Red Hat makes its MCP gateway for OpenShift generally available

What is new in the GA release

Red Hat says it added gateway isolation, stateless session support, prompts and resources support, MCP guardrails and security hardening to make the gateway ready for production. The company describes the release as an expansion of its enterprise AgentOps capabilities.

Isolation can be set up in two ways. Teams can delegate a completely separate gateway instance, including the MCP gateway components (the router and broker), which keeps traffic apart all the way to the back-end MCP server. Alternatively, a shared gateway provides isolation from the listener level down, with separate MCP gateway components used after routing. In that setup, different sets of MCP servers can sit behind a single gateway with endpoints such as /mcp-team-a and /mcp-team-b.

The gateway now also federates MCP prompts from upstream servers alongside tools. Prompts are prefixed the same way as tools and are reachable through prompts/list and prompts/get. Authorization filtering for prompts uses the allowed-capabilities JWT claim, and a virtual server can scope prompts with the spec.prompts field on the MCPVirtualServer resource. Resource federation covers resources/list and resources/read for prefixed ui:// resources, primarily on the stateful path, and these can be filtered by authorization rules too.

Tool discovery and the 2026 protocol version

As the number of tools behind a gateway grows, Red Hat says returning everything in one tools/list response becomes impractical and degrades LLM context efficiency. Progressive tool discovery, first added in the upstream project, is now available in Red Hat Connectivity Link. It uses two built-in meta-tools. First, discover_tools returns lightweight metadata such as server names, categories, hints and tool names without schemas. Then select_tools scopes the stateful session to a working set of tools and sends a notifications/tools/list_changed event so the agent refreshes its view. Because it relies on sessions and state, it works only with the stateful protocol version for now. Operators can add category and hint fields to MCPServerRegistration resources to make servers discoverable.

The MCP specification has published a new protocol version, 2026-07-28, which introduces a stateless HTTP transport. Red Hat says this enables serverless and horizontally scalable AI agent workloads on OpenShift. The gateway supports the earlier versions (2025-11-25, 2025-06-18, 2025-03-26) and the new one at the same time on a single endpoint. Clients negotiate the version, and the gateway routes accordingly, so older MCP servers can keep exposing tools alongside newer stateless ones. The /mcp path auto-negotiates, while /mcp/stateful forces the older protocol.

Auditing, metrics and guardrails

The router now emits a structured audit log entry for valid tools/call requests. Each entry is logged at INFO level with audit=true and includes the calling user (the JWT sub claim) if available, the tool and server names, the response status, and request and session identifiers. Entries are written both when a call reaches the backend and when the router rejects it early, for example after a session init failure or an unknown server. Red Hat says this complements the OpenTelemetry and MLflow integrations in Red Hat AI for end-to-end agentic tracing.

The broker exposes Prometheus metrics on a dedicated scrape endpoint, 9090 by default. Five new metrics cover upstream discovery health, tool inventory, connection stability and response sizes:

• mcp_broker_discovery_total: discovery attempts per upstream server
• mcp_broker_discovery_duration_seconds: duration of discovery calls
• mcp_broker_tools_discovered: current tool count per server
• mcp_broker_upstream_connection_failures_total: connection failures per server
• mcp_broker_tools_list_response_bytes: size of the tools/list response per server

All metrics use server_name as the primary label to avoid cardinality explosion.

The gateway also integrates natively with NeMo guardrails, the default guardrail service across Red Hat AI. It checks tools/call request and response bodies and enforces active safety policies. Requests are verified before the proxy sends them to an MCP backend, and responses are screened before returning to the client, which Red Hat says helps prevent prompt injection attacks and sensitive data exfiltration. This works independently of authentication or authorization. Users must install NeMo and configure the endpoint. Config IDs can apply to all gateway traffic, and additional IDs can be set per MCP server, where they are additive. The configuration is a Secret referenced by annotations on the MCPGatewayExtension and MCPServerRegistration resources.

Console plug-in and what it means for teams

Connectivity Link 1.5 also introduces an MCP gateway console plug-in, which is in developer preview. Teams can create, configure and visualize MCP gateways and servers, and test server capabilities from the OpenShift Console. Step-by-step workflows cover setting up gateways and registering servers, and an overview page shows the status and health of gateways and registered servers.

A built-in MCP inspector lets users connect to a gateway as a client would, including configuring an authentication header. Tools and prompts can be listed, individual prompts read in detail, and individual tools and the calls made to them inspected.

For organizations running agents on OpenShift, the release gives platform teams a supported way to separate tenants, filter what agents can see, audit tool calls and apply safety checks at the gateway. Support for both protocol generations on one endpoint lets them adopt the stateless version without retiring existing MCP servers.