diff --git a/envoy/config/filter/network/mysql_proxy/v1alpha1/BUILD b/envoy/config/filter/network/mysql_proxy/v1alpha1/BUILD
new file mode 100644
index 00000000..7c6eef81
--- /dev/null
+++ b/envoy/config/filter/network/mysql_proxy/v1alpha1/BUILD
@@ -0,0 +1,8 @@
+load("//bazel:api_build_system.bzl", "api_proto_library_internal")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_library_internal(
+    name = "mysql_proxy",
+    srcs = ["mysql_proxy.proto"],
+)
diff --git a/envoy/config/filter/network/mysql_proxy/v1alpha1/mysql_proxy.proto b/envoy/config/filter/network/mysql_proxy/v1alpha1/mysql_proxy.proto
new file mode 100644
index 00000000..b43c176d
--- /dev/null
+++ b/envoy/config/filter/network/mysql_proxy/v1alpha1/mysql_proxy.proto
@@ -0,0 +1,20 @@
+syntax = "proto3";
+
+package envoy.config.filter.network.mysql_proxy.v1alpha1;
+option java_package = "io.envoyproxy.envoy.config.filter.network.mysql_proxy.v1alpha1";
+option java_multiple_files = true;
+option go_package = "v1alpha1";
+
+import "validate/validate.proto";
+
+// [#protodoc-title: MySQL proxy]
+// MySQL Proxy :ref:`configuration overview <config_network_filters_mysql_proxy>`.
+message MySQLProxy {
+  // The human readable prefix to use when emitting :ref:`statistics
+  // <config_network_filters_mysql_proxy_stats>`.
+  string stat_prefix = 1 [(validate.rules).string.min_bytes = 1];
+
+  // [#not-implemented-hide:] The optional path to use for writing MySQL access logs.
+  // If the access log field is empty, access logs will not be written.
+  string access_log = 2;
+}