Well Known Dynamic Metadata

Filters can emit dynamic metadata via the setDynamicMetadata routine in the StreamInfo interface on a Connection. This metadata emitted by a filter can be consumed by other filters and useful features can be built by stacking such filters. For example, a logging filter can consume dynamic metadata from an RBAC filter to log details about runtime shadow rule behavior. Another example is where an RBAC filter permits/restricts MySQL/MongoDB operations by looking at the operational metadata emitted by the MongoDB filter.

The following Envoy filters emit dynamic metadata that other filters can leverage.

• External Authorization Filter

• External Authorization Network Filter

• Header-To-Metadata Filter

• JWT Authentication Filter for the extracted header and payload

• Mongo Proxy Filter

• MySQL Proxy Filter

• Postgres Proxy Filter

• Role Based Access Control (RBAC) Filter

• Role Based Access Control (RBAC) Network Filter

• ZooKeeper Proxy Filter

• MCP Filter

MCP Filter Dynamic Metadata

The MCP filter emits the following dynamic metadata under the envoy.filters.http.mcp namespace when processing MCP (Model Context Protocol) JSON-RPC requests:

Name	Type	Description
method	string	The JSON-RPC method name (e.g., initialize, tools/list, tools/call).
id	number	The JSON-RPC request ID.
params	struct	The params object from the JSON-RPC request containing method-specific parameters.

This metadata is consumed internally by the MCP router filter for request routing and aggregation. It can also be used by other filters such as RBAC for policy enforcement or access logging.

The following Envoy filters can be configured to consume dynamic metadata emitted by other filters.

• External Authorization Filter via the metadata context namespaces

• RateLimit Filter limit override

• Original destination listener filter

• TLS Inspector listener filter

Shared Dynamic Metadata

Dynamic metadata that is set by multiple filters is placed in the common key namespace envoy.common. Refer to the corresponding rules when setting this metadata.

Name	Type	Description	Rules
access_log_hint	boolean	Whether access loggers should log the request.	When this metadata is already set: A true value should not be overwritten by a false value, while a false value can be overwritten by a true value.

The following Envoy filters emit shared dynamic metadata.

• Role Based Access Control (RBAC) Filter

• Role Based Access Control (RBAC) Network Filter

The following filters consume shared dynamic metadata.

• Metadata Access Log Filter