Absorb behind Kong
Kong authenticates the caller and shapes traffic. Absorb decides which operations exist for the agent behind it. The release ships a declarative, DB-less Kong configuration that routes agent traffic to Absorb with the methods, timeouts and headers MCP depends on.
What the configuration contains
Shipped as deploy/gateways/kong.yml: one service and three routes. Each route strips the /agent prefix and preserves the host.
| Route | Paths | Methods | Why |
|---|---|---|---|
absorb-mcp | /agent/mcp | POST, DELETE | DELETE is how MCP clients end a session, and most gateway configurations leave it out |
absorb-sse | /agent/sse, /agent/messages | GET, POST | The legacy transport is a pair: one stream and one post-back |
absorb-admin | /agent/admin, /agent/integrations | All | The dashboard and the Slack approval callback |
Timeouts, plugins and load balancing
- The service sets a 5 second connect timeout and 900 second read and write timeouts, which keeps held approvals and SSE streams open.
- A request size limit of 4 MB.
- Local rate limiting at 600 requests per minute.
- A correlation ID on
X-Request-Id. - An upstream block with two Absorb targets for load balancing.
Where Kong stops and Absorb starts
| Kong | Absorb | |
|---|---|---|
| Caller | Authenticates the caller at the edge | Establishes which agent is calling, through its own tokens or OIDC |
| Traffic | Rate limits and request size | A response size cap per tool |
| Operations | Routes agent traffic to Absorb | Decides which operations exist for the agent, from the policy |
| Responses | Returns what Absorb sends | Returns only the fields the policy lists |
Requirements every gateway must meet
These are what actually break integrations. The shipped configurations for Kong, Apigee and MuleSoft meet all six.
| Requirement | Consequence if missed |
|---|---|
Pass Authorization through unchanged | Agents cannot authenticate |
Pass Mcp-Session-Id both ways | Sessions break after initialize |
No buffering on /sse | The agent hangs waiting for the stream |
| Read timeout above the approval wait | Held calls time out at the gateway |
Allow DELETE on the MCP path | Clients cannot end sessions |
| Preserve the path after the stripped prefix | Requests hit the wrong route, unless --path is set to match |
Other integrations
Absorb behind Apigee
A proxy bundle with response streaming enabled, so server-sent events are not buffered.
Absorb behind MuleSoft
A Mule 4 flow that passes Absorb error bodies through instead of converting them to exceptions.
Absorb vs API gateways
Forwarding the requests you receive, against determining which operations exist for an agent.
Compile your own API and assess the result
Send a specification. We will show the tools it produces, the operations it withholds, and the document your security function would review.