ExtMCP
An external gRPC service extension interface in agentgateway, invoked once before a tools/call request reaches the upstream server and once after the response returns. Through the two RPCs CheckRequest and CheckResponse, it allows, modifies, or rejects requests, thereby enabling inspection of path parameters at the request stage.
Timeline (last 90 days)
ExtMCP is an external gRPC service that agentgateway calls before a tools/call request reaches the upstream server, and calls once more after the response returns.
The ExtMCP interface is defined in ext_mcp.proto and contains two RPCs: CheckRequest and CheckResponse, each of which returns either allow, a modified version, or a rejection with an error.
ExtMCP is wired in via an mcpGuardrails policy block, in which methods: tools/call: full means both hooks run for tools/call: CheckRequest before the filesystem server sees the call, and CheckResponse after it responds.
The ExtMCP policy server is about 150 lines of Python code; CheckRequest parses the JSON-RPC params, extracts name and arguments, and for tools with paths compares each path string against a deny list.
The failureMode: failClosed configuration causes the gateway side to receive an explicit Connection refused rather than silently allowing the request when the policy server process is killed.
All Facts (5)
ExtMCP is an external gRPC service that agentgateway calls before a tools/call request reaches the upstream server, and calls once more after the response returns.
50%UnverifiedThe ExtMCP interface is defined in ext_mcp.proto and contains two RPCs: CheckRequest and CheckResponse, each of which returns either allow, a modified version, or a rejection with an error.
50%UnverifiedExtMCP is wired in via an mcpGuardrails policy block, in which methods: tools/call: full means both hooks run for tools/call: CheckRequest before the filesystem server sees the call, and CheckResponse after it responds.
50%UnverifiedThe ExtMCP policy server is about 150 lines of Python code; CheckRequest parses the JSON-RPC params, extracts name and arguments, and for tools with paths compares each path string against a deny list.
50%UnverifiedThe failureMode: failClosed configuration causes the gateway side to receive an explicit Connection refused rather than silently allowing the request when the policy server process is killed.
50%