Google ADK Python 2.9.0 adds model failover, LiveKit voice support and YAML workflows

Failover, voice and declarative workflows

The central resilience addition is FallbackModel, which can automatically move agent requests to backup models when the primary model encounters errors. The release notes describe this as a way to protect agent uptime; they do not report availability measurements or comparative performance results.

A new LiveKit runner extends ADK into voice and telephony applications. Related fixes cover the live-agent path as well: ADK now ends a live session when the client closes its request queue, honors the save_live_blob setting when caching user audio and forwards the agent’s generation configuration—including temperature, sampling parameters, output-token limits, seed and media resolution—to the Live API.

Workflow authors can now define and load ADK 2.0 graph workflows from declarative YAML configurations. Tool integration also expands through NodeTool: the release adds automatic inference for FunctionNode and support for nodes that take no arguments. Other workflow work includes multi-turn human-in-the-loop pause and resumption across workflows and agent tools, retrying subclasses of configured retry exceptions, and correctly failing a workflow when a detached dynamic node errors or is interrupted.

MCP 2.x is supported, but remains opt-in

ADK 2.9.0 can work with MCP SDK 2.x servers alongside 1.x, although installations continue to resolve MCP 1.x by default. Developers must deliberately install 2.x to opt in.

That qualification matters for extension fields. Under MCP SDK 2.x, validation discards fields on CallToolResult or tool declarations that the SDK does not define before ADK receives them. The declared _meta field is unaffected, so MCP servers that depend on vendor-specific data should place it there. MCP 1.x continues to pass those unknown fields as before, and ADK cannot restore fields already removed by 2.x validation.

The MCP fixes also limit application-default credentials to Google API hosts, avoid summarizing a tool call while it is paused for confirmation and accept either supported spelling of an MCP tool schema in telemetry.

Upgrade risks center on replay and local access

The most consequential breaking change affects workflow resumption. A failed node now runs again when a workflow resumes; previously, it was replayed as though it had completed. Node bodies therefore need to be idempotent. If a node performs an external side effect and then fails, resuming can repeat that side effect each time.

Nested workflow retry behavior also changes, but only for nodes already using retry_config. The release additionally reruns a paused workflow node after the user responds and removes resume inputs from the resumable-node checkpoint.

GCS tools now permit local reads and writes only for paths that resolve inside the directory configured by local_file_root. Without that setting, local file access is refused entirely. The check applies to the resolved destination rather than simply distinguishing absolute from relative path syntax.

For sessions, InMemorySessionService now raises SessionNotFoundError when code appends an event to a session the service does not hold. It previously accepted and discarded such events. Database-backed session services already used the stricter behavior, so this compatibility change is limited to in-memory sessions.

Agent execution, security and observability fixes

The broader bug-fix list addresses delegation, tool execution and state continuity. A2A changes require HTTPS for non-loopback agent-card URLs, prevent a completed task delegation from breaking later peer delegations and stop caching remote cards that fail validation. Transfers are now restricted to declared targets, forbidden parent or peer transfers are rejected, and a new transfer_reason value is intended to help prevent transfer loops.

Tool-call handling now rejects incomplete arguments from a broken stream, guards malformed JSON in LiteLLM responses and reports unknown tool names to the model instead of raising immediately. Callback chains stop at the first non-None result, while context variables set in before_tool_callback propagate into the tool. OpenAPI tooling now bounds default HTTP waits and treats an empty security requirement as optional authentication.

Several changes reduce credential exposure or tighten validation. ADK no longer sends an OAuth client secret to the client, omits that secret from workflow credential-request events, validates the author before resuming authentication-gated tool calls and offers optional OIDC verification for Pub/Sub and Eventarc triggers. Deployment code also validates app_name before placing it into a Dockerfile.

New telemetry can track skill loads and script execution, while logs can be exported over OTLP to telemetry.googleapis.com. Fixes end inference spans at the actual finish reason and keep thought signatures out of span attributes. Evaluation output now provides detailed results even when every test passes, offers an ignore_args option for tool-trajectory evaluation and labels metrics that never ran as not evaluated rather than failed.

Performance and documentation

Three performance changes defer imports in code executors, extend the workflow replay index instead of rebuilding it for every event and stop rescanning a session for each user-response event. The release notes describe the implementation changes but provide no quantified speed or resource measurements.

Documentation additions include unit guides for A2A, skills, execution backends, evaluation, serving and observability, plus a node-as-tool guide and voice material for the unit-guide skill. Google also updated Live streaming documentation, clarified callback contracts and documented what parallel workflow branches isolate and share. A final maintenance commit marks the package as version 2.9.0.

Source: Google ADK Python 2.9.0 release notes.

Definition. Google ADK Python 2.9.0 is a release of the Agent Development Kit that expands resilience, voice, workflow and MCP capabilities while tightening several runtime and security behaviors.

Key takeaways

FAQ

Sources