowed by
  the generic AxonFlowException catch with exit 0. The example now reads
  AXONFLOW_USER_TOKEN and exits non-zero on invalid-user-token rejections.

Added

• runtime-e2e/async_verdict_parity/ — live-agent assertion that
  decideAsync/mcpCheckInputAsync (joined) deliver the same enforcement
  verdict as their sync counterparts (async-adapter-bypass class): stacked
  SQLi → deny on /api/v1/decide, allowed=false on check-input, sync ==
  async on both planes.

• runtime-e2e/mcp_server_tool_split/ — live-agent assertion for the
  connector_type/tool split: LangGraphAdapter.mcpToolInterceptor()
  round-trips a clean tool call through check-input/check-output with the
  server and tool names as two distinct wire fields, a direct
  mcpCheckInput(..., options) call with an explicit tool option is
  accepted, and the two-argument mcpCheckInput(connectorType, statement)
  overload (no tool field) still works unchanged.

• AuditToolCallRequest.callerName (wire: caller_name) — identifies
  WHICH CLIENT made a tool call (e.g. claude_code, codex, cursor,
  openclaw), replacing the misleadingly-named toolType field for that
  purpose. toolType is kept as a deprecated input fallback — not
  removed, not renamed; the server resolves caller_name if supplied, else
  the legacy tool_type, else a default.