Back in June I wrote that Kong Konnect has two front doors and neither one is the one I want. There was the platform admin API behind a personal access token, and there was the Dev Portal that actually hands out credentials, and what there was not was a single door an agent could walk up to, authenticate through, and leave with something it could use. In September I added a correction from Kong’s engineering side that the Portal API reference was public and complete, and I noted the one thing that still held: a human could read that contract in a browser, but an agent could not fetch it, because the spec rendered client-side and no raw URL answered. Kong said per-portal MCP servers were coming. Today they shipped.
Kong Introduces the Portal MCP Server for Developer Portal went out this morning under the names of Amit Shah, Jason Harmon, and Nathanael Shermett, and Jason, who runs product management at Kong, wrote to me separately to say the June post had been heard, that the connect-an-agent side of the story was the piece they set out to address first, and that more is on the way on unifying the journey. I am writing this follow-up because that is exactly how this is supposed to work. I put a specific gap on the record, the vendor closed it, and the record should say so as plainly as it said the other thing.
What shipped is a dedicated MCP server for every Dev Portal, turned on with a single toggle once a portal has opted into AI features, that lets an agent discover and read that portal’s pages and API specifications instead of scraping HTML built for eyeballs. The access model is the one that matters: “An anonymous agent sees exactly what an anonymous developer would see. An authenticated agent is bound to the same role-based permissions as the human it’s acting on behalf of.” Kong’s own line for it is that “this isn’t a new access model bolted onto Dev Portal, it’s the same governance you already trust, extended to a new kind of consumer.” Alongside it, portals get OAuth 2.0 connections: an Authorization Code flow with PKCE, endpoints discovered automatically, a developer who logs in and consents once, and an administrator who decides who gets in through trusted clients, an allow-list of dynamic client registration redirect URLs, or both. The release also recaps three things that had already landed this year: any portal page fetchable as Markdown with an Accept: text/markdown header or a .md suffix, the Konnect MCP server now able to create, edit, and publish portal pages under PAT and SPAT permissions, and the Dev Portal Toolkit going generally available as a VS Code extension.
I went and checked the part I had complained about. Kong’s own developer site answers Accept: text/markdown with text/markdown on the home page, the Dev Portal docs, and the Portal API reference, and the .md suffix works on all of them. The Markdown version of the Portal API reference is 224 kilobytes because it embeds the entire OpenAPI 3.0.3 document, Portal API version 3.4.0, 48 paths, with an x-oas-source line pointing at the commit in Kong’s platform-api repository it was cut from. That is the raw spec an agent could not fetch on September 7, addressable at a URL an agent can guess, on September 24. While I had it open I checked it against the script I published in June, where I had marked several Dev Portal paths with a note to verify. The applications path, the credentials path, and the registrations path are all in the contract exactly as the script guessed them. The one miss is the login: the script posts to a basic sub-path under authenticate, and the contract has plain /api/v3/developer/authenticate plus an SSO variant. I owe the script that fix, and I now have a machine-readable contract to make it against.
Here is what it does to the argument. The June post said the gap was the bootstrap: everything after the first token could be automated, but the first token was still a human clicking through a console. OAuth 2.0 connections with PKCE and automatic endpoint discovery is the SoundCloud shape I held everyone up against, a browser pops, a person consents once, and the agent walks away with a token it can use without anyone pasting anything. What that token buys today is discovery and reading, the pages and the specs, plus code generated to call them. Whether the same connection can carry an agent through the next step, registering an application and minting the API credentials the Portal API clearly knows how to issue, is the question the “unifying the journey” line is pointed at, and I will take Kong at their word that it is next rather than pretend the release already says so. Two doors are still two doors. What is new is that one of them now opens for a machine.
The catalog view, for the record. Kong scores 62.0 on the Kin Score, strong band, carried by access clarity at 78.9 and contract quality at 65.9, with 139 API pages under the provider. Its Agent Readiness score is 33.2, agent-ready, with the MCP server, error semantics, reversibility, and OpenAPI examples all lit. The dimensions that are unlit are delegated identity, protected resource metadata, dynamic client registration, and consent identity, which is precisely the set a Konnect Dev Portal lights up the moment an administrator flips this toggle and publishes the OAuth metadata. Those are measured against Kong’s public surface, and Kong’s own docs site does not yet answer at the protected-resource well-known path, so the catalog will say what it says until a probe finds the door. When it does, this is the release that will have moved the number.
I do not write these posts to be right about vendors. I write them so the gap is specific enough that someone can close it, and Kong closed the one I could point at in under three months, with a product that respects the governance the portal already had instead of inventing a side entrance. What I would ask for next is the same thing I asked for in June, one door: let the connection that reads the spec also register the application and hand back the credential, and publish that door’s metadata at the well-known path so an agent finds it without being told where to look. Kong says that is where they are headed. The June post is what it looked like before. This one is the receipt.
