Why MCP Breaks Standard HTTP Routing

▶ Watch (0:19)

MCP is a protocol that lets agents access external tools. In a Linkerd installation, every pod runs a Linkerd proxy. An agent sends MCP requests to its local proxy, which must route those requests to the right MCP server proxy to reach the target tool. That routing chain sounds simple, but MCP’s stateful session model makes it anything but. Once a session starts with a specific MCP server, all subsequent requests in that session must go to the same server. Sending a second request to a different server is an error.

The HTTP 200 Observability Trap

▶ Watch (1:13)

MCP runs JSON-RPC inside HTTP. The HTTP headers look normal, but the information that matters for routing and observability lives in the body. A tool failure does not produce an HTTP error status. The response still returns HTTP 200. An infrastructure layer doing only HTTP-level observability will report everything is fine while a tool fails 100% of the time. Catching failures requires reading the body, not the headers. This makes payload processing mandatory for any mesh that wants to give operators accurate data about MCP traffic.

The Payload Parsing Problem

▶ Watch (2:43)

JSON has no required field ordering. In MCP bodies, the method field can appear at the end, after a large block of content. A proxy must read past all preceding content before it finds the fields needed to make routing decisions. Bodies can also be short and complete, or they can arrive partially and then stop. Linkerd had to answer how long to wait for a stalled body before abandoning the request. Flynn noted this is complicated further by Linkerd’s architecture, which treats every connection as a stream rather than an atomic request.

What Linkerd Shipped to Support MCP

▶ Watch (3:56)

Linkerd added JSON-RPC payload parsing, which required solving the degenerate-body timeout questions described above. On top of that, it added stateful routing so MCP sessions stick to the same server rather than load-balancing across multiple instances. Finally, Linkerd gained per-tool routing and per-tool authentication. Flynn gave a direct example: a policy could allow a specific user access to a word-summary tool while blocking access to a Bitcoin mining service. All of this is exposed through a new Kubernetes resource called MCPRoute.

Notable Quotes

an infrastructure system that’s only doing HTTP observability will tell you everything is great even though your tool is failing 100% of the time. Flynn · ▶ 02:23

In other words, as soon as you do MCP, you must do payload processing. Flynn · ▶ 02:31

you can say things like Flynn gets to go and use the I don’t know word summary thing but not the Bitcoin mining service. Flynn · ▶ 04:28

Key Takeaways

  • MCP sessions are stateful, so proxies must pin each session to one server.
  • Tool errors return HTTP 200, making body inspection mandatory for accurate observability.
  • Linkerd ships a new MCPRoute resource supporting per-tool routing and authentication policies.

About the Speaker(s)

Flynn is a technical evangelist at Buoyant, educating developers about Linkerd, Kubernetes, and cloud-native development. He has spent 40+ years in software, with a common thread of communications and security throughout, and is a coauthor of Linkerd: Up and Running.