[ Practical architecture guide ]

How to govern enterprise MCP servers with tool allowlists and audit logs.

An MCP gateway should make agent access narrower, observable, and revocable. It should not become a universal secret relay or a second uncontrolled copy of the data passing through it.

Published August 6, 2026 · Maha Strategies LLC

The short answer

Place a tenant-aware policy gateway between agent clients and approved MCP servers. Resolve the upstream from a server registry, authenticate both sides independently, enforce method and tool allowlists before network dispatch, contain upstream failures, and retain only the metadata needed to investigate access and availability.

The five controls that matter

  1. 01 · Inventory

    Give every approved upstream a tenant-owned server ID. Never let callers supply an arbitrary destination URL at request time.

  2. 02 · Authentication

    Bind the caller credential and server record to the same tenant. Keep upstream credentials encrypted and outside responses, logs, and discovery documents.

  3. 03 · Policy

    Allow MCP methods explicitly. For tools/call, require the tool name to appear on a per-server allowlist before forwarding anything upstream.

  4. 04 · Containment

    Bound body size, response size, duration, redirects, and request rate. Open a circuit when repeated transport failures indicate an unhealthy upstream.

  5. 05 · Evidence

    Record server ID, method, tool name, outcome, latency, and cryptographic request hash. Avoid retaining arguments or upstream response bodies by default.

A defensible request path

  1. Authenticate the agent credential and resolve its tenant.
  2. Load the server record using both tenant ID and server ID.
  3. Validate the JSON-RPC envelope and bounded request size.
  4. Reject methods and tool names outside the approved policy.
  5. Consume the tenant rate limit and check the server circuit state.
  6. Resolve the upstream hostname again and reject non-public destinations.
  7. Inject only the upstream credential configured for that server.
  8. Forward with strict timeout, redirect, and response-size limits.
  9. Record the metadata-only outcome and update circuit health.

What not to log

Tool arguments can contain source documents, customer identifiers, credentials, and regulated data. Full response bodies can be equally sensitive. A default gateway event should therefore identify the tenant, server, credential, MCP method, tool name, outcome, latency, upstream status, and a one-way request hash—not the request body itself.

Teams that need payload inspection should define it as a separate, explicit data-processing mode with its own retention policy, access controls, and customer approval.

The deployment boundary

Application-level SSRF checks are necessary but insufficient for the highest-assurance environments. Combine hostname validation with controlled egress, private connectivity where required, key rotation, incident response, and a tested method for disabling one server without disabling the whole tenant.