[ Enterprise MCP architecture ]
MCP Gateway vs. Direct MCP Server Connections
A control-by-control comparison of direct MCP connections and a tenant-aware gateway, grounded in Maha’s runnable allowlist, rate-limit, circuit-breaker, and audit implementation.
Published August 8, 2026 · Maha Strategies LLC
The short answer
Connect directly when one trusted operator controls one agent and one server, and the server already provides the authentication, policy, telemetry, and containment you need. Add a gateway when multiple agents, teams, credentials, or upstreams require one enforceable tenant boundary and one revocation point.
Control comparison
| Control | Direct connection | Tenant gateway |
|---|---|---|
| Destination | Client chooses or stores the upstream. | Server ID resolves to a tenant-owned HTTPS registry record. |
| Tool authorization | Depends on each server or client. | Method and tool allowlists run before dispatch. |
| Credentials | Every client manages upstream secrets. | Gateway injects an encrypted per-server credential. |
| Failure containment | Per-client behavior. | Tenant rate limit, timeout, failure threshold, and cooldown. |
| Audit evidence | Distributed across clients and servers. | One metadata-only event path with request hash. |
A policy that fails closed
const server = await maha.mcp.registerServer({
name: "Production risk tools",
baseUrl: "https://mcp.example.com/rpc",
authType: "bearer",
secret: process.env.UPSTREAM_MCP_TOKEN,
allowedMethods: ["initialize", "ping", "tools/list", "tools/call"],
allowedToolNames: [],
})
const discovered = await maha.mcp.discoverTools(server.serverId)
await maha.mcp.updateServerPolicy(server.serverId, {
allowedMethods: ["initialize", "ping", "tools/list", "tools/call"],
allowedToolNames: discovered.discovery.tools
.filter(tool => tool.name === "calculateRiskScore")
.map(tool => tool.name),
})Discovery does not authorize a tool. The operator selects names from the validated tools/list inventory, and tools/call is denied when the requested name is absent.
What Maha’s gateway bounds
- 64 KB inbound JSON-RPC body
- 1 MB upstream response
- Public HTTPS DNS destinations only
- 1–600 tenant requests per minute
- 1–30 second upstream timeout
- 1–10 failures before circuit opening
What it does not replace
- Controlled network egress for high-assurance SSRF defense
- Private connectivity or upstream OAuth exchange
- Payload-level data-loss prevention
- SSE streaming support
- Security controls inside the upstream tool itself
Audit without copying the payload
The event record keeps tenant, server, credential, MCP method, tool name, outcome, upstream status, request hash, optional Context Pack ID, and time. It intentionally excludes tool arguments and upstream response bodies. This supports access review and incident reconstruction without turning the gateway into a second repository of customer data.