MCP Gateway: How It Works and What to Look For

The gateway checks which agent is calling, for which person, and whether the tool is inside the granted scope, then allows, refuses or holds the call.

Plan a trial

Allow, refuse or hold, and a record either way.

An AI agent acting for a person, checked call by call

What an MCP gateway does

An MCP gateway is a checkpoint in front of your MCP servers, and every tool call an agent makes goes through it. For each call, the gateway checks:

who the agent is
which person it acts for
whether the tool is inside the granted scope

It then allows the call, refuses it or holds it for approval, and records the decision either way.

Without a gateway, each MCP server decides for itself, often with an API key that works for anyone who holds it. With an MCP gateway, one place makes the decision, with the person’s identity attached.

How an MCP gateway differs from an MCP server and an API gateway

An MCP server exposes tools, an API gateway guards HTTP endpoints, and an MCP gateway guards tool calls. A capable MCP gateway knows which agent is calling and for whom.

	MCP server	MCP gateway	API gateway
What it does	Runs the tools, such as `invoices.read`	Decides whether a tool call may proceed	Decides whether an HTTP request may proceed
What it decides on	Nothing; it trusts its caller	One tool call, by one agent, for one person	One request, usually by an application or API key
Knows the agent	Rarely	Yes, if tied to an identity provider	Rarely; it sees a key or client ID
Knows the person	No	Yes, if the credential carries it	Sometimes, through a user token

A plain proxy forwards traffic. A gateway makes a decision about each call.

You need an MCP gateway when agents act for people

One developer running one read-only MCP server on a laptop does not need a gateway. An organization needs one when its setup looks like this:

You need a gateway when	You can wait when
Agents call internal tools on behalf of staff, such as finance or HR systems	A single person runs a single read-only server for themselves
More than one MCP server is in play, owned by different teams	The tools touch no sensitive data
An auditor will ask which agent did what, for whom	Nobody outside the team uses the agent
Some actions, such as changing bank details, need a person to approve	A shared key is acceptable and nothing can be changed

Six checks on every tool call

A gateway that checks a token only at the start of a session misses most of what matters. These six checks run on every call:

Who is the agent? A registered identity with named human owners, proved by its own key. Not a shared secret.
Who is it acting for? The person is named in the credential, and the agent is named as the actor (OAuth token exchange, RFC 8693).
Is the credential fresh and bound? It lives for minutes and is tied to a key only the agent holds (DPoP, RFC 9449). A copied token is useless.
Is this tool in scope? Scopes name the application and the tool. No blanket permissions.
Does this action need a person? Sensitive scopes wait for the person’s approval, every time.
Is the decision recorded? Allowed or refused, with the reason.

One accounts-payable agent, three tool calls, three outcomes. The names are illustrative.

How the SSOGEN Gateway runs the checks

The MCP Gateway is a capability of the SSOGEN Gateway, a program you run inside your own network (container, Helm chart, RPM or DEB).

Agents reach your MCP servers through it, and it runs the six checks on every call.

Agent identity. Each agent is a registered identity with one to five named human owners. It has no password and proves itself with its own key.
Consent. When an agent acts for a person, the person sees a consent screen. They can shorten the period and withdraw consent at any time. A delegation never gives the agent more than the person has.
Per-call verification. On every tool call, the Gateway verifies the agent’s credential and its key proof, then checks that the tool is within the granted scopes.
Short credentials. A credential lasts 270 seconds at most, 240 by default, and works for one application and its scopes.
Approval. Sensitive scopes wait in the person’s approvals inbox. Approving produces a new credential for that one change.

Two controls sit above the individual call:

A kill switch stops one type of agent, or all of them. New credentials stop at once, and every enforcement point refuses the agent within five minutes.
Fixed, versioned policy makes every decision. AI can advise an administrator, but it cannot feed the inputs of a decision, and an automated test enforces that.

What a decision record looks like

Each call produces a record that names:

The decision. The result, the policy and its version, the rule that decided, and the reasons.
The parties. The agent and its owners, the person, and the actor chain.
The credential. The credential and the scopes.

Records are linked in a SHA-256 hash chain and sealed daily, so a removed or altered record is detected.

This record is illustrative. The names and times are made up, and they match the credential below.

time        2026-10-06 14:32:07 UTC
tool        finance-mcp / vendors.update_bank_details
agent       ap-assistant (agt_AP71)
person      m.kim
actors      m.kim -> agt_AP71
result      HELD for approval
rule        sensitive scope needs the person's approval
credential  c5d1 (issued 14:30:11, expires 14:34:11)

This is the credential behind it, decoded. sub is the person, act is the agent, and cnf ties the token to the agent’s key.

{
  "iss": "https://sso.example.com",
  "sub": "m.kim",
  "act": { "sub": "agt_AP71" },
  "client_id": "agt_AP71",
  "aud": "finance-mcp",
  "scope": "invoices.read",
  "jti": "c5d1",
  "iat": 1791297011,
  "exp": 1791297251,
  "cnf": { "jkt": "0ZcOCORZNYy-DWpqq30jZyJGHTN0d2HglBV3uiguA4I" }
}

Questions to ask any MCP gateway vendor

Ask	Why it matters	What the SSOGEN Gateway does
Where does it run?	A gateway outside your network sees every tool call and its data	Runs in your network, as part of the SSOGEN Gateway
How does it know the agent?	A shared API key says nothing about who used it	Each agent has its own identity, owners and key
Does it know the person?	“The agent did it” is not an audit answer	The person is in the credential; the agent is the actor
Is the check per call?	A session-level check misses what happens later	Every tool call is verified and recorded, refusals included
Can a person approve sensitive actions?	Some changes should never be automatic	Sensitive scopes wait in the person’s approvals inbox
How fast can you stop an agent?	You need a number, not “immediately”	New credentials stop at once; refusals everywhere within five minutes
Can the log be altered?	An editable log is not evidence	Hash-chained records, sealed daily

What an MCP gateway does not do

An MCP gateway controls access to tools.

Untrusted servers. It does not make an untrusted MCP server safe, because the server’s own code still runs with its own permissions.
Data use. It does not judge what an agent does with data it is allowed to read, and it cannot detect or block prompt injection.
Limited damage. A hijacked agent can only use the tools and scopes its person granted, for minutes at a time.
Fixed policy. SSOGEN makes every access decision from fixed policy that you can test before activating it, never from AI.

Questions

What is the difference between an MCP gateway and an MCP server?

An MCP server provides tools, like reading an invoice. An MCP gateway stands in front of one or more servers and decides whether each call may proceed.

Is an MCP gateway the same as an API gateway?

Same role, different level. An API gateway decides on an HTTP request. An MCP gateway decides on a tool call, and it can tell which agent is calling and for which person.

What is the difference between a proxy and an MCP gateway?

A proxy forwards traffic. A gateway checks identity, scope and approval on each call and records its decision.

Do we need an MCP gateway?

Yes, if agents act for people on internal systems, or an auditor will ask who did what. One person with one read-only server does not need one yet.

Where to go next

Enforcement. Policy enforcement point explains the enforcement idea. See also the OWASP Top 10 for LLM applications and Oracle MCP servers.
New to MCP? See what an MCP server is and MCP vs API.
SSOGEN in practice. Read how agent identity works, how the SSOGEN Gateway runs in your network, or the documentation on MCP authorization. To see it on your own tools, Get trial access.
Oracle EBS. For the ERP owner’s decision, read AI agent access to Oracle EBS without a password.
Comparison. For a sourced comparison with a vendor product, see Okta for AI agents compared with SSOGEN.
Proof check. To inspect the proof an agent sends with each request, use the DPoP proof checker.