Short answer. An MCP gateway is a control point between your AI agents and your MCP servers, so security teams can see and manage every agent's tool access in one place instead of on every laptop. It combines many MCP servers behind one URL and handles sign-in and logging.
An MCP gateway gives every agent one control point for your tools
Instead of configuring each MCP server, such as GitHub or Jira, in every client, you point clients at one URL:
{
"mcpServers": {
"company-gateway": { "url": "https://mcp.acme.com/mcp" }
}
}Behind that URL, a typical gateway handles:
- Tool aggregation. Many MCP servers show up as one tool list.
- Sign-in. Users authenticate through your IdP before they reach any server.
- Credentials. API keys for downstream servers live in the gateway, off laptops.
- Routing and logs. Requests go to the right server and get recorded.
A typical MCP Gateway forwards calls, so it can't decide what an agent does
Gateways are built to connect and route. Controlling what agents do takes real-time authorization per request, which typical gateways don't provide:
| Typical MCP gateway | What agent access control needs | |
|---|---|---|
| Identity | Often one key per deployment, so every run looks the same | An identity per run, tied to the delegating user |
| Decision | Role or key rules, set when the agent connects | Decided per request, in real time, based on the agent and the delegating user |
| Revocation | Revoke the key and every agent on it stops | Suspend one agent instance and leave the rest running |
| Responses | Often forwarded to the agent unchanged | Filtered for sensitive data and secrets before the agent reads them |
| Audit | Forwards the call and moves on | A record of every call, denied calls included |
| Coverage | Only agents pointed at it | Also enforced at the model and on the endpoint |
SecureAuth Agent Authority sits downstream of your IdP and makes a real-time authorization decision on every agent tool call, per request, based on the agent and the delegating user.
Explore Agent Authority by SecureAuthFrequently Asked Questions
Is an MCP gateway the same as an API gateway?
No. An API gateway routes HTTP requests. An MCP gateway reads tool lists and tool calls inside MCP's JSON-RPC messages. Some API gateways now add MCP support.
Do I need an MCP gateway?
A gateway is useful if you only need to aggregate tools across many MCP servers. Controlling what agents do with those tools also takes per-request authorization.
What is per-request authorization?
Per-request authorization checks every tool call before it runs, based on the delegating user's current access and what the agent is trying to do. The agent can't exceed the user's access and holds no standing credentials. Denied calls are recorded.
Does an MCP gateway support SSO?
Most support SSO for the people signing in. Check that the identity also reaches each tool call, since per-user rules and audit depend on it.