[github-actions]

agentgateway/agentgateway#4059 — mcp: assert that resumed sessions are on the same backend

Docs versions: standalone/main, kubernetes/main

What changes for users: Encrypted MCP session IDs are now tied to the MCP backend that issued them. If a client presents a resumed session to a different backend, the proxy returns HTTP 404 and the client starts a new session on the current backend.

What the docs now say: The standalone Streamable HTTP page and the Kubernetes Stateful MCP page now say that an encrypted session ID for another MCP backend returns HTTP 404, matching the existing session recovery guidance.

Not verified: No cluster or local runtime; the configuration and requests are unrun.

How agentgateway-4059 was drafted, and what was not verified

• Code PR: mcp: assert that resumed sessions are on the same backend agentgateway#4059
• Code issue: none linked
• Product: agentgateway (upstream) → agentgateway/website
• Docs version: standalone/main and kubernetes/main
• Category: scoped-edit / pr

Plan, and what changed it

• Planned: Add the resumed-session behavior to the MCP session documentation for both standalone/main and kubernetes/main.
• Learned: content/docs/kubernetes/main/documentation/mcp/session.md reuses assets/agw-docs/pages/agentgateway/mcp/session.md, and that asset already gates main-only session-key behavior.
• Did: Updated the standalone Streamable HTTP page and the gated Kubernetes session asset, then wrote a release-note artifact.

Why a documentation change is necessary

The pull request adds the issuing backend to AES-encoded MCP session state and rejects resumed sessions whose encoded backend differs from the current request's backend. The standalone Streamable HTTP page already explains HTTP 404 session recovery for session IDs that cannot be decoded, and the Kubernetes Stateful MCP page has the same main-only session-key guidance. Without this update, readers would not know that a decodable but cross-backend encrypted session ID has the same recovery path.

What changed on disk

• assets/agw-docs/pages/agentgateway/mcp/session.md — Adds the main-only Kubernetes session behavior for encrypted session IDs that belong to another MCP backend.
• content/docs/standalone/main/integrations/mcp/servers/http.md — Adds the standalone Streamable HTTP behavior for encrypted session IDs that belong to another MCP backend.

How to verify this change

1. Run the code PR's MCP test for persisted cross-backend sessions, persisted_stateful_session_cannot_cross_mcp_backends.
2. The test initializes an encrypted session on backend /a, restarts the gateway to force token-based resumption, and sends the session ID to backend /b.
3. The request to /b returns HTTP 404, the /b upstream receives no request, and the same session ID still works on backend /a.

What was not verified

No cluster or local agentgateway runtime was used, so the configuration and requests are unrun.
The proposed release note was not placed into release notes; the workflow places it after this run.

How the pages were chosen (triage report)

Draft a documentation change

agentgateway/agentgateway#4059 — mcp: assert that resumed sessions are on the same backend

• Product: agentgateway (upstream) → agentgateway/website
• Docs version: standalone/main, kubernetes/main
• Summary (the title; the body has no description): mcp: assert that resumed sessions are on the same backend
• Not tested: no cluster was available, so every command in this diff is unrun

Release notes

This pull request also adds its release-note entries:

• content/docs/standalone/main/release-notes/release-notes.md: mcp: assert that resumed sessions are on the same backend (fix, under MCP)

Release notes kept out of a tree. Check that each change really does not reach the trees named here:

• mcp: assert that resumed sessions are on the same backend agentgateway#4059: not placed for kubernetes/main, because the draft edited no page there. If the change also reaches that tree, add the note there.

Draft branch: pr-tracker-draft-agentgateway-4059

[cloudflare-workers-and-pages]

Deploying agentproxy with    Cloudflare Pages

Latest commit:	7ccdafa
Status:	✅  Deploy successful!
Preview URL:	https://c3bdaccc.agentproxy.pages.dev
Branch Preview URL:	https://pr-tracker-draft-agentgatewa-me4x.agentproxy.pages.dev

View logs