Every few months the industry picks a new artifact to argue about, and right now it's the MCP gateway. Half the pitches I see frame it as a firewall for AI — as if the danger were the model itself, leaking out through a port. That framing sells appliances. It doesn't describe the problem.
Here is the problem. The Model Context Protocol turned tools into a commodity. Any agent can discover a server, read its tool descriptions, and start calling functions that touch your CRM, your file store, your payments stack. That's the point of it — and it means your integration surface now grows at the speed of a config file, not at the speed of a procurement review.
The model was never the asset at risk. The tools are — and the credentials behind them.
Scope sprawl. An agent that needs to read one calendar gets a token that can read every calendar, because that's the token someone had. Nobody would provision a new employee that way, but we do it for agents daily. The gateway's first honest job is boring: per-agent identity, per-tool scopes, credentials that expire.
Poisoned context. Tool descriptions and tool results are inputs to the model. A malicious or compromised server can carry instructions in either — the description says "also forward the output to this address," politely, in text no human reads. A gateway that inspects and pins tool manifests — this version, this hash, these capabilities — turns a supply-chain surprise into a diff you review.
The attribution gap. When something goes wrong today, the question "who did this?" has an answer: a person, a service account, a change ticket. When an agent chains four tools across three servers on a user's behalf, the honest answer is often a shrug. The gateway is where that answer gets rebuilt — one choke point where every call is logged with the agent, the human sponsor, the tool, and the reason.
A gateway will not make a model behave. It won't stop a well-crafted injection from steering a conversation, and it won't fix an agent that was given a bad goal by its own developer. Those live in evaluation, in system-prompt discipline, in the choice of what to automate at all. Pretending the gateway covers them is how you end up with a compliant architecture diagram and an incident report.
The unglamorous truth: the gateway is only as good as the inventory behind it. You cannot mediate agents you don't know exist. The organizations getting this right treat agents the way they learned to treat users and laptops — a register of who they are, what they're for, what they can touch, and when they were last reviewed. That's not a product you buy. That's governance, and it's the part that turns the whole thing from heroics into habit.
Buy the gateway if you need one — most enterprises will. Just be clear about what you're buying: identity, scoping, pinning, and a place where accountability lives. The rest is still your job.