---
season: 3
season_name: "Season 3 — October 2026 (Autumn / Halloween Edition)"
day: 20
title: "Agent Gateway vs. Apigee: The Tale of Two Gateways"
summary: "Protect enterprise backends from runaway agent loops and enforce zero-trust egress by pairing Agent Gateway with Apigee."
tags: ["Phase 4: Agent Gateway", "Apigee", "Security", "Governance"]
canonical_url: "https://adventofagents.com/2026/10/20"
markdown_url: "https://adventofagents.com/2026/10/20.md"
video_url: "https://www.youtube.com/embed/ikqlZLLYrLA"
primary_video:
  title: "Day 20: Agent Gateway vs. Apigee: The Tale of Two Gateways"
  creator_name: "Christopher Duncan & Elliott Abraham"
  duration: "10:00"
  video_url: "https://www.youtube.com/embed/ikqlZLLYrLA"
---

# 🛡️ Day 20: Agent Gateway vs. Apigee: The Tale of Two Gateways

> **Season 3 — October 2026 (Autumn / Halloween Edition)** · [Interactive Web View](https://adventofagents.com/2026/10/20?utm_source=adventofagents&utm_medium=markdown&utm_campaign=adventofagents_s3_2026&utm_content=day20) · [Raw Markdown](https://adventofagents.com/2026/10/20.md?utm_source=adventofagents&utm_medium=markdown&utm_campaign=adventofagents_s3_2026&utm_content=day20)

**Summary:** Protect enterprise backends from runaway agent loops and enforce zero-trust egress by pairing Agent Gateway with Apigee.

**Day 20 of Google's Advent of Agents — Season 3 (October 2026)**

Autonomous AI agents need two distinct security boundaries: an **Egress Gateway** (Google Cloud Agent Gateway) to enforce zero-trust outbound tool reachability, and an **Ingress Gateway** (Apigee) to safeguard enterprise APIs from runaway agent loops, hallucinated bursts, and context bloat.

### Architecture Overview

![Architecture Flow](https://raw.githubusercontent.com/Bornism/advent-day20-agent-gateway-apigee/main/assets/architecture_flow.png)

### 5-Minute Agent Kata

In this hands-on exercise, you will explore defense-in-depth tool governance across both boundaries:

1. **Egress Isolation (Agent Gateway)**: Intercept outbound agent calls, enforce deny-by-default egress, check Agent Registry allowlists, and verify cryptographic SPIFFE workload identity.
2. **Ingress Protection & Payload Mediation (Apigee)**: Expose existing enterprise APIs as governed MCP tools without backend rewrites, mediate schemas to prevent LLM context bloat, and stop runaway agent execution loops with **Spike Arrest**.
3. **Defense-in-Depth Verification**: Run test discovery (`tools/list`), execute tool calls (`tools/call`), and trigger rapid execution bursts to watch Apigee cut off recursive loops with `HTTP 429`.

### Key Architecture Takeaways

- **Apigee Owns Ingress**: Fronts enterprise backends (SAP, BigQuery, Cloud Run, on-prem), terminates client connections, translates REST/SOAP to MCP JSON-RPC, and enforces rate quotas.
- **Agent Gateway Owns Egress**: Transparently intercepts outbound tool calls at the agent runtime boundary, validates SPIFFE identity, and screens prompts inline with Model Armor.
- **Complete Defense-in-Depth**: Agent Gateway controls what the agent is allowed to call; Apigee controls how enterprise tools and backends are safely consumed.

👉 To try this yourself, clone the [Day 20 Demo Repository](https://g.dev/cloud/adventofagents-season3-day20-demo) and check the **Links** tab for more reading material.

## Code & Commands

### Discover MCP Tools via Apigee

```bash
# Run in Cloud Shell or terminal against your Apigee gateway to discover exposed MCP tools:
curl -s -X POST https://${APIGEE_HOSTNAME}/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {}}' | jq .
```

### Execute Governed Tool Call

```bash
# Execute a tool call to verify that Apigee returns mediated customer data without schema bloat:
curl -s -X POST https://${APIGEE_HOSTNAME}/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": {"name": "lookup_customer_account", "arguments": {"customer_id": "CUST-9921"}}}' | jq .
```

### Runaway Loop Burst Protection (Spike Arrest)

```bash
# Simulate an autonomous agent stuck in a runaway retry loop (halts on call #3 with HTTP 429):
for i in {1..5}; do
  curl -s -o /dev/null -w "Request $i: HTTP %{http_code}\n" -X POST https://${APIGEE_HOSTNAME}/v1/mcp \
    -H "Content-Type: application/json" \
    -d '{"jsonrpc": "2.0", "id": '$i', "method": "tools/call", "params": {"name": "lookup_customer_account", "arguments": {"customer_id": "CUST-9921"}}}'
done
```

## Resources & Links

- **[GitHub Companion Demo Repository](https://g.dev/cloud/adventofagents-season3-day20-demo)** — Pre-packaged Apigee MCP Proxy starter bundle, Agent Gateway policy, and setup guide.
- **[Google Cloud Agent Gateway Documentation](https://g.dev/cloud/adventofagents-season3-agent-gateway)** — Learn how Agent Gateway enforces deny-by-default egress and SPIFFE workload identity.
- **[Apigee API Management Platform](https://g.dev/cloud/adventofagents-season3-docs-apigee)** — Enterprise API gateway for mediation, Spike Arrest, and legacy-to-MCP translation.