Google announces MCP support in Apigee hybrid for on-premises AI agents

What happened

Google announced Model Context Protocol support in Apigee hybrid 1.17.0, released on September 14, 2026. This follows a preview announcement of MCP in cloud-managed Apigee. The feature lets organizations run the MCP data plane inside their own Kubernetes clusters rather than requiring infrastructure hosted on Google Cloud, addressing a core requirement from customers whose APIs run on-premises or in other public clouds due to regulatory, data residency, or multi-cloud architecture constraints.

How it works: the architecture

The conceptual model mirrors MCP in cloud-managed Apigee. You describe your API using an OpenAPI 3.0.x specification and create an MCP Discovery Proxy from it. Each operation in the spec becomes an MCP tool that AI agents can discover via JSON-RPC using tools/list and invoke using tools/call. Apigee handles protocol transcription; you do not write or operate a separate MCP server.

In Apigee hybrid, the MCP data plane runs inside your own Kubernetes cluster. The control plane in Google Cloud generates MCP tool configuration from your OpenAPI specification. Your cluster fetches that configuration periodically, and MCP request traffic never leaves the cluster. Two architectural properties address security review: MCP request traffic stays inside your cluster—agents' tools/call requests are received, authorized, and proxied to backends entirely within your infrastructure. Configuration is pulled, not pushed—a sidecar fetches tool configuration from the control plane in Google Cloud, meaning Google never initiates a connection into your network.

Governance and data residency

MCP endpoints are Apigee proxies, so they inherit the platform's governance layers: OAuth 2.0, OpenID Connect, API key verification, and Apigee's policy library. Tool-level control uses API products, the same concept you already use. You list the specific tool operations a client is entitled to, optionally with per-tool quotas, and Apigee enforces access. When a client calls tools/list, the response contains only the tools in that client's API product. An agent cannot call a tool it was never allowed to see.

MCP in Apigee hybrid is available for Subscription and Evaluation organizations, including Data Residency–enabled organizations configured at organization setup. Configuration is fetched from your control plane location and the runtime request path stays in your cluster by design. For teams whose constraint is that requests may not leave a specific jurisdiction, facility, or VPC, the architecture supports that constraint structurally rather than through a setting.

Observing and managing agentic traffic

Deployed MCP Discovery Proxies are automatically ingested into Apigee API hub, assigned the MCP API style, and their operations mapped to individual tools. This creates a searchable catalog developers can query in natural language. In API Insights, filters for API style and MCP tool name let you isolate agentic traffic from ordinary REST traffic. You can see the ratio of discovery to execution calls and separate proxy overhead from backend time. MCP proxy requests are tagged with the tool name so API Insights can break down traffic by tool and show which tools agents use, how often, and over what period.

Enabling MCP in your cluster

MCP is optional in Apigee hybrid and not enabled by default. Enabling it is a Helm operation on a cluster already running Apigee hybrid 1.17.0 or later. Set enableMcpServer: true in your overrides.yaml, then upgrade the apigee-operator chart first and the apigee-org chart second. The order matters; upgrading in the wrong order produces a successful upgrade with no MCP pods. A one-time, per-organization grant adds the apigee-watcher identity to your organization's control plane access so the sidecar can retrieve configuration. Defaults provide two MCP replicas with autoscaling to ten. Rolling back is the same field set to false and a single chart upgrade. The MCP sidecar reuses the existing apigee-watcher identity; there is no new Google service account to create and no new IAM role to grant.

Enabling or disabling MCP triggers a staged canary release of runtime pods, so schedule it in an approved maintenance window. The operation requires no inbound network path from Google into your cluster.

Distributed tracing and what's next

An MCP tool call crosses an AI client, Apigee, and your backend. Today each is its own logging island, making it difficult to answer where the time went in the call chain. MCP clients can carry W3C trace context inside the JSON-RPC _meta field. Apigee extracts it and forwards it as ordinary traceparent and tracestate headers, so instrumented services downstream join the trace without code changes. This creates a single trace ID spanning the AI client, Apigee proxies, and backend execution, reducing trace ingestion cost by trimming infrastructure spans. The ecosystem is converging on the same approach; SEP-2028, an open proposal in the MCP community, aims to standardize _meta-to-header forwarding of W3C trace context as standard MCP server behavior.

curl -X POST "https://xxx.xxx.xxx.net/mcp" \
-H "Content-Type: application/json" \
-H "MCP-Protocol-Version: 2025-11-25" \
-d '{
"jsonrpc": "2.0",
"id": 321,
"method": "tools/call",
"params": {
"name": "createReward",
"arguments": {
"reward": "123"
},
"_meta": {
"traceparent": "00-3ad8012d970b3971cb16cda653a1a370-df3047d1d0830dc0-01"
}
}
}'

Source

AI-assisted, verified against the source. This post was drafted with AI from the primary source linked above and checked automatically against it. For anything you depend on, read the original.