MCP Gateway Security Controls for AI Agents

The Model Context Protocol states plainly that it cannot enforce these security principles at the protocol level, and that implementors should follow best practices in their integrations. Every control an organization gets therefore comes from where it places the gateway and what it does there.

‍

The protocol publishes its own security best practices document, currently at revision 2026-07-28, naming the attacks a deployment has to handle. Reading that list backwards produces the logging schema and the enforcement set, which is a more defensible way to build both than inventing fields.

‍

What Does the Specification Require?

‍

A short list of absolute obligations expressed as MUST, each attached to a named attack rather than to a general principle.

‍

Consent Has to Be Stored Per Client

‍

Proxy servers must maintain a registry of approved client identifiers per user and check it before initiating any third-party authorization flow. The consent interface must name the requesting client, display the third-party scopes being requested, show the redirect destination and carry request forgery protection.

‍

Tokens Must Be Audience-Bound

‍

Passing a token received by one server onward to another is explicitly forbidden, and clients must implement resource indicators so a malicious server cannot obtain tokens meant elsewhere. Validation of the audience is the control that makes the prohibition enforceable.

‍

Scope Has to Be Minimized

‍

The guidance calls for a progressive least-privilege scope model, requesting what a task needs rather than what a server offers. A broad grant issued once is the condition most of the other attacks depend on.

‍

What Should a Gateway Log?

‍

Six elements, each tied to an attack in the specification's list, which is what makes the schema defensible to somebody asking why these fields.

‍

• Server identity and version: Which server answered, since a compromised local server is a named attack.
• Tool name and arguments: What was invoked and with what, since scope abuse shows in arguments rather than names.
• Acting identity: Whose authority the call ran under, which the confused deputy problem turns on entirely.

‍

The Other Three

‍

Token audience, so passthrough is detectable rather than theoretical. Outbound destinations requested by the server, since request forgery is in the list. Consent decisions with their timestamps complete the set, because the specification requires the registry to exist and a registry nobody can read is not evidence.

‍

Why Arguments Rather Than Tool Names

‍

A tool name describes a capability and an argument describes its use. Reading a file is a permitted operation and reading a particular file may not be, so a log recording only invocations answers questions nobody is asking, and what the tool boundary reveals depends on the arguments being retained.

‍

Why Log the Protocol Version?

‍

Because the security model changes between revisions, and a schema fixed at one revision silently falls behind the threat list it was built against.

‍

What Changed in One Revision

‍

Comparing the current document against the previous one, session hijacking was restructured into state handle hijacking, and mix-up attacks, localhost redirect impersonation and client metadata trust policies were added. An organization logging to the older list has no field for three named attacks.

‍

The Field Already Exists

‍

HTTP transport requires the negotiated version to travel in a protocol version header on subsequent requests, so the value is present and usually discarded. Retaining it lets a reviewer establish which security model applied to a given call.

‍

What Should Be Enforced?

‍

Four controls, and each maps to a MUST rather than to a preference, which matters when somebody asks why the gateway blocked a workflow.

‍

Server Allowlisting

‍

Only registered servers answer. Local server compromise is in the attack list, and an unregistered server reached by an agent is the condition the attack needs.

‍

Scope Ceilings Per Identity

‍

The maximum authority any single call can exercise, set below what the server would grant. Scope minimization is a specification obligation and a ceiling is how it survives contact with a developer in a hurry.

‍

Approval Steps on Named Operations

‍

Write operations, financial actions and anything touching regulated material routed through a human decision. Governing agents at the boundary is where that routing belongs, since the agent itself cannot be trusted to request it.

‍

What Does the Protocol Leave Unaddressed?

‍

Token lifecycle, which the specification treats as somebody else's problem and which an operator therefore owns.

‍

The Finding

‍

Analysis published by the National Security Agency observes that MCP servers rely on bearer tokens as defined in OAuth 2.1 while the core specification mandates no token lifecycle management, covering refresh, revocation and reuse control. Expiration and rotation appear as recommendations rather than requirements.

‍

What Follows for a Deployment

‍

Expiry, rotation and revocation have to be imposed at the gateway or by the authorization server, since no part of the protocol will do it. A session that remains valid indefinitely is a replay opportunity the specification does not close.

‍

What Falls Outside the Gateway?

‍

Servers running locally over standard input and output, which never cross a network boundary at all.

‍

Why That Matters More Here

‍

Local servers are the common development pattern, so the population outside the gateway is engineering machines rather than an edge case. The specification addresses this directly with guidance on proxy scenarios, which exists because the configuration is widespread.

‍

What Reaches Them

‍

Endpoint signals rather than gateway logs. A process inventory on the developer machine establishes which servers run there, and securing the protocol surface depends on covering both populations rather than the routed one alone.

‍

What Should Be Established?

‍

Three things, and the first takes an afternoon against the published list.

‍

Which of the named attacks your current logging would let you detect after the fact, checked attack by attack rather than in general. Whether tool arguments are retained or only tool names, since that decides whether scope abuse is visible. Then whether token expiry and revocation are imposed anywhere, given the protocol imposes neither. Kovrr's AI Security and Governance Platform reads agent and MCP activity alongside identity and network sources, and the protocol's security implications covers the background this builds on.

‍

Build the Schema From the Attack List

‍

The protocol states that it cannot enforce security at the protocol level, so every control comes from the deployment. Its own security document, now at revision 2026-07-28, names the attacks, and reading that list backwards produces both the logging schema and the enforcement set. Six fields cover it, being server identity and version, tool name and arguments, acting identity, token audience, outbound destinations and consent decisions, with arguments mattering more than names because scope abuse shows there. The negotiated protocol version deserves a field of its own, since the attack list grew by three between the last two revisions and the header already carries the value. Token lifecycle remains unmandated, as published analysis from the National Security Agency notes, so expiry and revocation are the operator's to impose.

‍

To see agent and MCP activity read alongside identity and network signals, book a demo mapped to your own estate.