Stéphane Tailland
92f0a272a5
- Two audience scopes per MCP server, not one: Kong's own openid-connect
plugin re-exchanges the token, so it must also name
kong-token-exchange-broker. Measured on catalog.
- Drop the resolved Konnect-not-persisting blocker; the cause was a dead
Konnect org, not Konnect refusing writes.
- Drop the resolved kong-token-exchange-broker secret mismatch; its
client_credentials returns 200.
- Record the real blocker: PydanticAI's MCP client cannot open a session
against ai-mcp-proxy.
- Document the realm's override-on-start import and ${KC_SECRET_*}
placeholders, and the a2a-sdk 1.x serving requirements.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>