From 1d8922e1b560eeadd9aeb1f8a6535c45a317ce9d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Tailland?= <stephane@sttlab.eu>
Date: Sun, 23 Aug 2026 15:25:47 +0200
Subject: [PATCH] Fix customers-mcp GET/SSE stream 502 loop: bind ai-mcp-proxy
 to the stream route too
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The stream route (GET, mcp/routes.yaml) had no ai-mcp-proxy binding,
so GET requests fell through to the KongService's own upstream
target (REST_HOSTNAME, i.e. Kong's own external hostname) and
looped back into the Gateway, growing response headers each pass
until nginx rejected them (502, "upstream sent too big header").
Confirmed via customers dataplane pod logs while debugging a
LibreChat connection failure. catalog-mcp has the same structural
gap but happens to 405 instead of looping there — not touched here.
---
 kong/mcp/pluginbindings.yaml | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/kong/mcp/pluginbindings.yaml b/kong/mcp/pluginbindings.yaml
index 0fa96a4..9177773 100644
--- a/kong/mcp/pluginbindings.yaml
+++ b/kong/mcp/pluginbindings.yaml
@@ -34,6 +34,37 @@ spec:
       kind: KongRoute
       name: ${NAME}-customers-mcp
 ---
+# Also bind to the GET/-stream route, not just the POST/DELETE one above.
+# Without this, GET requests never reach ai-mcp-proxy at all and fall
+# through to the KongService's own upstream target — which is
+# ${REST_HOSTNAME} (Kong's own external hostname, mcp/service.yaml), so an
+# unintercepted GET loops back into the Gateway and grows response headers
+# on every pass until nginx rejects it ("upstream sent too big header",
+# 502) — confirmed 2026-08-23 via customers dataplane pod logs (28
+# occurrences) while debugging a LibreChat connection failure specific to
+# customers-mcp. catalog-mcp has the identical gap (checked: its
+# ai-mcp-proxy-binding also targets only the non-stream route) but happens
+# to fail as a harmless 405 there instead of looping — not fixed here,
+# flagged in STATUS.md, don't assume catalog's GET stream actually works
+# just because nothing broke loudly.
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-customers-mcp-ai-mcp-proxy-stream-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-customers-mcp-ai-mcp-proxy
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-customers-mcp-stream
+---
 apiVersion: configuration.konghq.com/v1alpha1
 kind: KongPluginBinding
 metadata: