[github-actions]

agentgateway/agentgateway#4044 — CEL: Expose outbound calls as upstreamCalls

Docs versions: standalone/main, kubernetes/main

No code-path rule covers 4 touched file(s). The planner could route these only by identifier search, so the candidate pages may miss what they changed, including in the other mode:

• crates/agentgateway/src/proxy/httpproxy.rs
• crates/agentgateway/src/telemetry/mod.rs
• crates/agentgateway/src/telemetry/upstream.rs
• crates/core/src/metrics.rs

What changes for users: Access log CEL expressions can read upstreamCalls to inspect outbound HTTP calls that a request made, including MCP target calls and policy callouts after backend authentication or token exchange. The variable is populated only when an access log expression references it, and stdio MCP targets do not add entries.

What the docs now say: The standalone and Kubernetes CEL variables pages list upstreamCalls for logging expressions, and the CEL examples pages show how to log MCP token audiences and outbound call statuses from access logs.

Not verified: No cluster, local gateway, or Hugo run; the configuration is unrun.

How agentgateway-4044 was drafted, and what was not verified

• Code PR: CEL: Expose outbound calls as upstreamCalls agentgateway#4044
• Code issue: none linked
• Product: agentgateway (upstream) -> agentgateway/website
• Docs version: standalone/main and kubernetes/main
• Category: new-feature / pr

Plan, and what changed it

• Planned: Choose the specific target pages for the new upstreamCalls CEL access-log surface from the new-feature candidate list.
• Learned: schema/cel.md and the generated main CEL reference already list the full field shape, so the missing docs were mode-specific availability and a copyable access-log expression.
• Did: Documented upstreamCalls on the standalone and Kubernetes CEL variables and examples pages.

Why a documentation change is necessary

The pull request adds the upstreamCalls CEL variable for access log expressions, and the generated reference lists its nested fields. No existing prose page mentioned upstreamCalls, so readers had no example that showed where the variable is available or how to use it to inspect MCP target calls after backend authentication or token exchange. The CEL reference pages are the specific pages for expression availability and examples in both deployment modes.

Rejected candidates: the MCP guide pages cover connectivity, authentication, authorization, guardrails, and client setup rather than access-log expression variables; the metrics and traces pages cover Prometheus and trace attributes rather than CEL access logs; the access-log export pages cover OTLP delivery rather than expression syntax; the Kubernetes setup customization and backend tunnel pages cover unrelated configuration areas. The generated CEL context reference already carries the field reference, so no generated file was edited.

What changed on disk

• content/docs/standalone/main/reference/cel/variables.md: Added upstreamCalls to the logging row and clarified that tracing and metrics do not get that variable.
• content/docs/standalone/main/reference/cel/yaml-and-examples.md: Added a standalone frontendPolicies.accessLog.add example for MCP token audiences and outbound call statuses.
• content/docs/kubernetes/main/reference/cel/variables.md: Added upstreamCalls to the logging row.
• content/docs/kubernetes/main/reference/cel/yaml-and-examples.md: Added a Kubernetes spec.frontend.accessLog.add example for MCP token audiences and outbound call statuses.

How to verify this change

1. In standalone mode, add the frontendPolicies.accessLog.add example from content/docs/standalone/main/reference/cel/yaml-and-examples.md to a working MCP HTTP target configuration that uses backend authentication or token exchange, and run agentgateway -f config.yaml.
2. Send an MCP tools/call request through the gateway. The stdout access log includes mcp_token_audiences and upstream_call_statuses, with an entry whose subtype is Mcp, whose target is the MCP target name, and whose status is the upstream HTTP response code.
3. In Kubernetes mode, add the spec.frontend.accessLog.add example from content/docs/kubernetes/main/reference/cel/yaml-and-examples.md to the AgentgatewayPolicy that targets the Gateway, send the same request, and check the proxy pod logs for the same custom fields. The generated CEL reference for main lists the nested fields used by the examples, including upstreamCalls.request.headers, upstreamCalls.response.code, upstreamCalls.response.grpcStatus, upstreamCalls.duration, and upstreamCalls.error.

What was not verified

• The standalone configuration was not run locally.
• The Kubernetes configuration was not applied or dry-run against a cluster; the configuration is unrun.
• Internal links are unchecked because Hugo was not run.
• No Vale pass was run; the target repository has no Vale configuration, and this repository's house style does not apply to it.
• Counterpart sections not drafted: the kgateway analogs for deployment customization, control plane metrics, and data plane metrics were not used because they do not cover CEL access-log variables or outbound-call logging.

Validation of the added standalone configuration

0 of 1 added config file(s) passed --validate-only (latest with cr.agentgateway.dev/agentgateway:latest, main with cr.agentgateway.dev/agentgateway:latest-dev).
Validation checks field names and types only. Commands, runtime behavior, and field paths written in prose are unverified.

Rejected:

• content/docs/standalone/main/reference/cel/yaml-and-examples.md:94 — Run 'docker run --help' for more information

How the pages were chosen (triage report)

Feature clusters

Kept apart on purpose. Merging wrongly produces a guide that documents two things and explains neither, so these are reported for a person to merge rather than grouped automatically:

• CEL: Expose outbound calls as upstreamCalls agentgateway#4044, llm: add reasoning_effort into CEL context agentgateway#4186, llm: expose request context to response CEL on streaming responses agentgateway#4241, ext_proc: keep CEL executor out of request future agentgateway#4246 all mention "CEL" in the title and are in different clusters; check whether they are one feature

New configuration: no page mentions it yet

agentgateway/agentgateway#4044 — CEL: Expose outbound calls as upstreamCalls

• Product: agentgateway (upstream) → agentgateway/website
• Docs version: standalone/main, kubernetes/main
• Summary (read from the body): Today the MCP access logs can't see the credential sent to each target after backend authentication or token exchange. Notes:
• Not tested: no cluster was available, so every command in this diff is unrun
• No rule covers 4 touched file(s). The candidate pages below come from the files that DID match a rule, so they may scope this narrower than the change is. Read these before deciding the change is only about the pages listed:
  • crates/agentgateway/src/proxy/httpproxy.rs
  • crates/agentgateway/src/telemetry/mod.rs
  • crates/agentgateway/src/telemetry/upstream.rs
  • crates/core/src/metrics.rs

Release notes

This pull request also adds its release-note entries:

• content/docs/kubernetes/main/release-notes/release-notes.md: Access logs can inspect outbound upstream calls (feature, in a new 1.8 section)
• content/docs/standalone/main/release-notes/release-notes.md: Access logs can inspect outbound upstream calls (feature, in a new 1.8 section)

Draft branch: pr-tracker-draft-agentgateway-4044

[cloudflare-workers-and-pages]

Deploying agentproxy with    Cloudflare Pages

Latest commit:	af72490
Status:	⚡️  Build in progress...

View logs

[kristin-kronstain-brown]

Moved this PR's release-notes entry to the combined release-notes PR, #1482, so the draft PRs stop conflicting on the release-notes pages. Review or change the entry there.