How MCP Gateways Work, Key Features & Top 5 Risks They Prevent

• An AI client or agent sends an MCP request: The client routes requests for tool discovery, resource retrieval, or tool execution through the gateway.
• The gateway identifies the agent and verifies access: It authenticates the client and checks authorization to access the requested MCP server.
• The gateway checks which tools the agent is allowed to call: It enforces tool-level permissions and may hide unauthorized tools from discovery responses.

• The gateway inspects the prompt, tool call, and agent intent: Where supported, it checks content and available context for sensitive data, malicious instructions, or policy violations.
• Approved requests are forwarded to the MCP server: Requests that pass security checks reach the appropriate server; prohibited requests are blocked.
• Tool responses are inspected and activity is logged: The gateway may filter unsafe responses and record activity for monitoring, auditing, and incident investigation.

• Discovery and mapping of agents, tools, and MCP servers: Inventories observed clients, servers, and tools to help organizations understand their MCP attack surface.
• Per-agent MCP tool control: Enforces granular permissions based on agent identity, user identity, tool name, and other request attributes.
• Secure agent access to systems and tools: Centralizes authentication and access control, with credential management and token validation where supported.
• Prompt validation and LLM guardrails: Inspects MCP content for malicious instructions, sensitive data, and policy violations; original prompts require additional integration.

• Intent-based behavioral guardrails for tool calls: Uses available task context and tool activity to flag, block, or require approval for potentially unsafe actions.
• Agent behavior analytics and anomaly detection: Monitors activity patterns and identifies unusual tool usage, request volumes, or access violations.
• Integration with enterprise, homegrown, and developer-hosted agents: Applies consistent controls across agent environments whose MCP connections can route through the gateway.

• MCP Gateway vs. MCP Server vs. MCP Proxy
• Common Use Cases of MCP Gateways
• MCP Gateway vs. API Gateway vs. AI Gateway vs. LLM Firewall
• How an MCP Gateway Works

• What MCP Threats Can an MCP Gateway Protect Against?
• Key Capabilities of an MCP Gateway
• MCP Gateway Best Practices
• Securing MCP Traffic and AI Agents with Radware Agentic AI Protection

MCP Server

An MCP server exposes tools, resources, and prompts to AI clients through the MCP standard. It acts as an interface between AI applications and external systems, such as databases, APIs, file systems, and SaaS applications.

For example, a GitHub MCP server allows AI agents to interact with GitHub repositories, retrieve issues, and create pull requests. Each MCP server defines the capabilities available to connected clients and handles requests to execute those capabilities.

MCP Proxy

An MCP proxy sits between an MCP client and an MCP server and forwards MCP requests and responses. It acts as an intermediary without necessarily changing the underlying server's functionality.

MCP proxies are commonly used to bridge different transports, forward connections to remote MCP servers, or provide a stable endpoint for clients. Depending on the implementation, they may also support basic authentication, logging, or request filtering.

An MCP gateway is an external service that sits between AI clients and MCP servers, allowing organizations to centrally manage and control MCP traffic. Rather than connecting directly to MCP servers, AI clients send their requests through the gateway, where security and governance policies can be enforced.

MCP gateways typically provide capabilities such as centralized authentication, access control, traffic monitoring, rate limiting, and audit logging. They allow organizations to control which MCP servers and tools users or AI agents can access, without configuring security policies separately for every server.

Unlike a basic MCP proxy, an MCP gateway focuses on managing MCP traffic across multiple clients and servers, particularly in enterprise environments.

• Enterprise AI assistants connected to business data: Enforce user- and agent-based access policies for databases, document repositories, and CRM platforms. Restrict tools, inspect requests for sensitive information, and log interactions for audits.
• Developer coding agents running on endpoints: Control access to MCP servers and tools used by coding agents, and monitor traffic for suspicious activity. Local connections that bypass the gateway require additional endpoint controls.

• Customer-facing AI agents and public MCP servers: Validate requests, enforce tool-level permissions, and apply rate limits across internal and third-party MCP connections. Restrict high-risk actions to limit damage from compromised or manipulated agents.
• Multi-agent workflows across SaaS and cloud platforms: Apply separate access policies for each agent, monitor cross-system data transfers, and detect unusual tool-call sequences. Centralized controls reduce reliance on autonomous agents following instructions.

MCP Gateway

An MCP gateway sits between AI clients and MCP servers, allowing organizations to centrally manage, monitor, and secure MCP traffic. It provides visibility and control over how AI agents and applications interact with external tools and data sources through the Model Context Protocol.

MCP gateways can enforce authentication, authorization, tool-level access policies, rate limits, and audit logging. For example, an organization can use an MCP gateway to allow an AI agent to read issues from GitHub while blocking access to tools that modify or delete repositories.

Unlike general-purpose gateways, MCP gateways understand MCP-specific operations, such as tool discovery and tool execution. This allows them to enforce policies based on the MCP server, requested tool, client identity, and request context.

API Gateway

An API gateway manages traffic between applications and backend APIs. It provides a centralized entry point for API requests and commonly handles authentication, authorization, routing, rate limiting, caching, and monitoring.

API gateways typically operate with protocols such as HTTP and REST. While they can forward MCP traffic over HTTP, they do not necessarily understand MCP-specific operations, such as tools/list and tools/call. As a result, a conventional API gateway may enforce policies at the endpoint level without distinguishing between individual MCP tools.

The key difference is that API gateways manage general API traffic, while MCP gateways provide controls designed specifically for MCP interactions.

AI Gateway

An AI gateway manages communication between AI applications and model providers, such as OpenAI, Anthropic, and Google. It provides a centralized layer for routing model requests, managing API keys, monitoring token usage, tracking costs, and enforcing usage limits.

AI gateways may also support model fallback, load balancing, response caching, and provider switching. For example, an organization can use an AI gateway to route requests between different LLM providers based on cost, availability, or model capabilities.

The main difference is the traffic they manage. AI gateways primarily manage requests to AI models, while MCP gateways manage interactions between AI clients and MCP servers. Some platforms support both functions.

LLM Firewall

An LLM firewall is a security layer that inspects and filters data exchanged with large language models. Its primary purpose is to detect and prevent threats such as prompt injection, sensitive data leakage, malicious instructions, and violations of security policies.

LLM firewalls typically inspect prompts, model responses, and other content processed by AI applications. For example, an LLM firewall can detect a prompt injection attempt embedded in a retrieved document or block a model response containing sensitive information.

An MCP gateway focuses on controlling access to MCP servers and tools, while an LLM firewall focuses on identifying security risks within AI-related content. However, their capabilities can overlap. Some MCP gateways integrate content inspection to detect malicious tool responses or prevent sensitive information from being sent to MCP servers.

1. An AI Client or Agent Sends an MCP Request

An AI client, such as an AI assistant or autonomous agent, sends a request to an MCP server through the gateway. The request might involve discovering available tools, retrieving resources, or executing a specific tool.

For example, an AI agent might send a tools/call request to retrieve customer records from a database. Instead of connecting directly to the database's MCP server, the client sends the request to the MCP gateway, which acts as the entry point for MCP traffic.

2. The Gateway Identifies the Agent and Verifies Access

The MCP gateway authenticates the requesting client and determines its identity. Depending on the implementation, authentication can use OAuth tokens, API keys, or other identity mechanisms.

The gateway then verifies whether the client is authorized to access the requested MCP server. It may also associate the request with a specific user, agent, application, or organization to apply identity-based security policies.

For example, an organization might allow its internal AI assistants to access a customer database MCP server while blocking requests from unapproved third-party agents.

3. The Gateway Checks Which Tools the Agent Is Allowed to Call

After verifying the client's identity, the gateway evaluates which MCP tools the client is authorized to use. Access policies can be defined based on the user, agent, MCP server, tool name, or other request attributes.

For example, an AI agent might be allowed to call a get_customer tool but prohibited from calling delete_customer. A gateway can enforce these restrictions during tool execution and, where supported, filter unauthorized tools from discovery responses.

This provides more granular control than simply allowing or blocking access to an entire MCP server.

4. The Gateway Inspects the Prompt, Tool Call, and Agent Intent

MCP gateways with content inspection capabilities can analyze tool requests to identify potential security risks. This may include detecting sensitive data, suspicious tool arguments, prompt injection attempts, or requests that violate organizational policies.

For example, a gateway might detect that an agent is attempting to send customer credentials to an external service through an MCP tool. It can block the request before the data leaves the organization's environment.

Some advanced gateways can also evaluate agent intent by examining available conversation context or the sequence of tool calls. However, MCP requests do not automatically include the user's original prompt or the agent's reasoning. Intent analysis therefore depends on the context and integrations available to the gateway.

5. Approved Requests Are Forwarded to the MCP Server

Once the request passes the applicable security checks, the gateway forwards it to the appropriate MCP server. The gateway maintains the connection between the client and server while handling protocol requirements and request routing.

The MCP server then processes the request and executes the requested operation. For example, a GitHub MCP server might retrieve repository information or create an issue through the GitHub API.

If a request violates an access policy or security rule, the gateway can reject it before it reaches the MCP server.

6. Tool Responses Are Inspected and Activity Is Logged

After the MCP server processes the request, its response returns through the gateway. Depending on its capabilities, the gateway can inspect the response for sensitive information, malicious instructions, or other policy violations before delivering it to the AI client.

For example, a gateway with data loss prevention capabilities might detect and redact sensitive customer information in a tool response. Content inspection can also help identify prompt injection instructions embedded in retrieved documents or external tool results.

The gateway can log relevant activity, including client identities, MCP servers, tool names, timestamps, access decisions, and request outcomes. These records help security teams investigate incidents, monitor tool usage, and audit AI agent activity.

1. Indirect Prompt Injection Through Tool Results

Indirect prompt injection occurs when an attacker embeds malicious instructions in content that an AI agent retrieves from an external source. In MCP environments, these instructions can appear in tool responses, retrieved documents, database records, or other data returned by MCP servers.

An MCP gateway with content inspection capabilities can analyze tool responses for suspicious instructions before forwarding them to the agent. It can block or sanitize malicious content and log detected attempts. However, detecting prompt injection is not always reliable, so tool-level access restrictions remain important.

2. Tool Poisoning and Manipulated Tool Descriptions

Tool poisoning involves modifying an MCP tool's description, metadata, or other information to influence how an AI agent uses it. Because agents rely on tool descriptions to understand available capabilities, malicious instructions embedded in those descriptions can affect their behavior.

An MCP gateway can inspect tool definitions returned during discovery, restrict access to unapproved tools, and detect unexpected changes in tool metadata. Some gateways can also enforce approved tool schemas or maintain allowlists of trusted tools and servers.

3. Jailbreaking Agents Into Unsafe Actions

Jailbreaking attacks attempt to manipulate an AI agent into ignoring its instructions or security restrictions. In MCP environments, attackers may use malicious prompts, retrieved content, or tool responses to convince an agent to execute unauthorized operations.

An MCP gateway can reduce the impact of successful jailbreaks by enforcing access policies independently of the agent's decisions. Even if an agent is manipulated into requesting a prohibited operation, the gateway can block the corresponding tool call. Gateways with content inspection may also detect suspicious instructions, although they cannot guarantee that every jailbreak attempt will be identified.

4. Malicious or Compromised MCP Servers (Supply Chain Attacks)

MCP servers can introduce supply chain risks when they contain malicious code, are compromised by attackers, or depend on vulnerable third-party components. Because MCP servers interact directly with external systems, a compromised server may expose sensitive information, return manipulated content, or perform unauthorized operations.

An MCP gateway can help organizations manage these risks by restricting connections to approved MCP servers, monitoring changes in available tools, and inspecting traffic from external servers. It can also block connections to known malicious endpoints. However, a gateway cannot directly prevent malicious code from executing inside an MCP server, so server isolation, dependency scanning, and software supply chain controls are also necessary.

Data leakage occurs when sensitive information is unintentionally or maliciously transferred through MCP interactions. This can happen when an agent includes confidential data in tool arguments, sends information to an untrusted MCP server, or retrieves sensitive records that should not be accessible to the requesting user.

An MCP gateway with data loss prevention (DLP) capabilities can inspect tool requests and responses for sensitive information, such as API keys, credentials, personal data, or financial records. It can block or redact data based on configured policies and restrict which agents can send information to specific MCP servers.

Gateways can also maintain audit logs of MCP interactions to help security teams investigate potential data exposure. However, detecting sensitive data across multiple tool calls may require additional context, such as data classification, session history, and the identity of the requesting user.

Discovery and Mapping of Agents, Tools, and MCP Servers

An MCP gateway can help organizations identify which AI agents connect to MCP servers, which tools are available, and how those tools are being used. By monitoring MCP traffic and tool discovery operations, the gateway can build an inventory of active clients, servers, and their exposed capabilities.

Some gateways also map relationships between agents, MCP servers, and backend services. This allows organizations to understand their MCP attack surface and identify potential paths to sensitive data.

Per-Agent MCP Tool Control

An MCP gateway allows organizations to define which MCP tools individual agents can access and execute. Instead of granting access to every tool exposed by an MCP server, administrators can enforce permissions based on agent identity, user identity, tool name, and other request attributes.

The gateway evaluates tool calls against these policies and blocks unauthorized requests before they reach the MCP server. Some gateways can also filter tool discovery responses so agents only see tools they are permitted to use.

Secure Agent Access to Systems and Tools

MCP gateways provide a centralized point for authenticating AI clients and controlling their access to MCP servers. They can integrate with identity providers and use mechanisms such as OAuth to verify client identities and enforce access policies.

Depending on the implementation, gateways may also support credential management, token validation, and short-lived access tokens. These controls help reduce the need to distribute backend credentials across individual AI applications.

Prompt Validation and LLM Guardrails

MCP gateways with LLM security capabilities can inspect content exchanged between AI clients and MCP servers to identify potentially malicious instructions, sensitive information, and policy violations.

These controls can include prompt injection detection, sensitive data filtering, and content validation. However, MCP traffic does not necessarily contain the original user prompt or complete conversation history. Inspecting those inputs requires additional integration with the AI application or agent runtime.

Intent-Based Behavioral Guardrails for Tool Calls

Intent-based guardrails evaluate whether an agent's requested tool action is consistent with its authorized task, rather than relying only on static tool permissions. They help identify situations where an agent uses an otherwise permitted tool for an unsafe purpose.

An MCP gateway with intent-based analysis can examine tool arguments, previous tool calls, and available task context to identify suspicious actions. Depending on configured policies, it can block the request, require additional approval, or generate a security alert. The accuracy of these decisions depends on how much context the gateway can access.

Agent Behavior Analytics and Anomaly Detection

An MCP gateway can collect telemetry about agent activity, including tool calls, accessed MCP servers, request frequency, execution outcomes, and access policy violations. This information helps organizations establish patterns of normal agent behavior and identify unusual activity.

Gateways with anomaly detection capabilities can identify these patterns and alert security teams. Some implementations can also automatically restrict access or block suspicious tool calls when predefined thresholds are exceeded.

Related content: Read our article about AI threat detection.

An MCP gateway can provide a common security and management layer for AI agents built using different frameworks, platforms, and development environments. This allows organizations to apply consistent MCP access policies without implementing separate controls in every agent.

Gateways may support different integration methods, including remote MCP endpoints, client configuration changes, SDKs, and network-level routing. This flexibility helps organizations manage MCP traffic across centrally deployed agents, developer workstations, and externally hosted AI applications, provided their connections can be routed through the gateway.

Discover Every Agent, Tool, and MCP Server Before Writing Policies

Before enforcing MCP security policies, organizations should identify which AI agents are operating in their environment, which MCP servers they connect to, and which tools those servers expose. This inventory should include enterprise AI assistants, developer-hosted agents, third-party agents, and internally developed applications.

Discovery should also map the relationships between agents, tools, users, and backend systems. For example, an organization should know which agents can access customer databases, modify cloud resources, or interact with external SaaS applications.

This visibility helps security teams identify unauthorized MCP connections, excessive permissions, and potentially sensitive operations. It also provides the information needed to create access policies based on actual tool usage rather than assumptions.

Related content: Learn how to identify and manage shadow AI.

Route All MCP Traffic Through a Single Inspection Point

Organizations should route MCP connections through a centralized gateway wherever technically possible. This creates a consistent enforcement point for authentication, authorization, traffic inspection, and security logging.

Without centralized inspection, individual agents may connect directly to MCP servers using different authentication methods and security configurations. This makes it difficult to enforce consistent policies or detect suspicious activity across the environment.

A centralized gateway allows security teams to inspect requests and responses, block unauthorized tool calls, and maintain a unified audit trail. Organizations should also implement controls that prevent agents from bypassing the gateway through direct connections. Local MCP servers and endpoint-hosted agents may require additional enforcement mechanisms.

Grant Tools per Agent and Task, Not per MCP Server

MCP access policies should follow the principle of least privilege. Rather than granting an agent unrestricted access to every tool exposed by an MCP server, organizations should authorize individual tools based on the agent's identity and assigned task.

Policies should distinguish between read-only operations and actions that change data, execute commands, or interact with external services. High-risk operations may require additional authorization or human approval.

Where supported, organizations can also apply temporary permissions that expire when a task is completed. This limits the damage an agent can cause if it is compromised or manipulated.

Treat Tool Descriptions and Tool Outputs as Untrusted Input

MCP tool descriptions and responses can contain attacker-controlled content. A malicious MCP server might embed instructions in tool metadata, while a legitimate server could return documents or database records containing prompt injection payloads.

Organizations should inspect tool descriptions during discovery and monitor changes to tool definitions. Unexpected modifications to tool names, descriptions, parameters, or schemas may indicate tool poisoning or a compromised server.

Tool responses should also be inspected for malicious instructions, sensitive information, and suspicious content before reaching the agent. However, content inspection alone cannot prevent every prompt injection attack.

Baseline Normal Agent Behavior and Block Goal-Divergent Actions

Traditional access controls determine whether an agent is permitted to execute a particular tool. However, an authorized tool call can still be unsafe if it is unrelated to the agent's legitimate task.

Organizations should establish behavioral baselines by monitoring which tools agents typically use, how frequently they make requests, what data they access, and which actions they perform together.

MCP gateways with behavioral analysis capabilities can evaluate tool calls against established patterns and available task context. Organizations can configure policies to alert on unusual activity, block high-risk actions, or require additional approval when an agent's behavior diverges from its authorized goals.

Extend Existing API, Bot, and DDoS Protection to MCP Endpoints

MCP endpoints can be exposed to many of the same network and application-layer threats as traditional APIs. Publicly accessible MCP servers may face unauthorized access attempts, automated abuse, excessive requests, and denial-of-service attacks.

Organizations should extend existing API security controls to MCP endpoints, including authentication, rate limiting, request validation, bot detection, and DDoS protection.

These controls should complement MCP-specific protections, such as tool-level authorization, prompt injection detection, and agent behavior monitoring. Combining network-level protection with MCP-aware security policies helps protect both the availability of MCP services and the systems they expose.

• Agent and tool discovery: Continuously discovers all types of agents and tools across environments, mapping agent connections and dependencies to provide visibility into the full agent ecosystem.
• MCP tool control: Allows or blocks tools as needed for each agent, giving security teams granular control over which capabilities individual agents can use.
• LLM guards: Builds guardrails that protect against prompt injection, jailbreaks, and unsafe outputs, and validates prompts to prevent injection and data leaks.
• Agent behavioral protection: Maintains runtime monitoring of agent actions and intents, monitors tool calls, and blocks goal-divergent actions to detect and mitigate malicious activity, including indirect prompt injection and supply chain attacks.
• Agent behavior analytics: Tracks usage trends, anomalies, and performance changes, and records agent activity, model usage, and tool interactions.

• Secure agent access: Limits agent entry to systems and provides rich metadata on agent configuration, usage, and tools.
• Real-time security posture and risk graph mapping: Identifies and scores risks across agents and tools, captures agent workflows across all AI environments, and builds a complete attack story.
• Protection for developer-hosted agents: Monitors, detects, and secures AI agents on the client side, including Claude Code agents.
• Broad ecosystem integration: Works with leading enterprise and homegrown agent platforms, AI services, and cloud solutions.
• Audit-ready posture reports: Generates posture management reports that demonstrate compliance with global standard requirements.