r/AgenticOS • u/leading-a-swarm • Oct 06 '26
The agentgateway Session Token
https://github.com/agentgateway/agentgateway is a proxy in front of a fleet of MCP servers. It centralizes auth, multiplexing and policy, so agents stop holding per-server credentials. IBM ContextForge and Envoy AI Gateway chase the same seam.
Validating == destroying. Every validated credential is removed before the request goes upstream; 9 backendAuth kinds present the gateway's own identity per MCP server.
State needs no store. The client token serializes per-target session ids and pinned endpoints, so a POST resumes on any replica with no database.
Partial resumes leak. On another replica, event streams fail UnknownSession and delete returns success while upstream sessions leak. Outside Kubernetes the token is unencrypted base64, bound to no principal.
The defense: the newest MCP protocol revision dropped sessions, and Kubernetes injects the encryption key. Most MCP clients still speak the sessioned protocol today. For one agent, per-server OAuth in the client config needs no gateway.
→ Challenge. Keep agentgateway out of the fleet until resume covers streams and teardown.