An MCP server exposes tools. delete_repository, create_charge, execute_query. The agent calls whatever it decides to call, and the server runs it. Nothing sits in between.
Connect a coding agent to a GitHub MCP server and it can delete a repository as readily as it can read one. Point it at a Stripe server and create_refund is one tool call away from list_charges. The Model Context Protocol defines how tools are discovered and invoked. It does not define who is allowed to invoke what. An MCP gateway is the layer that adds that missing decision.
What is an MCP gateway
An MCP gateway is a proxy that sits between your AI clients and the MCP servers they call. Every tools/call leaves the client, reaches the gateway first, and is evaluated against policy before it is forwarded upstream. The gateway allows the call, denies it, or hides the tool from the agent, and can attach argument-level conditions and quota limits.
It is the same architectural idea as an API gateway, applied to agent tool calls. A single control point in front of many backends. The difference is what it inspects: not REST routes, but MCP method calls and their arguments, made by a non-deterministic caller that can be steered by the content it reads.
The protocol is a transport. The gateway is the control plane that the transport never shipped with.
Why MCP needs a gateway
MCP has no permission model. When you connect an agent to a server, it gets every tool that server exposes, with no scoping, no limits, and no per-person identity. Three gaps follow directly.
Unrestricted tool access. A server publishes its full toolset to any connected client. There is no native way to expose get_issue while hiding delete_repository. It is all or nothing.
Scattered, shared credentials. Each server authenticates on its own terms: a bearer token here, an API key there, an OAuth flow somewhere else. Those secrets end up copied into client config files on every developer machine. Nobody can say which person made which call, and revoking access means rotating a key everyone shares. We found exactly this pattern when . , and the reason the control belongs at the .
Related reading
Control what your agents can do through MCP.
. Pre-classified tools across thousands of MCP servers.
Read the MCP security reference →. What the boundary looks like.
SOCIAL SHARE CARD GENERATOR