The moment more than three people in your company connect MCP servers on their own, you have an ungoverned integration layer reaching into production systems. Nobody decided this. It simply happened, one convenient install at a time.
A gateway is the answer, and the current specification made building one considerably easier.
What a Gateway Actually Does
Five jobs, in order of value.
- Allowlisting. Only registered servers are reachable. This caps blast radius more effectively than any detection tooling, because an unregistered malicious server is simply unreachable.
- Identity and token brokering. Agents present their identity to the gateway, and the gateway holds the downstream credentials. Individual agents never hold long-lived secrets.
- Policy enforcement. Which agents may call which tools, with what limits, at what times.
- Audit. One place where every tool call is recorded, since the protocol still has no standardised audit trail of its own.
- Rate limiting and cost control. Per agent, per tool, per team.
Why This Got Easier
Two changes in the 2026-07-28 spec matter here.
First, method and tool names now travel in the Mcp-Method and Mcp-Name HTTP headers. Your gateway, rate limiter or web application firewall can route, authorise and meter on headers without parsing JSON bodies. That turns policy enforcement into ordinary HTTP infrastructure work.
Second, the stateless core removes session affinity. A gateway no longer has to pin a client to a particular backend instance, which means it can be a normal horizontally scaled proxy rather than a stateful component you have to operate carefully.
A Reference Shape
| Layer | Responsibility |
|---|---|
| Client-facing endpoint | One URL per environment, authenticated |
| Registry | The allowlist, with owner and review date per server |
| Policy engine | Agent to tool permissions, limits, time windows |
| Credential broker | Holds downstream secrets, issues scoped access |
| Audit sink | Immutable log of every call and outcome |
| Cost meter | Per agent and per team attribution |
Cost attribution deserves a mention. MCP has no defined multi-tenancy or cost attribution model, so if you do not build it at the gateway, nobody can tell you which team is spending what.
How to Roll It Out Without a Revolt
Gateways fail politically far more often than technically. If yours is slower or more restrictive than the direct connection people already use, they will route around it and you will have achieved nothing.
- Start permissive. Log everything, block almost nothing, for the first month.
- Publish the registry. People should see what is available and how to request more.
- Commit to an approval SLA. Five working days, and meet it. Slow approval is what creates shadow integrations.
- Make the gateway path easier. Pre-authenticated and one line of config beats a direct connection people must configure themselves.
- Tighten with evidence. Use the first month of logs to write policy that reflects real usage rather than imagination.
Conclusion
Build the allowlist and the audit log first, because together they deliver most of the value. Use the method and name headers for policy so enforcement stays in ordinary HTTP infrastructure. Broker credentials centrally so no agent holds a long-lived secret. Then roll out permissively and tighten with evidence, because a gateway everyone bypasses is worse than no gateway, since it creates the illusion of control.
Frequently Asked Questions
Should we build or buy a gateway?
A minimal allowlisting proxy with logging is a small build and gets you most of the benefit. Buy when you need fine-grained policy, identity integration and cost attribution without staffing it.
Does a gateway slow agents down?
Marginally, and the stateless core keeps that overhead small. The latency cost is trivial next to the cost of an unaudited integration into production.
What about desktop clients using stdio servers?
Those bypass a network gateway entirely, which is why device management and an approved-server list matter alongside it. Local servers are the gap most gateway projects forget.