Absorb behind MuleSoft
MuleSoft handles the caller and the network. Absorb decides which operations exist for the agent behind it. The release ships a Mule 4 flow that forwards agent traffic to Absorb and passes its responses back unchanged.
What the flow contains
Shipped as deploy/gateways/mulesoft-proxy.xml.
| Element | Setting |
|---|---|
| HTTP listener | /agent/* |
| Request configuration | A 900 second response timeout |
| Forward | Passes headers and query parameters through, strips the /agent/ prefix from the path, and sets sendCorrelationId="ALWAYS" |
| Success status validator | Accepts 100 to 599 |
Why the status validator matters
Most Mule proxies convert any response outside 2xx into an exception. That hides the policy denial an agent needs to see in order to correct its call. The success validator accepts 100 to 599, so Absorb's own error bodies reach the agent unchanged instead of being turned into Mule errors.
Requirements every gateway must meet
These are what actually break integrations. The shipped configurations for Kong, Apigee and MuleSoft meet all six.
| Requirement | Consequence if missed |
|---|---|
Pass Authorization through unchanged | Agents cannot authenticate |
Pass Mcp-Session-Id both ways | Sessions break after initialize |
No buffering on /sse | The agent hangs waiting for the stream |
| Read timeout above the approval wait | Held calls time out at the gateway |
Allow DELETE on the MCP path | Clients cannot end sessions |
| Preserve the path after the stripped prefix | Requests hit the wrong route, unless --path is set to match |
Other integrations
Absorb behind Kong
A declarative, DB-less configuration with three routes, 900 second timeouts, rate limiting and a correlation ID.
Absorb behind Apigee
A proxy bundle with response streaming enabled, so server-sent events are not buffered.
Absorb vs API gateways
Forwarding the requests you receive, against determining which operations exist for an agent.
Compile your own API and assess the result
Send a specification. We will show the tools it produces, the operations it withholds, and the document your security function would review.