Topic starter
06/11/2026 6:38 pm
TL;DR: A LangChain agent reaches an MCP gateway and LLM over a private, identity-based overlay instead of public endpoints, according to NetFoundry's demo, with X.509 identity, continuous authorization and outbound-only connectivity removing inbound exposure while preserving access. The governance shift is from network perimeter exceptions to per-connection identity control.
Editorial analysis by NHI Mgmt Group, based on content published by NetFoundry: “Securing LangChain Agents with Zero Trust: Connecting to MCP Servers and LLMs over NetFoundry”.
Key questions
Q: How should teams secure MCP-connected services behind an AI gateway?
A: They should apply the same identity, device, and policy checks to MCP-connected services that they use for the gateway itself.
Q: Why do public AI service endpoints create identity governance risk?
A: Public AI service endpoints create identity governance risk because they often expose shared APIs, long-lived tokens, and broad service accounts that are hard to attribute to one owner or purpose.
Q: How does certificate-based identity change agent access control?
A: Certificate-based identity changes agent access control by binding an agent or workload to a cryptographic certificate instead of a shared secret or password.
Practitioner guidance
- Audit exposed MCP and LLM endpoints Inventory every agent-facing endpoint that is currently reachable through public DNS, inbound firewall rules or port forwarding, then map each one to the identity control that should govern it.
- Move authorization to connection time Require each agent, workload or service to present a cryptographic identity before the first request is accepted, and ensure policy is evaluated at session start as well as during the session.
- Separate tool access by principal and session Assign tool sets per authenticated client so one agent cannot inherit or reuse another agent's access path, even when both consume the same MCP service.
Bottom line: Publicly reachable MCP and LLM services create an identity governance problem as much as a network exposure problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Identity-first access is the real control boundary for MCP and AI gateways: If a service can be reached before identity is established, the organisation is still operating a network-first trust model. That model turns gateways, MCP servers and model endpoints into shared exposure points instead of governed access points. The practical conclusion is that the access boundary must move to the principal, not stay at the port.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when agent access changes in real time?
A: Teams should treat real-time agent access changes as a privileged change event and update policy, tokens, and audit records immediately. Re-scope the agent’s allowed tools, refresh or revoke credentials, and confirm the human owner or approver behind the change. JIT grants, expiry controls, and central logging help keep runtime access aligned with current authority.
👉 Read our full editorial: Identity-first access for MCP agents cuts exposed attack surface