OpenAI Agents SDK 0.24.0: what the MCP and sandbox changes actually mean for your loop

What it is

OpenAI's Python agent runtime, now at 0.24.0 (released 15 October 2026). 0.24.0 adds run-wide function error formatting and MCP discovery annotations, and improves recovery, sandbox safety, and tracing. The broader SDK ships agents, sandbox agents preconfigured to work with a container to perform work over long time horizons, and realtime agents, plus guardrails and handoffs.

One honest note up front: the "MCP v2 defaults" and "three sandbox guardrail layers" framing comes from the Developers Digest write-up, not the official 0.24.0 changelog. The changelog itself is narrower.

The next-work-session test

You're building a research agent that calls three MCP servers (a vector store, a GitHub tool, a code sandbox). In 0.23 you were catching tool exceptions per-tool and hand-formatting error strings so the model could recover. In 0.24 you register one formatter at the Runner level and get MCP tool annotations surfaced automatically — so your agent can read a tool's readOnlyHint or destructiveHint before calling it and route risky calls through a confirmation step.

Concretely: 0.24.0 features expose MCP annotations on converted tools and support run-wide tool exception formatting. That's two files touched in your repo, not an architecture change.

Pricing

The SDK itself is free and open source on GitHub. Model and tool usage still bills through the OpenAI API at standard per-token rates — the SDK is a wrapper, not a separate SKU. If you run it against a non-OpenAI model via the provider interface, you pay that provider instead. No separate "Agents SDK" line item exists on OpenAI's pricing page as of this writing.

What we'd actually use it for

Hardening an agent loop you already have in production. If you're on 0.23.x, the real wins are:

• One place to format tool errors so the model's recovery behavior is consistent across every tool call.
• MCP annotation passthrough, so your guardrail code can make policy decisions based on the server's own hints rather than a hand-maintained allowlist.
• Bug fixes that preserve RunState agent ownership across hook state changes, preserve tool outputs after callback failures, and recover from invalid sandbox tool arguments — all things that bit people writing custom hooks.

Not a reason to rewrite anything. A reason to bump the pin.

Limits

The guardrail story is still incomplete. OpenAI Agents SDK guardrails enforce the initial input and final output; tool guardrails are a separate SDK feature — and a community issue is still open proposing proper tool-level governance because the current InputGuardrail/OutputGuardrail focus on model input/output validation, but there is no equivalent for tool execution governance. So if you were expecting a true three-layer guardrail stack (input, tool, output) from the box, you're writing the middle layer yourself.

Sandbox support also lags on the TypeScript side: the new harness and sandbox capabilities launch first in Python, with TypeScript support planned for a future release.

And 0.24 is a minor release with real migration cost if you've written custom error callbacks or persisted agent graphs — the PR description flags compatibility changes there. Read the risk assessment in PR #5285 before upgrading a service you can't easily roll back.

Try it if

• You're already on openai-agents 0.22+ and your on_tool_error handlers are copy-pasted across every tool.
• You consume MCP servers you don't own and want their annotations in your routing logic.
• You run sandbox agents and have hit the invalid-argument recovery bugs.
• You want evals that assert on consistent error messages across tool failures.

Skip it if

• You need tool-call-level policy enforcement today — track issue #2515 instead and keep your own middleware.
• You're building in TypeScript and sandbox agents are the reason you're here.
• You have custom tool error formatters in production and no window to test migration this sprint.
• You were sold on "MCP v2 defaults" as a headline feature — the v0.24.0 notes don't use that phrase, and you should read them before planning around it.