Agentgateway tutorial shows MCP tool calls gated by an external ExtMCP policy server

A Cloud Native Deep Dive tutorial shows agentgateway's ExtMCP hook blocking GitHub MCP write tools via an external gRPC policy server on Kubernetes.

A Cloud Native Deep Dive tutorial (published 2026-09-13) walks through agentgateway's ExtMCP hook. It sends parsed MCP method calls to your own policy server, which can pass, change or deny each one. Builders get a place to enforce rules like "no write tools" outside the agent and outside the MCP server.

The author says ExtMCP is modeled on ext_authz and borrows mutations from ExtProc. The difference is that the gateway already parses the JSON-RPC, so the policy server receives the method, raw params or result, and selected headers instead of raw HTTP. In the demo, a Python gRPC server sits in front of the GitHub Copilot MCP server. It denies write tools on tools/call, strips them from tools/list responses and tags the remaining tools [guarded].

The tutorial assumes a Kubernetes cluster, agentgateway OSS and a GitHub token. One gotcha is worth noting: by default the gRPC call to the policy server waits forever, so the author adds a 5s request timeout alongside failureMode: FailClosed.

The official MCP docs list guardrails (ExtMCP) next to simpler CEL-based authorization, which controls which tools a client can reach. An independent DZone walkthrough runs the agentgateway binary from YAML config with an ExtMCP guardrail that blocks poisoned tool calls. The Kubernetes tutorial itself doesn't confirm a non-Kubernetes ExtMCP setup.

Several things remain unclear:

Inference Gateway documents a comparable approach with tool-argument and tool-output guardrail phases.

Sources