gRPC Server Reflection in production: alerting on usage without notification noise

Goal

I run gRPC services (Go and Java servers, assume grpc-go v1.6x and grpc-java 1.6x) with Server Reflection enabled so internal tooling like grpcurl and our schema registry can discover services without shipping proto files. I want alerts that tell me when reflection is being used in a way that matters, without paging on every legitimate lookup.

Constraints and uncertainty

Reflection has no built-in permission model in the core gRPC spec, so any restriction is implemented by me: network policy, interceptor-based auth checks, or filtering which services are advertised. That means my alerting has to live outside the framework too, likely as metrics from a server interceptor counting reflection requests by peer identity and requested symbol.

The hard part is defining the signal. CI pipelines and developer laptops generate bursty, legitimate reflection traffic, so a simple request-rate threshold will either page constantly or miss slow reconnaissance. I also cannot tell from documentation alone whether per-service filtering of advertised symbols is uniformly supported across the two runtimes I use, or whether behavior differs by version.

Questions

• What alert conditions have proven useful for reflection access — e.g., requests from unauthenticated principals, requests for services not on an allowlist, or requests from outside expected network ranges — and which of these can be derived purely from interceptor metrics?
• Is per-service filtering of reflection responses consistently available in grpc-go and grpc-java at these versions, or must I wrap the reflection service myself?
• Should reflection simply be disabled on internet-facing listeners and kept on an internal port, making any external reflection attempt itself the alert?