[github-actions]

agentgateway/agentgateway#4057 — mcp: rebind re-used session to current settings

Docs versions: standalone/main, kubernetes/main

What changes for users: Stateful MCP requests that reuse a session ID on another route to the same backend now use the current route's MCP policy settings. In the dossier test, a session opened on /a and reused on /b is denied by /b's guardrail policy with denied by route b.

What the docs now say: The Streamable HTTP integration page now says that stateful session resumption keeps backend pinning, but MCP policy settings come from the current route when the same session ID is reused on another route to the same backend.

Not verified: No cluster or agentgateway run; the behavior and release note are unrun.

How agentgateway-4057 was drafted, and what was not verified

• Code PR: mcp: rebind re-used session to current settings agentgateway#4057
• Code issue: none linked
• Product: agentgateway (upstream) → agentgateway/website
• Docs version: standalone/main and kubernetes/main; documented in the development tree, which is where unreleased changes go.
• Category: scoped-edit / pr

Plan, and what changed it

• Planned: Document how reused MCP sessions bind to the current route's policies on the Streamable HTTP session page.
• Learned: The neighbor dossiers cover UI session-key hiding, cache refactoring, and analytics, not this MCP route-policy behavior.
• Did: Updated the Streamable HTTP session explanation and wrote a proposed MCP release note for both affected docs trees.

Why a documentation change is necessary

The diff changes stateful MCP session reuse when the same session ID reaches a different route to the same backend. The existing Streamable HTTP page already documents session IDs, backend pinning, and session resumption, but it did not say which route's policies apply when the route changes. The new test in the code diff shows that a session initialized on an unguarded route does not skip guardrails on another route to the same backend.

What changed on disk

• content/docs/standalone/main/integrations/mcp/servers/http.md: Clarifies that reused sessions keep backend pinning while the current route's MCP policy settings still apply.

How to verify this change

1. Cannot be verified from the diff alone with a complete published command. A reviewer needs a local setup with two MCP routes that point to the same backend: route /a unguarded, and route /b with an MCP guardrail or authorization policy that denies a tools/call request with a recognizable message such as denied by route b.
2. Send an initialize request to /a, save the returned Mcp-Session-Id, and send a tools/call request to /b with that session ID.
3. The request to /b is routed to the same backend session, and the response shows the denial from /b's policy.

Proposed release note

The note names both standalone/main and kubernetes/main because the runtime behavior reaches both modes, while the page edit is in the standalone Streamable HTTP integration.

What was not verified

• The configuration was not applied to a cluster or run locally; every command and behavior check in this report is unrun.

How the pages were chosen (triage report)

Draft a documentation change

agentgateway/agentgateway#4057 — mcp: rebind re-used session to current settings

• Product: agentgateway (upstream) → agentgateway/website
• Docs version: standalone/main, kubernetes/main
• Summary (the title; the body has no description): mcp: rebind re-used session to current settings
• Not tested: no cluster was available, so every command in this diff is unrun

A declared version this draft does not reach

This pull request is planned for more than one documentation version,
and nothing in the diff publishes to:

• kubernetes/main

A file under assets/ reaches a version tree only where a page in that
tree reuses it, so editing a shared asset does not by itself cover every
mode a product ships. Either that version still needs writing, or the
change genuinely does not apply there and the reason belongs in this body.

Release notes

This pull request also adds its release-note entries:

• content/docs/kubernetes/main/release-notes/release-notes.md: mcp: rebind re-used session to current settings (fix, under MCP)
• content/docs/standalone/main/release-notes/release-notes.md: mcp: rebind re-used session to current settings (fix, under MCP)

Draft branch: pr-tracker-draft-agentgateway-4057

[cloudflare-workers-and-pages]

Deploying agentproxy with    Cloudflare Pages

Latest commit:	d1cbef5
Status:	✅  Deploy successful!
Preview URL:	https://f5d54d0f.agentproxy.pages.dev
Branch Preview URL:	https://pr-tracker-draft-agentgatewa-auzy.agentproxy.pages.dev

View logs