Apigee hybrid 1.17.0, released September 14, 2026, brings Model Context Protocol support to self-hosted Apigee deployments, letting the MCP data plane run inside a customer's own Kubernetes cluster rather than on Google-managed infrastructure. The control plane generates MCP tool configuration from an OpenAPI spec, which the cluster pulls periodically; MCP request traffic never leaves the cluster and no inbound connection from Google is required. Enabling it is a Helm operation gated by an enableMcpServer flag, requiring the apigee-operator chart to be upgraded before apigee-org. The post also covers API insights for per-tool traffic breakdowns and how Apigee forwards W3C trace context from MCP's JSON-RPC _meta field into standard traceparent/tracestate headers for distributed tracing via OpenTelemetry.
Table of contents
What this means for multi-cloud and on-premisesTurning it onWhat's next: tracing an agent's call end to endNext stepsQuestions this post answers
How do I enable MCP support in Apigee hybrid 1.17.0?
Set the top-level enableMcpServer: true key in your overrides.yaml, then upgrade the apigee-operator chart first and the apigee-org chart second, since the operator chart owns the schema for the new MCP resources. A one-time per-organization grant adds the apigee-watcher identity to control plane access so a sidecar can retrieve tool configuration. Defaults run two MCP replicas, autoscaling to ten, and disabling it is the same field set to false. Teams rolling out Apigee hybrid upgrades track release steps like these on daily.dev.
Does MCP traffic in Apigee hybrid leave my own cluster?
No, MCP request traffic stays entirely inside the customer's own cluster in Apigee hybrid 1.17.0. An agent's tools/call request is received, authorized, and proxied to the backend within the cluster, and configuration is pulled by a sidecar from the Apigee control plane rather than pushed, so Google never initiates an inbound connection into the network. Architects evaluating agentic API gateways weigh data-residency tradeoffs like this on daily.dev.
How does Apigee propagate distributed tracing for MCP tool calls?
MCP clients carry W3C trace context inside the JSON-RPC _meta field, which a conventional REST backend cannot read; Apigee extracts it and forwards it as ordinary traceparent and tracestate headers so instrumented downstream services join the trace without code changes. This produces a single trace ID spanning the AI client, Apigee proxies, and backend execution when distributed trace is enabled with OTEL. Platform teams debugging agent-to-backend latency can follow tracing approaches like this via daily.dev.
Share this post