Absorb behind Apigee
Apigee authenticates the caller and applies traffic limits. Absorb decides which operations exist for the agent behind it. The release ships an Apigee proxy bundle with the streaming settings that server-sent events need.
What the proxy bundle contains
Shipped as deploy/gateways/apigee/apiproxy/, four files.
| File | Contents |
|---|---|
absorb.xml | The proxy manifest that ties the endpoints and policy together |
proxies/default.xml | Base path /agent, a spike arrest in the PreFlow, a named flow matching GET /sse, and one route rule to the target |
targets/default.xml | The Absorb URL with request and response streaming enabled, io.timeout.millis at 900000, and HTTP/1.0 disabled |
policies/SpikeArrest.xml | 30 requests per second, keyed on the caller's Authorization header rather than on IP |
Server-sent events through Apigee
Apigee buffers responses by default, which breaks server-sent events: the agent waits for a stream that never arrives. The target endpoint sets request.streaming.enabled and response.streaming.enabled to true so events pass through as they are written, and io.timeout.millis to 900000 so streams and held approvals stay open for 15 minutes.
Rate limits per agent
The spike arrest allows 30 requests per second and is keyed on the Authorization header rather than on IP, so the limit applies per agent credential and agents behind one network address do not share it.
Requirements every gateway must meet
These are what actually break integrations. The shipped configurations for Kong, Apigee and MuleSoft meet all six.
| Requirement | Consequence if missed |
|---|---|
Pass Authorization through unchanged | Agents cannot authenticate |
Pass Mcp-Session-Id both ways | Sessions break after initialize |
No buffering on /sse | The agent hangs waiting for the stream |
| Read timeout above the approval wait | Held calls time out at the gateway |
Allow DELETE on the MCP path | Clients cannot end sessions |
| Preserve the path after the stripped prefix | Requests hit the wrong route, unless --path is set to match |
Other integrations
Absorb behind Kong
A declarative, DB-less configuration with three routes, 900 second timeouts, rate limiting and a correlation ID.
Absorb behind MuleSoft
A Mule 4 flow that passes Absorb error bodies through instead of converting them to exceptions.
Absorb vs API gateways
Forwarding the requests you receive, against determining which operations exist for an agent.
Compile your own API and assess the result
Send a specification. We will show the tools it produces, the operations it withholds, and the document your security function would review.