OCT. 14, 2026 (英语).
去年12月，我们在Apigee对MCP支持的宣布预览：将你已经拥有的API转换、保护、管理和编目为AI agents可以发现和调用的工具的能力，而不写入代码或站起你自己的MCP服务器。 客户的回答是即时的，第一个问题回覆如下：“我的跑步时间能让我住在这里吗？”
对于许多Apigee 客户来说，运行时间并非偶然地生活在Google管理的基础设施上。 它生活在他们自己的数据中心，同地办公设施，或者另一个公共云层中，因为一个调节器需要它，因为记录系统离三个架子相去甚远，或者因为多云产业只是企业的现实。 这些客户并没有问他们是否想要代理进入他们的API. 他们问他们能不能不动跑道就拿到它
现在他们可以了。 与Apigee mixy 1.1.7. 0，发布于2026年9月14日，模型背景协议支持在Apigee mixy中提供，MCP数据平面运行在您自己的Kubernetes集群内。
概念模型是我们在阿皮吉运送的，没有改变。 您使用 OpenAPI 3. 0.x 规格描述您的 API，并从中创建 MCP 发现代理。 该光谱中的每一个操作都成为了MCP工具。 Agents在JSON-RPC上用工具/列表与端点交谈来发现可用的，并使用工具/呼叫来引用它，而Apigeee处理协议和转码。 您不会写入 MCP 服务器代码，您也不会将 MCP 服务器作为单独的软件块运行，并有自己的生命周期。
混合体的变化是工作发生的地方。 在Apigee混合体中，MCP数据平面运行在您自己的Kubernetes集群内。 Apigee 控制平面从您的 OpenAPI 规格生成 MCP 工具配置，您的集群定期获取配置，MCP 请求流量永远不会离开集群。 显示下图，MCP数据平面在每个部署模型中运行。
该建筑的两种特性是值得直言的，因为它们是你安全审查小组会问的。
MCP请求交通停留在您的集群。 兹克 1Z的工具/呼叫请求完全在自己的基础设施内接收，授权和代理到你的后端。 没有MCP请求或响应，在请求时间跨越边界到Google Cloud.
配置被拉动，而不是被推出。 与 MCP 数据平面相邻的侧车( 从您的集群内) 伸出以获取从您的光谱中得出的工具配置。 Apigee控制平面(以 Google Cloud 为单位) 从未启动连接到您的集群，这意味着 MCP 不需要从 Google 进入您的网络的进入路径。
- 代理端点运行在你的API已经运行。 Apigee 杂交已经允许您在您选择的 Kubernetes 平台上主机运行时间，MCP 继承了该时间。 MCP侧车重新使用已存在的阿比盖-观察者身份。 没有新的Google服务账户可以创建，也没有新的IAM角色可以授予。 每一个组织一个控制飞机的补助以及你已经拥有的身份其余的都是
- 数据存储和主权态势延续。 Apigee混合式的MCP供订阅和评价组织使用，包括数据居住支持组织(按组织设置)。 在混合式上，配置是从您的控制平面位置获取的，运行时请求路径通过构建留在您的集群中。 对于受到"请求不能离开这个司法管辖，这个设施，或者这个VPC"约束的团队，这种约束得到了架构的支持，而不是一个设置的支持。
- 你已经写的治理适用于agents。 MCP端点是Apigeee代理，因此它们继承了平台：OAuth 2.0和OpenID Connect,API密钥校验以及Apigee的内置政策库。 工具级控制来自您已经使用的概念，API产品。 您列出客户端有权获得的特定工具操作，选择使用每个工具配额，Apigeee 执行。 它还会自动过滤发现。 当客户端调用工具/列表时，响应中只包含该客户端API产品中的工具。 agent 如果从未被允许看到，则无法调用删除账户。
- 你的代理交通显示在你的API交通。 已部署的 MCP 发现代理自动被摄入 Appigee API 中枢，将 MCP API 样式及其操作映射到单个工具上，这是开发者可以用自然语言查询的可搜索目录，而不是一个端点的电子表格。 在API的洞察力中，两个滤波器，API风格和MCP工具名可以将代理流量从普通REST流量中分离出来，并查看一个跨越API性能，错误分析，耐用性和目标性能仪表板的单一工具。 可以看到发现与执行的比例，除了后端时间之外，还可以分辨代理管理费用。
MCP是Apigee混合体中的一个可选功能，默认不能启用。 启用它是一个已经在运行 Apigee 混合1.1.7. 0 的集群上的 Helm 操作。 这样做的步骤如下。
设置顶级启用McpServer：您的覆盖中的真实密钥。 yaml，然后首先升级Apigee-操作图和Apigee-org图第二。 令相关。 运营商图拥有新MCP资源的计划并按错误的顺序进行升级，生成一个没有MCP被吊舱的成功升级。 还有一个一次性的，每个组织给予的，新增，监视者身份，用于您的组织控制平面访问，因此侧车可以取回配置。 默认是明智的出框。 2台MCP复制机，自动升级为10台。 倒滚是同一个场设置为假的，是单一的图表升级。
在你安排改变之前还要计划一些事情使MCP启用或失效触发了一个相接的金丝雀放出运行时的吊舱，所以在经过批准的维护窗口中运行。 这里的公开文献描述了如何在已存在的Apigee混合组中启用MCP.
您的 MCP 代理被曝光为单个端点。 每个agent请求，无论它引用什么工具，都到达同/mcp路径。 Apigee 标记了其中每个请求，并标有被调用的工具的名称，因此 API 洞察力可以通过工具破解一个端点，并显示您 agents 实际使用的哪些工具，频率和期限。 显示 API洞察力下方的截图，包括向MCP代理(mcp)提出的请求，还可以看到单个工具(作为API代理mcp-保健，mcp-petstore,mcp-statuscode)响应时间和tps. 请参看关于监测和分析mcp流量的公开文献
我们还在下面的API见解中看到工具在工具性能标签中被调用。
MCP工具呼叫交叉一个AI客户端，Apigee和你的后端。 今天，每个都属于自己的原木岛，因此问题平台小组实际上问到“时间去了哪里？” 没有单一的答案。
下面的片段是一个来自AI客户端的mcp工具呼叫请求的例子。 下面的卷曲请求允许结束对请求的跟踪，当在Apigee与OTEL一起启用了分布的跟踪。
卷起 - X POST "https://xxx.xx.xx.net/mcp"\.
-H"Content-Type：应用程序/json"\?
-H"MCP-Protocol-Version:2025-11-25" (中文(简体) ).
-d '{
"jsonrpc":"2.0" (中文(简体) ).
"id": 321 (英语).
"通鉴":"取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取取。.
"段落":{
"取名":"创造回想"
"论语":{
"资治通鉴":"123"
},
"_meta": {
"追踪父母":"00-3ad8012d970b3971cb16cda653a1a370-df3047d1d0830dc0-01".
}
}
}'
贝壳
复制
与在 Google CloudTrace 显示中分发的追踪所安排的相同整个全球视野中的呼声 (Assumption是链式报告给同一Google CloudTrace中的所有服务(Apigee/Non-Apigee)).
MCP客户端携带了JSON-RPC meta域内的W3C痕量上下文，一个常规的REST后端不知道如何阅读。 Apigee将其取出并转发作为普通的痕母和痕子头，因此下游的仪器服务在没有代码更改的情况下会加入痕子。 接下来有三件事：一个跨越AI客户端，Apigeee代理和后端执行的单一的痕量ID；没有重编码和较少噪音参与的后端，因为网关可以在过关模式中转发上下文，而不是排放自己的基础设施跨度，这同样会修剪摄入成本。
生态系统正在同一种想法相汇合。 SEP-2028是MCP社区的一个开放建议，旨在将MCP服务器的W3C痕量上下文标准行为标准化。
搭载了W3C痕量上下文的OpenTeleometry路径在今天的Apigee可以找到。
MCP支持现在在Apigee混合1.1.7. 从Apigee总体架构中的MCP开始，为Helm程序启用Apigee混合式的MCP并快速启动MCP以获得第一个响应agent的工具。
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
OCT. 14, 2026
Last December, we announced preview of MCP support in Apigee: the ability to turn the APIs you already have, secured, governed and cataloged into tools that AI agents can discover and call, without writing code or standing up MCP servers of your own. The response from customers was immediate and so was the first question back: “can I have this where my runtime actually lives?”
For many Apigee customers, the runtime does not live on Google-managed infrastructure by accident. It lives in their own data center, in a colocation facility, or in another public cloud because a regulator requires it, because the systems of record are three racks away, or because a multi-cloud estate is simply the reality of the business. Those customers were not asking whether they wanted agentic access to their APIs. They were asking whether they could get it without moving the runtime.
And now they can. With Apigee hybrid 1.17.0, released on September 14, 2026, Model Context Protocol support is available in Apigee hybrid and the MCP data plane runs inside your own Kubernetes cluster.
The conceptual model is the one we shipped on Apigee, unchanged. You describe your API with an OpenAPI 3.0.x specification and create an MCP Discovery Proxy from it. Every operation in that spec becomes an MCP tool. Agents talk to the endpoint over JSON-RPC using tools/list to discover what is available and tools/call to invoke it and Apigee handles the protocol and the transcoding. You do not write MCP server code and you do not operate an MCP server as a separate piece of software with its own lifecycle.
What changes in hybrid is where the work happens. In Apigee hybrid, the MCP data plane runs inside your own Kubernetes cluster. The Apigee control plane generates MCP tool configuration from your OpenAPI Specification, your cluster fetches that configuration periodically and MCP request traffic never leaves the cluster. The diagram below shows where the MCP data plane runs in each deployment model.
Two properties of that architecture are worth stating plainly because they are the ones your security review team will ask about.
MCP request traffic stays inside your cluster. An agent's tools/call request is received, authorized and proxied to your backend entirely within your own infrastructure. No MCP request or response crosses the boundary to Google Cloud at request time.
Configuration is pulled, not pushed. A sidecar alongside the MCP data plane (from within your cluster) reaches out to fetch the tool configuration derived from your spec. The Apigee control plane (in Google Cloud) never initiates a connection into your cluster, which means MCP requires no inbound path from Google into your network.
- Agentic endpoints run where your APIs already run. Apigee hybrid already lets you host the runtime on the Kubernetes platform of your choice and MCP inherits that. The MCP sidecar reuses the existing apigee-watcher identity. There is no new Google service account to create and no new IAM role to grant. One control-plane grant per organization and the identity you already have does the rest.
- Data residency and sovereignty posture carry over. MCP in Apigee hybrid is available for Subscription and Evaluation organizations, including Data Residency–enabled organizations (configured at organization setup). On hybrid, configuration is fetched from your control plane location and the runtime request path stays in your cluster by construction. For teams whose constraint is "the request may not leave this jurisdiction, this facility, or this VPC," that constraint is supported by the architecture rather than by a setting.
- The governance you already wrote applies to agents. MCP endpoints are Apigee proxies, so they inherit the platform: OAuth 2.0 and OpenID Connect, API key verification as well as Apigee's built-in policy library. Tool-level control comes from a concept you already use, the API product. You list the specific tool operations a client is entitled to, optionally with a per-tool quota and Apigee enforces it. It also filters discovery automatically. When a client calls tools/list, the response contains only the tools in that client's API product. An agent cannot call delete_account if it was never allowed to see it.
- Your agentic traffic shows up where your API traffic does. Deployed MCP Discovery Proxies are automatically ingested into Apigee API hub, assigned the MCP API style and their operations mapped to individual tools a searchable catalog that developers can query in natural language rather than a spreadsheet of endpoints. In API insights, two filters, API style and MCP tool name let you isolate agentic traffic from ordinary REST traffic and look at a single tool across the API performance, error analysis, latency and target performance dashboards. You can see the ratio of discovery to execution and you can tell proxy overhead apart from backend time.
MCP is an optional feature in Apigee hybrid and is not enabled by default. Enabling it is a Helm operation on a cluster already running Apigee hybrid 1.17.0 or later. Steps to do this are as follows.
Set the top-level enableMcpServer: true key in your overrides.yaml, then upgrade the apigee-operator chart first and the apigee-org chart second. The order matters. The operator chart owns the schema for the new MCP resources and upgrading in the wrong order produces a successful upgrade with no MCP pods. There is also a one-time, per-organization grant that adds the apigee-watcher identity to your organization's control plane access, so the sidecar can retrieve configuration. Defaults are sensible out of the box. Two MCP replicas, autoscaling to ten. Rolling back is the same field set to false and a single chart upgrade.
A few things to plan for before you schedule the change. Enabling or disabling MCP triggers a staged canary release of runtime pods, so run it in an approved maintenance window. The public documentation here describes how to enable MCP in an existing Apigee hybrid cluster.
Your MCP proxy is exposed as a single endpoint. Every agent request, whatever tool it invokes, arrives at the same /mcp path. Apigee tags each of those requests with the name of the tool that was called, so API insights can break that one endpoint out by tool and show which tools your agents actually used, how often and over what period. The screenshot below shows API insights, including requests to the MCP proxy (mcp) and also see individual tools (as API proxies mcp-healthcare, mcp-petstore, mcp-statuscode) response time and tps. See public documentation on monitoring and analyzing mcp traffic with Apigee API insights here and here on how to use the API insights dashboard.
We also have a view of tools being called in the tool performance tab within API insights below.
An MCP tool call crosses an AI client, Apigee and your backend. Today each of those is its own island of logs, so the question platform teams actually ask “where did the time go?” has no single answer.
The snippet below is an example mcp tools call request from an AI client. The curl request below allows for end to end tracking of the request, when distributed trace is enabled in Apigee with OTEL.
curl -X POST "https://xxx.xxx.xxx.net/mcp" \
-H "Content-Type: application/json" \
-H "MCP-Protocol-Version: 2025-11-25" \
-d '{
"jsonrpc": "2.0",
"id": 321,
"method": "tools/call",
"params": {
"name": "createReward",
"arguments": {
"reward": "123"
},
"_meta": {
"traceparent": "00-3ad8012d970b3971cb16cda653a1a370-df3047d1d0830dc0-01"
}
}
}'
Shell
Copied
The same call as orchestrated by distributed trace in Google CloudTrace shows the calls in its entirety in one global view. (Assumption is all services (Apigee/Non-Apigee) in the chain report to the same Google CloudTrace)
MCP clients carry W3C trace context inside the JSON-RPC _meta field, which a conventional REST backend has no idea how to read. Apigee extracts it and forwards it as ordinary traceparent and tracestate headers, so instrumented services downstream join the trace without code changes. Three things follow: a single trace ID spanning the AI client, the Apigee proxies and backend execution; backends that participate without recoding and less noise, because the gateway can forward context in passthrough mode rather than emitting infrastructure spans of its own which also trims trace ingestion cost.
The ecosystem is converging on the same idea. SEP-2028, an open proposal in the MCP community, aims to standardize _meta-to-header forwarding of W3C trace context standard behavior for MCP servers.
The OpenTelemetry path that carries W3C trace context is available in Apigee today.
MCP support is available now in Apigee hybrid 1.17.0. Start with the MCP in Apigee overview for the architecture, Enable MCP in Apigee hybrid for the Helm procedure and the MCP quickstart to get a first tool answering an agent.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.