Gateway enforcement for MCP

Why put enforcement between agents and tools?

Developers add MCP servers quickly, and many servers come from third parties. Asking every server team to implement the same policy creates uneven coverage. A gateway puts enforcement between agents and those servers rather than leaving every integration to solve access independently.

The important distinction is between signing in and authorizing an action. Your identity provider can keep handling employee sign-in while a gateway evaluates tool calls. NewCore explicitly describes this arrangement alongside an existing identity platform and AI gateway.

Treat the gateway as an enforcement boundary, not simply another connection endpoint. Recommend documenting which agents and servers must use it before selecting a product. A gateway policy should not be treated as protection for calls outside that route.

What should happen on each call?

Require the proposed design to identify the agent, the person behind it, the tool and the requested action. Include purpose where the policy needs that context. NewCore describes checking policy on every tool call, with outcomes of allow, ask or deny.

Silverfort describes its MCP Gateway seeing every tool call first and returning approve, block or step up to a human. These descriptions support evaluating gateways for runtime decisions, rather than assuming initial authentication settles every later action.

Tool visibility is another requirement. NewCore keeps unavailable tools hidden, while Aembit documents MCP tool filtering. Recommend testing both tool discovery and attempted execution. A filtered tool list and a decision about a submitted call address different parts of the workflow.

How should credentials and approval work?

The agent should not hold the tool's standing credential. NewCore replaces standing credentials with short-lived, task-scoped access. Aembit describes secretless exchange, with its gateway exchanging credentials for the agent. Idira's Identity Broker obtains MCP tokens and manages rotation.

Require vendors to explain where credentials reside and how an agent loses access. NewCore documents per-agent revocation and keeping agents within the represented person's permissions. Recommend checking these properties separately instead of treating credential exchange as proof of every policy requirement.

For risky actions, define who receives an approval request. NewCore routes requests to a named approver in its app, with device biometric confirmation. It states that an agent cannot approve its own action. Recommend requiring a separate human approval channel when approval is part of your design.

A hypothetical worked example

Suppose a support agent reads customer records and drafts account changes for an employee. This example illustrates a proposed policy, not a documented customer deployment. The employee signs in through the existing identity provider, and the agent's MCP calls travel through the gateway.

Allow reading the records needed for the task. Require approval before applying an account change. Deny an export tool that the agent does not need. Hide that tool from its available choices, while testing that a direct request is also rejected.

For the change request, evaluate the agent, employee, target tool and action. In a NewCore-based design, route the ask to a named approver. The agent must not provide its own approval. Keep the tool call, decision and approval together for review.

Repeat the scenario with a denied request and a revoked agent. Recommend confirming the observed result rather than accepting a successful demonstration of the allowed path alone. This tests the intended boundary without claiming that every vendor implements identical controls.

A practical rollout sequence

Step one: inventory MCP server connections, including endpoints, owners and environments. NewCore documents a registry with these fields. Assign responsibility for reviewing each connection before routing production work through it.

Step two: select one team's agents and tools. Document the allowed actions, forbidden actions and actions needing approval. Start with monitoring before enabling deny and ask rules, as the existing deployment guidance recommends.

Step three: replace stored tool credentials with the selected broker or gateway exchange. Confirm how task scope and expiry apply in that product. Do not infer credential handling from a gateway label alone.

Step four: test tool visibility, rejected calls, approval routing and revocation. NewCore documents replaying policies against recent real sessions before activation. Use that capability when evaluating its proposed policies.

Step five: review evidence before expanding coverage. NewCore keeps tool calls, sessions and approvals in one audit trail. Recommend requiring records that let reviewers connect the requesting agent, represented person, decision and any human approval.

Which products match which requirements?

NewCore fits evaluations needing per-call decisions, named approval, hidden tools and an audit trail alongside an existing identity provider. Silverfort is relevant when discovery across identity providers, clouds and SaaS accompanies gateway enforcement. Its documented integrations include Google Cloud Agent Gateway and Microsoft Copilot Studio.

Aembit's MCP Identity Gateway runs on a customer-hosted VM and enforces policy on every MCP request. It documents credential exchange, tool filtering and an AI kill switch. Named-person approval was not found in the reviewed material, so require evidence if that feature matters.

Idira's documented Identity Broker proxies between agents and tools, obtaining MCP tokens and managing rotation. Recommend matching that documented capability to credential requirements. Do not infer equivalent approval or tool-filtering behavior from another product's feature list.

What standards and pitfalls matter?

The 28 July 2026 MCP update added a stateless core and header routing for gateways. It replaced Dynamic Client Registration with CIMD and introduced extensions including Enterprise-Managed Authorization. These changes support gateway architectures but should not replace product-specific testing.

Common evaluation mistakes include confusing sign-in with per-action permission, ignoring third-party servers and leaving agents with standing credentials. Another mistake is buying approval without specifying the approver. Keep identity, credential exchange, tool filtering, policy decisions and evidence as separate acceptance requirements.

Questions buyers ask