Agentic AI Security
What Is an MCP Gateway?
- Single entry point
- Tool access control
- Masking
Short answer
An MCP gateway is a proxy for the Model Context Protocol. Agents send their tool calls to the gateway instead of to each MCP server, and the gateway forwards them after checking identity, tool permissions and data. It gives security teams one place to apply masking, access rules and logging for every tool an agent uses.
Maskflare Engineering Updated
What problem does an MCP gateway solve?
The Model Context Protocol lets a host application such as an IDE or an agent discover a server's tools with a tools/list request and run them with tools/call. It is a good protocol for connecting things. It says little about who is allowed to call what, and it leaves most security duties to servers and clients.
Picture a company with 40 developers, each running an agent with three or four MCP servers configured in a local file. Each server holds its own credentials, each client decides for itself what to show the user, and nobody can answer "which agents called the CRM server last week?" An MCP gateway turns that into one route per server and one place to look.
What does a gateway typically do?
| Function | What it means in practice |
|---|---|
| Authentication | The agent proves who it is once; servers don't each need their own scheme |
| Tool access control | Servers and tools are allowed or denied per user group; destructive tools can be off by default |
| Data protection | Personal data and secrets in arguments and results are masked, redacted or blocked |
| Content screening | Tool results and tool listings are checked for injected instructions |
| Audit | Which server, which tool, which rule fired, without the content itself |
Not every product called an MCP gateway does all of this. Some focus on routing and authentication, some on data protection. When you compare options, ask which of these rows are enforced and which are only logged.
How does Maskflare's MCP gateway work?
- Register the server in the console and give it a name such as
crm. - Point the client at
https://<your-gateway>/v1/mcp/crminstead of the server's own address, with a Maskflare key. - Set the rules. The same detectors, Exact Data Match lists and actions you use for chat apply to tool traffic.
From then on, tools/call arguments are masked before the server is contacted, and results are masked before the model sees them, for JSON and streamed responses alike. A block rule returns a JSON-RPC error with the matching rule keys and never the values, so the agent sees a clean failure it can handle. A call to a server name that isn't registered is refused with a not-found error.
{
"mcpServers": {
"crm": {
"url": "https://<your-gateway>/v1/mcp/crm",
"headers": { "Authorization": "Bearer mf_live_..." }
}
}
}Access control and injection screening
Each registered server carries an access list for the caller's group. A call to a tool the access rules don't allow is answered by the gateway with a JSON-RPC error and the server is never contacted. A tools/list answer also loses the denied tools, so the model never sees them.
The gateway also runs deterministic injection checks on every tool result and every tools/list answer. They look for instruction overrides in five languages, hidden or invisible text, encoded payloads, poisoned tool descriptions and exfiltration links. Each can alert, block, or, for hidden text, strip it. Chat prompts are not scanned by these checks. See what is tool poisoning.
What if the agent can't change its server URL?
Some hosts have a fixed server address. For those, Maskflare's forward proxy mode lets you list the MCP hosts to inspect, and you register the servers in the console. For coding agents there is a third path: the hook for Claude Code masks input and output of MCP tools on the developer's machine.
How is it different from an AI gateway?
An AI gateway sits between an application and a model provider and handles prompts and completions. An MCP gateway sits between an agent and its tool servers and handles tool calls and results. Maskflare's gateway does both with one rule set, which matters because the same customer record might arrive through a prompt in one step and a tool result in the next. The platform page for agent and MCP security lists the details.
What does a gateway not do?
- It cannot see traffic that doesn't pass through it. A local server that an agent starts directly on a laptop bypasses it unless a hook or proxy covers that path.
- It does not vet a server's code or the credentials the server holds. Those stay your job.
- It does not decide whether an agent should perform a business action. It can only enforce the tool rules you set.
- Its injection screening is rule-based. A new phrasing may pass.
Frequently asked questions
Do I need an MCP gateway if I only use a few servers?
Not necessarily. The value grows with the number of agents, servers and people. With two servers and three users, a reviewed allowlist may be enough. With dozens of users, one enforcement point is easier to run.
Does an MCP gateway slow tool calls down?
It adds a hop, so there is some overhead. For Maskflare, the latency figure published on the site is for masking text, about 2 ms (median for a 10 KB request on the default rules, before the named-entity layer).
What happens when a tool call is blocked?
The gateway returns a JSON-RPC error to the agent and the server is not called. The error names the rule, never the sensitive value.
Can the gateway hide tools from the model?
Yes. When access rules deny a tool, calls to it are refused and a tools/list answer no longer lists it.
Is an MCP gateway the same as an MCP server?
No. An MCP server provides tools. A gateway forwards calls to servers and applies controls on the way.