Topic starter
24/06/2026 8:42 pm
TL;DR: AI systems can standardize tool access through JSON-RPC, OAuth 2.1, and protocol mediation, while also exposing where current gateway and identity controls still need discipline, according to Kong. The underlying issue is not just connectivity but governing who or what can invoke tools safely across agent workflows.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “# Kong AI/MCP Gateway and Kong MCP Server Technical Breakdown”.
Key questions
Q: What breaks when MCP access is built on shared API tokens?
A: Shared API tokens break accountability first.
Q: Why does on-behalf-of OAuth matter for AI agent security?
A: It prevents the agent from directly holding the downstream service token, which reduces the blast radius if the agent logic is compromised.
Q: How should security teams govern MCP gateway logs and telemetry?
A: They should log the identity context, tool invoked, validation result and outcome for each request, then review those records as entitlement evidence.
Practitioner guidance
- Define tool-level authorization boundaries Map each MCP tool to a discrete approval and entitlement rule so access is granted per capability, not per broad gateway route.
- Validate token audience and scope at invocation Require the gateway to verify OAuth token validity, audience and scope before forwarding any MCP request to a server.
- Log MCP-specific identity telemetry Capture host, client, tool name, token validation result and request outcome so investigations can reconstruct agent activity precisely.
Bottom line: MCP standardises how AI agents reach tools, but the real governance problem is still who may invoke what, under which context and with what proof.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:26 am
Protocol mediation does not solve identity governance by itself: MCP reduces integration chaos, but it does not answer who may invoke which tool, under what conditions, or with what revocation logic. The governance burden shifts from connection setup to runtime authorization and auditability. That makes the gateway an identity control point, not just an API transport layer.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between protocol mediation and access governance for MCP?
A: Protocol mediation moves messages between client and server, while access governance decides whether the call should happen at all. A gateway can translate MCP traffic perfectly and still fail as a control if it does not enforce scope, audience, revocation and audit requirements.
👉 Read our full editorial: Kong MCP gateway shows where AI agent access control breaks