FAQS
No items found.
An MCP gateway is a governance layer that sits between AI agents and the MCP servers they call, enforcing routing, authentication, access control, and observability on every request.
An MCP gateway is a governance plane that sits between AI agents and the tools they call. It enforces routing, authentication, access control, and observability for every Model Context Protocol (MCP) request. MCP is an open standard for connecting AI applications to external systems, and it works like a USB-C port for AI applications. The Model Context Protocol gateway is the traffic and management layer for an MCP deployment, in the same way an API gateway is for a set of microservices.
The sharpest distinction is between a proxy and a gateway. A plain MCP proxy only forwards traffic. It moves a request from the client to the server and returns the response without judging whether the request should have been made. An MCP gateway adds a policy layer on top of that forwarding. The gateway is an emergent architectural pattern, not a term defined in the MCP specification itself. The short version is that a proxy forwards, while a gateway forwards and governs. The same layer is also called an MCP server gateway, an agent gateway, an MCP router, or an MCP aggregator.
An MCP gateway works by sitting in the request path between an AI agent and one or more MCP servers. It enforces four things on every request: routing, authentication, authorization, and observability. Routing decides which MCP server handles the call. Authentication confirms the agent's identity. Authorization controls which agents can access which tools. Observability captures metrics and traces, so the organization can audit what each agent did.
The request flows through the gateway in a fixed sequence. First, the agent sends a self-describing request. Second, the gateway validates the protocol metadata. Third, it authenticates and authorizes the request. Fourth, it routes the request to the correct backend. Fifth, it proxies the tool or resource call. Sixth, it delivers the response. Seventh, it records the completion and observation. The gateway operates as a Layer 7 proxy, which means it inspects application-level traffic rather than just forwarding packets.
The gateway performs several concrete jobs that a plain MCP server does not. It can translate a local stdio server, a process that runs on one machine, into a Streamable HTTP endpoint reachable over the network. It injects upstream credentials, such as bearer tokens or API keys, so agents never see them directly. It enforces tool-level authorization, so one agent can call a query tool but not a delete tool. It filters tool discovery through tool slicing, which hides dangerous capabilities from the agent's context. It records audit logs of identity, operation, policy decision, status, and timing.
The authorization step is the most important nuance. The gateway acts as a policy enforcement point, the place where a policy is applied. Before a tool runs, it asks a policy decision point, the place that decides, a specific question. That question is richer than a token can answer: can this agent, acting for this user, invoke this tool with these arguments. This is the core of agent authorization, and it depends on agent identity to know who the agent is acting for. Whether the gateway makes that decision itself or delegates it to a separate policy decision point is an implementation choice. The decision must also be enforced at each hop, not just the front door. A decision made only at the gateway and trusted blindly the rest of the way is a decision made too early.
An MCP gateway matters because MCP standardizes interaction but not control. Out of the box, MCP does not define role-based access control, and there is no centralized audit layer. Without a gateway, an organization runs an ungoverned web of AI-to-system integrations with three critical gaps: no central visibility, no access control, and no audit trail. Authorization collapses to the authenticated principal that the proxy layer uses to connect.
Authentication is not authorization, and the gateway makes that distinction concrete. MCP provides an authorization framework, but organizations may need additional controls for fine-grained, contextual authorization and centralized governance. The Asana incident is the clearest example. In that incident, requests were authenticated with valid credentials, but the server did not check whether the authenticated user should see the specific resource being returned. Authentication passed. Authorization was missing. The gateway also bounds the damage from a compromised agent. Scoping an agent to a small set of tools and enforcing that scope outside the agent limits the damage by policy rather than by the agent's own behavior. This is the least privilege for AI agents applied at the gateway.
MCP standardizes how agents talk to tools. The MCP gateway standardizes how that access is governed. The gateway is where control lives, and control is the part MCP does not provide on its own.
An MCP server is an executor. It runs tool calls, owns application state when needed, and returns results. An MCP gateway is an orchestrator. It does not execute business logic; it governs access control to the backend servers.
MCP stands for Model Context Protocol. It is an open standard for connecting AI applications to external systems, and it works like a USB-C port for AI applications.
No. Authorization is optional for MCP implementations. A protected MCP server acts as an OAuth 2.1 resource server, but the specification stops at authentication and does not reach fine-grained authorization. That gap is what an MCP gateway fills.
An AI gateway knows LLM APIs and controls prompts, tokens, and model spend. An MCP gateway knows JSON-RPC MCP traffic. Neither understands the other's traffic, which means an AI gateway cannot enforce which agent runs which tool.
Most teams can spin up an agent. Few can deploy one their security team signs off on. Here's the framework that does both.
Give them a Basecamp. Go from AI chaos to AI work, in minutes.
