Repository navigation
Add --openappa to install OpenAPPA guardrails at the egress gateway - #3817
Draft
Joey Orlando (joeyorlando) wants to merge 3 commits into
Draft
Joey Orlando (joeyorlando) wants to merge 3 commits into
Joey Orlando (joeyorlando) wants to merge 3 commits into
Conversation
The additional egress ext_proc filter sees request headers only, so a processor that needs request and response bodies, such as an MCP tools/call policy, cannot run there. Buffering every body would stall long-lived SSE streams. --experimental-additional-egress-extproc-allow-mode-override sets allow_mode_override with one allowed mode: response headers sent and both bodies buffered. The processor opts a request in from its request_headers response. --experimental-additional-egress-extproc-timeout sets the filter's message and gRPC timeouts, which stay at 2s by default. Both require --experimental-additional-egress-extproc-service. The defaults render the filter unchanged.
Joey Orlando (joeyorlando)
changed the title
Joey Orlando (joeyorlando)
changed the title
ext_proc read request and response bodies, for MCP policy engines such as OpenAPPA
OpenAPPA checks MCP tool calls against what an actor has already read. Running it as the egress gateway's additional ext_proc filter took a hand-built Deployment, Service and policy plus three extproc flags. --openappa deploys manifests/openappa into ate-system and sets those flags: the service to openappa:9443, mode overrides on, and a 60s timeout unless one is given. A different service, mode overrides turned off, another namespace or the agentgateway dataplane are refused. A redeploy without it removes OpenAPPA and keeps its policy ConfigMap and credentials Secret, as removeK8sCredentialProvider does. The bundled appa.toml is applied only when the cluster has no policy, so an edited one survives a redeploy. --openappa-policy replaces it on every deploy. The pod template carries the policy's digest, so a changed policy restarts the runtime.
Joey Orlando (joeyorlando)
changed the title
ext_proc read request and response bodies, for MCP policy engines such as OpenAPPA
This was referenced Nov 13, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
ate-setup deploy --openappa, which installs OpenAPPA guardrails at the egress gateway with one flag.OpenAPPA is an open-source information-flow policy engine for AI agents. It labels each agent session with who may read the data it has seen and how far that data is trusted. It then checks every tool call against those labels, so a session that read a private repository can't post to a public issue. The decisions come from declarative per-tool rules, not from a model.
Running at the egress gateway, it checks every actor's MCP tool calls, whatever harness or image the actor runs, and refuses a call before it leaves the cluster. Its labels are keyed by the actor's verified identity.
--openappadeploys OpenAPPA's runtime and ext_proc processor intoate-system, with a Service and a NetworkPolicy that admits only the egress gateway. It also points the additional egress ext_proc filter at that Service. A redeploy without the flag removes it. Options:--openappa-policy: the operator's ownappa.toml. The bundled default includes OpenAPPA's GitHub battery.--openappa-mcp-servers: the MCP hosts to check.--openappa-runtime-imageand--openappa-extproc-image: image overrides.openappa-provider-credentialsSecret.The guide is
docs/guides/openappa.md.To make this possible, the additional ext_proc filter gets two generic opt-in settings that any processor can use:
--experimental-additional-egress-extproc-allow-mode-overridelets the processor read the request and response bodies of the requests it picks, viamode_override. All other traffic stays headers-only, so long-lived SSE streams are never buffered.--experimental-additional-egress-extproc-timeoutsets the filter's timeouts.Without them the rendered filter is unchanged.
The default extproc image,
ghcr.io/archestra-ai/appa-extproc, is published starting with OpenAPPA's next release (archestra-ai/OpenAPPA#904). Its digest gets pinned once that release exists.Tested on a kind install deployed with
--openappaalone and a locally built extproc image. A stock Claude Code actor read a file from a private repository through GitHub's MCP server. OpenAPPA then refused the agent's comment on a public issue, and acurlcall from the same actor was refused the same way. Model API traffic stayed headers-only. The tests render the manifests and filter, parse the filter into the vendoredExternalProcessorproto, and cover the config validation and removal.AI use: AI-assisted, I reviewed and tested it.