live wire
▸SUPPLY CHAIN · Red Hat maps an agentic remediation loop for failed OpenShift pipelinesRed Hat▸vLLM adds day-zero Reflection Beam serving with agent-driven kernel optimizationvLLM▸vLLM maps Reflection Beam serving across H100, H200 and Blackwell GPUsvLLM Recipes▸vLLM-Omni adds MOSS-Image serving recipe for multilingual text and JSON layoutsvLLM Recipes▸AI · vLLM-Omni adds a verified single-GPU serving recipe for Fish Audio Drama 3vLLM Recipes▸AI · vLLM adds a verified MI355X serving recipe for Ling 3.1 FlashvLLM Recipes▸DEVELOPER HUB · Red Hat maps production fixes for air-gapped OpenShift Dev SpacesRed Hat Developer▸AI · Red Hat makes its OpenShift MCP gateway generally available in Connectivity Link 1.5Red Hat▸SECURITY: Podman sandbox-bypass CVE can ignore requested restrictions (Sep. 29)Red Hat Product Security▸PLATFORM · Red Hat Summit 2027 opens call for proposals through Nov. 30Red Hat▸AI · vLLM adds verified Step-5 Preview recipes for H200, B300 and GB300vLLM Recipes▸INTEGRATION · Camel 4.23 adds semantic routing, policy components and MCP stdioApache Camel▸AI · vLLM-Omni adds a day-zero serving recipe for FLUX 3 Image KleinvLLM Recipes▸INTEGRATION · Camel 4.18 for Quarkus 3.33.4.GA fixes 24 CVEs, including auth bypasses and request smugglingRed Hat Product Errata▸SUPPLY CHAIN · Red Hat maps an agentic remediation loop for failed OpenShift pipelinesRed Hat▸vLLM adds day-zero Reflection Beam serving with agent-driven kernel optimizationvLLM▸vLLM maps Reflection Beam serving across H100, H200 and Blackwell GPUsvLLM Recipes▸vLLM-Omni adds MOSS-Image serving recipe for multilingual text and JSON layoutsvLLM Recipes▸AI · vLLM-Omni adds a verified single-GPU serving recipe for Fish Audio Drama 3vLLM Recipes▸AI · vLLM adds a verified MI355X serving recipe for Ling 3.1 FlashvLLM Recipes▸DEVELOPER HUB · Red Hat maps production fixes for air-gapped OpenShift Dev SpacesRed Hat Developer▸AI · Red Hat makes its OpenShift MCP gateway generally available in Connectivity Link 1.5Red Hat▸SECURITY: Podman sandbox-bypass CVE can ignore requested restrictions (Sep. 29)Red Hat Product Security▸PLATFORM · Red Hat Summit 2027 opens call for proposals through Nov. 30Red Hat▸AI · vLLM adds verified Step-5 Preview recipes for H200, B300 and GB300vLLM Recipes▸INTEGRATION · Camel 4.23 adds semantic routing, policy components and MCP stdioApache Camel▸AI · vLLM-Omni adds a day-zero serving recipe for FLUX 3 Image KleinvLLM Recipes▸INTEGRATION · Camel 4.18 for Quarkus 3.33.4.GA fixes 24 CVEs, including auth bypasses and request smugglingRed Hat Product Errata
upstreambeat.ai
newsAI

Red Hat puts its OpenShift MCP gateway into production support

Connectivity Link 1.5 adds tenant isolation, protocol negotiation, progressive tool discovery, audit telemetry and NeMo guardrails for agent tool traffic.

OpenShift MCP gateway comparison with isolated, negotiated, and guarded tool traffic.
Side by side: what changed
By The News Desk· Oct 16, 2026the quick take — two AI hosts go live when you do

Red Hat has made its Model Context Protocol gateway generally available in Red Hat Connectivity Link 1.5, moving the OpenShift component beyond technology preview. The release brings MCP traffic into Red Hat’s supported API-management layer and adds controls aimed at operating agent tools across teams rather than connecting a single client to a single server.

Isolation starts at the gateway

Connectivity Link can isolate tenants with separate gateway instances, including independent router and broker components, or share the core gateway while separating listeners and downstream MCP components. The second model allows paths such as /mcp-team-a and /mcp-team-b behind one gateway endpoint while retaining separation after routing.

The gateway now federates prompts alongside tools. Operators can authorize prompts through an allowed-capabilities JWT claim and scope them on an MCPVirtualServer. Resource federation covers resources/list and resources/read for prefixed ui:// resources, with the same authorization filtering applied to data presented to agents.

Red Hat also carries upstream progressive tool discovery into the product. Instead of putting every tool schema into one large tools/list response, agents can call discover_tools for lightweight metadata and then select_tools to choose a working set. The gateway emits notifications/tools/list_changed so the client refreshes its available tools. That capability currently requires a stateful session.

New and old MCP clients can share an endpoint

The GA gateway supports the stateless HTTP transport in MCP protocol version 2026-07-28 while retaining the 2025-11-25, 2025-06-18 and 2025-03-26 versions. Clients negotiate on /mcp; operators can force the older stateful route through /mcp/stateful. That gives platform teams a migration path for existing servers while allowing horizontally scaled or serverless workloads to use the stateless protocol.

For auditability, valid tools/call requests now generate structured log records containing the caller identity when available, tool and server names, response status, request ID and session ID. Rejections at the router are logged as well. Five Prometheus metrics cover discovery attempts and duration, discovered-tool counts, upstream connection failures and tools/list response sizes.

Guardrails sit around execution

The gateway integrates with NVIDIA NeMo Guardrails to inspect both tool-call requests before backend execution and responses before they return to clients. Operators can set policies globally and add server-specific checks through Kubernetes Secrets referenced by MCPGatewayExtension and MCPServerRegistration resources. This content screening is separate from authentication and authorization, and its deployment requires a separately installed NeMo service.

Connectivity Link 1.5 also includes a developer-preview OpenShift console plug-in for creating gateways, registering servers and inspecting tools and prompts. The plug-in is not itself GA: Red Hat labels the user interface as developer preview even though the gateway data plane is generally available.

The result is a supported control point for MCP on OpenShift, but not a claim that every surrounding component has reached the same maturity. Teams evaluating the release should distinguish the GA gateway and protocol features from the preview console experience and the external guardrail service it can call.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk