Kuadrant MCP Gateway 0.9 makes tool calls auditable inside the router

Kuadrant’s MCP Gateway 0.9 moves observability closer to the decisions an MCP router actually makes. The Aug. 14 release records each tools/call request with the user, tool, upstream server, response status and request or session identifiers, while continuing work on the project’s emerging stateless protocol support.

What changed

The router now emits a structured INFO log entry marked audit=true for every tool call. When a JWT subject is available, the entry attributes the call to that user; it also names the selected tool and MCP server. Rejected calls are logged as well, including failures during session initialization or requests for unknown servers.

That placement matters. A service-mesh proxy can record the HTTP path, status, latency and authenticated peer, but the MCP method and tool name live in the JSON-RPC payload or protocol headers. The gateway router already parses that information to make routing decisions, so version 0.9 can produce an MCP-level audit trail without depending on a custom Istio telemetry provider.

The release also streams request bodies for the developing 2026 stateless protocol path instead of buffering each body in full. Kuadrant restructured routing around protocol-specific handlers and added public or private cache-scope metadata to tool and prompt responses. The project describes this protocol support as alpha and the gateway itself as a tech preview.

Who it affects

Platform teams evaluating a shared MCP gateway gain a clearer answer to a basic governance question: which authenticated identity called which tool on which server, and whether the request succeeded. The record is generated where the gateway resolves the tool call, rather than inferred later from transport logs.

Operators also get smaller production-readiness improvements: graceful SIGTERM handling for in-flight work, validation that caCertBundleRef contains CA certificates, uniqueness checks for registration prefixes, ppc64le images and GitHub Actions pinned to commit SHAs.

What to do

Treat 0.9 as an evaluation release, not a finished control plane. Test whether its audit fields map cleanly into the organization’s log retention and incident-response workflows, and verify how rejected calls appear alongside accepted ones. Teams experimenting with stateless protocol clients should test streaming separately because that path remains alpha.

The roadmap is also worth separating from shipped behavior. Resource federation is incomplete, a NeMo Guardrails integration exists as a design rather than an implementation, and deployment under the Kuadrant umbrella operator is still being assembled. The useful advance today is narrower but concrete: tool-aware audit evidence is now emitted by the router that made the decision.