Topic starter
24/06/2026 8:42 pm
TL;DR: MCP standardises how AI agents reach tools, Kong reports, but it still leaves the core question of who may invoke what, under which context, and with what proof. Gateway teams must treat runtime authorization, telemetry and blast radius as control decisions, not just plumbing.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “# Kong AI/MCP Gateway and Kong MCP Server Technical Breakdown”.
Key questions
Q: Why does on-behalf-of OAuth matter for AI agent security?
A: It prevents the agent from directly holding the downstream service token, which reduces the blast radius if the agent logic is compromised.
Q: How should security teams govern MCP gateway logs and telemetry?
A: They should log the identity context, tool invoked, validation result and outcome for each request, then review those records as entitlement evidence.
Q: What breaks when MCP access is built on shared API tokens?
A: Shared API tokens break accountability first.
Practitioner guidance
- Define tool-level authorization boundaries Map each MCP tool to a discrete approval and entitlement rule so access is granted per capability, not per broad gateway route.
- Validate token audience and scope at invocation Require the gateway to verify OAuth token validity, audience and scope before forwarding any MCP request to a server.
- Log MCP-specific identity telemetry Capture host, client, tool name, token validation result and request outcome so investigations can reconstruct agent activity precisely.
Bottom line: MCP standardises how AI agents reach tools, but the real governance problem is still who may invoke what, under which context and with what proof.
Glossary terms: MCP Gateway, Tool Invocation, Token Introspection, Identity Blast Radius
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 22 hours ago by NHI Mgmt Group
25/06/2026 5:26 am
Protocol mediation does not solve identity governance by itself: MCP reduces integration chaos, but it does not answer who may invoke which tool, under what conditions, or with what revocation logic. The governance burden shifts from connection setup to runtime authorization and auditability. That makes the gateway an identity control point, not just an API transport layer.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between protocol mediation and access governance for MCP?
A: Protocol mediation moves messages between client and server, while access governance decides whether the call should happen at all. A gateway can translate MCP traffic perfectly and still fail as a control if it does not enforce scope, audience, revocation and audit requirements.
👉 Read our full editorial: MCP gateway mediation still leaves AI tool access to policy
This post was modified 22 hours ago by NHI Mgmt Group