Apigee Hybrid 1.17.0 Brings On-Premises Model Context Protocol Support
Apigee hybrid 1.17.0, released on September 14, 2026, introduces Model Context Protocol (MCP) support to self-hosted deployments, allowing the MCP data plane to run directly inside customer Kubernetes clusters rather than on Google-managed infrastructure. Developers previously faced a choice between utilizing agentic AI tools and maintaining strict data residency constraints in local data centers, colocation facilities, or competing public clouds. Google’s update eliminates that barrier, letting artificial intelligence agents discover and invoke APIs locally without forcing organizations to migrate their existing runtime environments.
Self-Hosted Kubernetes Clusters Run the New Data Plane
The core architectural model mirrors the cloud-managed version released last December by developers.googleblog.com. Organizations define APIs using OpenAPI 3.0.x specifications, and the system automatically converts every operation into an MCP tool. Agents communicate with the endpoint over JSON-RPC by sending tools/list
queries to discover available capabilities and tools/call
commands to execute them, while Apigee handles protocol translation.
The crucial difference in the hybrid release involves execution locality. The Apigee control plane generates tool configurations from OpenAPI specs, and a cluster-side sidecar periodically fetches those updates. Daily.dev reported that MCP request traffic never leaves the customer’s cluster, and the architecture requires no inbound connection from Google Cloud, satisfying strict corporate security reviews and sovereignty mandates.
Helm Upgrades Enable the Optional Feature
Enabling MCP in an existing cluster requires a specific upgrade sequence using Helm charts. Operators must set the top-level enableMcpServer: true
flag inside their overrides.yaml
file. Administrators then upgrade the apigee-operator
chart before updating the apigee-org
chart. Order matters because the operator chart defines the schema for the new resources; reversing the steps results in a successful chart deployment that spawns no MCP pods.
A one-time control plane grant links the existing apigee-watcher
identity to the organization, allowing the cluster sidecar to pull configurations without creating new Google service accounts. Out-of-the-box settings deploy two MCP replicas that scale automatically up to ten pods. Disabling the feature requires changing the override flag to false and executing a single chart rollback.
API Insights Track Token Latency and Tool Usage
Every agent request arrives at a single /mcp
path, but Apigee tags each transaction with the specific tool name invoked. Developers can isolate agentic traffic from standard REST calls inside API insights by filtering for API style and MCP tool name. This granular visibility helps engineering teams measure response times, transaction rates per second, and proxy overhead versus backend latency.
Distributed tracing is handled by capturing W3C trace context embedded inside the JSON-RPC _meta
field by AI clients. Apigee extracts this metadata and forwards it as standard traceparent
and tracestate
headers, allowing conventional backend services to join a unified trace without code modifications. SEP-2028, an open proposal in the MCP community, aims to standardize this trace-forwarding behavior across all MCP servers.
Questions About Apigee Hybrid MCP Support
Does MCP request traffic ever leave my private Kubernetes cluster?
No, request traffic stays entirely within your local cluster during execution. A local sidecar pulls configuration files from the Google Cloud control plane, meaning Google never initiates an inbound network connection into your infrastructure.
What happens if I upgrade the Helm charts in the wrong order?
Upgrading the apigee-org
chart before the apigee-operator
chart completes successfully without creating any MCP pods because the operator owns the necessary resource schemas.
How do conventional backend systems read trace data from AI clients?
Conventional backends do not read the JSON-RPC _meta
field directly; instead, Apigee extracts the embedded W3C trace context and converts it into standard HTTP trace headers for downstream services.
Keep reading