In short:An MCP gateway sits between agents and MCP servers and inspects every call. It can authenticate the agent, exchange credentials, filter tools and enforce policy in one place. It gives security teams a single choke point for agent traffic instead of separate rules in each tool.
How does it work?
Agents point at the gateway instead of the servers. The 2026-07-28 MCP specification added header routing to help gateways.
What does it look like in practice?
Aembit's MCP Identity Gateway runs as a customer-hosted VM and enforces policy on every MCP request.