Skip to content

[Automated] Draft docs (agentgateway): mcpGuardrails: CEL processor (+4 related) - #1265

Open
github-actions[bot] wants to merge 7 commits into
mainfrom
pr-tracker-draft-agentgateway-3711-plus4
Open

[Automated] Draft docs (agentgateway): mcpGuardrails: CEL processor (+4 related)#1265
github-actions[bot] wants to merge 7 commits into
mainfrom
pr-tracker-draft-agentgateway-3711-plus4

Conversation

@github-actions

@github-actions github-actions Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

agentgateway/agentgateway#3711 — mcpGuardrails: CEL processor

Docs versions: standalone/main, kubernetes/main

What changes for users: MCP guardrails can now run in-process CEL processors with kind: expression to reject or transform mcp.params and mcp.result. Agent sessions are available as request.agent.session, Client Setup uses the browser origin when the UI and LLM gateway share a gateway, and playground requests no longer forward browser cookies or basic auth.

What the docs now say: The standalone MCP guardrails guide now shows kind: expression, condition, reject, transform, mcp.params, and mcp.result. The standalone and Kubernetes CEL variable pages now cover MCP CEL processor contexts and request.agent.session, and the UI launch and LLM playground pages cover the changed UI behavior.

Not verified: No configured cluster or runnable agentgateway binary in this CI sandbox; the configuration and UI behavior are unrun.

How agentgateway-3711 was drafted, and what was not verified

Plan, and what changed it

  • Planned: Document CEL MCP guardrails, agent session detection, and UI playground behavior on the rule-named pages for standalone/main and kubernetes/main.
  • Learned: The UI launch page body is in assets/agw-docs/standalone/setup/ui/launch.md, so main-only UI changes needed version gates.
  • Did: Wrote standalone MCP guardrails and LLM playground content, gated the shared UI launch asset, updated standalone and Kubernetes CEL variable pages, and added one standalone access-log example.

Why a documentation change is necessary

The generated references list the new mcpGuardrails.processors[].kind: expression, condition, reject, transform, mcp.params, mcp.result, request.agent.session, and config.standardAttributes.session fields, but readers need prose that explains how to use the fields safely. The existing MCP guardrails guide described only remote ExtMCP processors, so it did not tell users that in-process CEL processors can now reject or transform MCP bodies. The UI docs did not say that Client Setup resolves same-gateway URLs through the browser origin or that playground requests omit browser credentials.

What changed on disk

  • content/docs/standalone/main/documentation/mcp/guardrails/setup.md: Added CEL MCP guardrail processor prose, YAML, and field descriptions.
  • content/docs/standalone/main/reference/cel/variables.md: Added request.agent.session and MCP CEL guardrail variable contexts.
  • content/docs/kubernetes/main/reference/cel/variables.md: Added request.agent.session and MCP CEL guardrail variable contexts.
  • content/docs/standalone/main/documentation/observability/access-logs/view.md: Added an access-log example for request.agent.session.
  • content/docs/standalone/main/documentation/llm/playground.md: Documented that playground requests omit browser credentials and use the API key field for bearer auth.
  • assets/agw-docs/standalone/setup/ui/launch.md: Added gated main-tree content for Settings tabs and Client Setup browser-origin URL behavior.

How to verify this change

  1. Run a standalone config that includes an MCP backend and an mcpGuardrails.processors entry with kind: expression, methods: {"tools/call": request}, and reject: "blocked".
  2. Send a matching tools/call request through the MCP endpoint. The JSON-RPC response returns the configured rejection message and the MCP backend is not called.
  3. Open the standalone UI on the same gateway that serves LLM traffic, go to LLM > Client Setup, and check that Gateway base URL matches the browser origin.
  4. Protect the LLM gateway with browser cookies or HTTP basic auth, then send a playground request without an API key. The request does not include those browser credentials; with a playground API key, the request includes an Authorization header.

What was not verified

  • The standalone MCP guardrail configuration was not run.
  • The UI Client Setup and playground behavior was not checked in a browser.
  • The Kubernetes CRD examples were not applied; this sandbox has no configured cluster.
  • Stale value not edited because the page was not an authorized target: assets/agw-docs/pages/traffic-management/load-balancing.md still uses request.headers["x-session-id"] where the dossier says request.agent.session is the new value.

Validation of the added standalone configuration

No added standalone config file was validated.
Not checked: 2 fragment(s) that are not a whole config file.
Validation checks field names and types only. Commands, runtime behavior, and field paths written in prose are unverified.

How the pages were chosen (triage report)

Feature clusters

These pull requests document one feature between them:

Cluster Pull requests Product Why grouped
c4 agentgateway/agentgateway#3711, agentgateway/agentgateway#3803, agentgateway/agentgateway#3807, agentgateway/agentgateway#3850, agentgateway/agentgateway#3892 agentgateway both are drafted into content/docs/standalone/main/documentation/llm/playground.md, the only page a code-path rule names for one of them, so separate pull requests would conflict

Kept apart on purpose. Merging wrongly produces a guide that documents two things and explains neither, so these are reported for a person to merge rather than grouped automatically:

Worked in another repository as well. This does not hold the cluster: a different repository documents itself in a different product's tree, on a schedule this run does not control. Listed so the other work is not a surprise later:

Cluster Also worked by What it is
c4 #1238 [Automated] Draft docs (agentgateway): ui: show Client Setup in XDS mode (+3 related) (open)

Draft a documentation change

agentgateway/agentgateway#3803 — ui: add top level settings page with sub-pages

  • Product: agentgateway (upstream) → agentgateway/website
  • Docs version: standalone/main
  • Summary (read from the body): This allows up to scale up our settings page to various other top level settings
  • Not tested: standalone configuration needs no cluster; whole config files the draft adds are validated with --validate-only after drafting, and commands are unrun
  • No rule covers 1 touched file(s). The candidate pages below come from the files that DID match a rule, so they may scope this narrower than the change is. Read these before deciding the change is only about the pages listed:
    • crates/agentgateway/src/config_store.rs

agentgateway/agentgateway#3807 — ui: expose proper gateway url for client setup

agentgateway/agentgateway#3892 — ui: avoid implicit passing creds to MCP and LLM playground

  • Product: agentgateway (upstream) → agentgateway/website
  • Docs version: standalone/main
  • Summary (read from the body): Very niche case - but this avoids accidentally exposing cookies/basic auth/etc from the logged in session.
  • Not tested: standalone configuration needs no cluster; whole config files the draft adds are validated with --validate-only after drafting, and commands are unrun

New configuration: no page mentions it yet

agentgateway/agentgateway#3711 — mcpGuardrails: CEL processor

  • Product: agentgateway (upstream) → agentgateway/website
  • Docs version: standalone/main, kubernetes/main
  • Summary (read from the body): mcpGuardrails: processors: - kind: cel methods: {"tools/call": request} when: mcp.params.name == 'restricted_tool' reject: "This tool is unavailable" - kind: cel methods: {"tools/call": response} transform: >- mcp.result.merge({ 'content': mcp.result.content.map(c, c.type == 'text' ? c.merge({'text': c.text.regexReplaceAll('secret-[A-Za-z0-9]+', '[REDACTED]')}) : c) })
  • Not tested: no cluster was available, so every command in this diff is unrun
  • No rule covers 2 touched file(s). The candidate pages below come from the files that DID match a rule, so they may scope this narrower than the change is. Read these before deciding the change is only about the pages listed:
    • schema/cel-functions.md
    • schema/cel.md

agentgateway/agentgateway#3850 — Automatically detect and report 'session'

  • Product: agentgateway (upstream) → agentgateway/website
  • Docs version: standalone/main, kubernetes/main
  • Summary (read from the body): Use heuristics to get session id from various harnesses and record this into logs, CEL context, and use it with our switchyard example.
  • Not tested: no cluster was available, so every command in this diff is unrun
  • Stale values (the change fixed these in its own fixtures):
    • x-switchyard-session-id: request.headers["x-session-id"] is now request.agent.session. Still written at:
      • assets/agw-docs/pages/traffic-management/load-balancing.md:70
      • assets/agw-docs/pages/traffic-management/load-balancing.md:88
      • assets/agw-docs/pages/traffic-management/load-balancing.md:99
      • content/docs/standalone/1.5.x/documentation/configuration/backends.md:346
      • content/docs/standalone/1.5.x/documentation/configuration/backends.md:368
      • content/docs/standalone/1.5.x/documentation/configuration/backends.md:381
      • content/docs/standalone/latest/documentation/configuration/backends.md:379
      • content/docs/standalone/latest/documentation/configuration/backends.md:401
      • content/docs/standalone/latest/documentation/configuration/backends.md:414
      • content/docs/standalone/main/documentation/configuration/backends.md:379
      • content/docs/standalone/main/documentation/configuration/backends.md:401
      • content/docs/standalone/main/documentation/configuration/backends.md:414
  • No rule covers 6 touched file(s). The candidate pages below come from the files that DID match a rule, so they may scope this narrower than the change is. Read these before deciding the change is only about the pages listed:
    • crates/agentgateway/src/http/mod.rs
    • crates/agentgateway/src/http/session.rs
    • crates/agentgateway/src/lib.rs
    • crates/agentgateway/src/proxy/httpproxy.rs
    • crates/agentgateway/src/state_manager.rs
    • schema/cel.md

Release notes

This pull request also adds its release-note entries:

  • content/docs/kubernetes/main/release-notes/release-notes.md: CEL MCP guardrails (feature)
  • content/docs/standalone/main/release-notes/release-notes.md: CEL MCP guardrails (feature)

Draft branch: pr-tracker-draft-agentgateway-3711-plus4

@actions-user
[Automated] Draft docs (agentgateway): mcpGuardrails: CEL processor (…
ee90b7d 
…+4 related)

Signed-off-by: GitHub Action <action@github.com>
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying agentproxy with  Cloudflare Pages  Cloudflare Pages

Latest commit: 3a6864c
Status: ✅  Deploy successful!
Preview URL: https://c6bc911a.agentproxy.pages.dev
Branch Preview URL: https://pr-tracker-draft-agentgatewa-5ucw.agentproxy.pages.dev

View logs

@kristin-kronstain-brown @claude
Drop launch.md edits covered by #1238; move release notes to v1.7
541c1a5 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Kristin Brown <kristin.brown@solo.io>
kristin-kronstain-brown added a commit that referenced this pull request Oct 14, 2026
@kristin-kronstain-brown @claude
Add the Settings sentence from #1265 to the UI launch page
4c851a3 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Kristin Brown <kristin.brown@solo.io>
@kristin-kronstain-brown kristin-kronstain-brown mentioned this pull request Oct 14, 2026
Merged
kristin-kronstain-brown added a commit that referenced this pull request Oct 14, 2026
@kristin-kronstain-brown @claude
Install cloud-provider-kind from its release binary
e8d7b0a 
Building it with go install @latest pulled hundreds of modules through
proxy.golang.org, and dropped proxy streams failed doc-test shards
before any test ran (#920, #1250, #1265). Pinned to v0.12.0 and
checksum-verified.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Kristin Brown <kristin.brown@solo.io>
@kristin-kronstain-brown
Merge main (doc tests migration, #920) into pr-tracker-draft-agentgat…
4a159e4 
…eway-3711-plus4

Signed-off-by: Kristin Brown <kristin.brown@solo.io>
@kristin-kronstain-brown
Updates from main
aca514b 
Signed-off-by: Kristin Brown <kristin.brown@solo.io>
@kristin-kronstain-brown
Fixes
c02b840 
Signed-off-by: Kristin Brown <kristin.brown@solo.io>
@kristin-kronstain-brown
Merge branch 'main' into pr-tracker-draft-agentgateway-3711-plus4
2ecfc90
@kristin-kronstain-brown @claude
Merge origin/main into pr-tracker-draft-agentgateway-3711-plus4
3a6864c 
Resolve release-notes conflicts with the v1.7 sections on main.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Kristin Brown <kristin.brown@solo.io>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kristin-kronstain-brown kristin-kronstain-brown kristin-kronstain-brown approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@kristin-kronstain-brown @actions-user