Securing MCP: governing Model Context Protocol tool calls.
The Model Context Protocol (MCP) lets AI agents and apps call external tools and servers. That power is exactly why MCP needs governance. This guide explains the risks and how an MCP gateway brings every tool call under control.
What is MCP?
The Model Context Protocol (MCP) is an open standard that lets AI clients — coding-agent CLIs, desktop apps, and editors like Cursor, Windsurf, and VS Code — connect to external tools and data sources. An MCP server can read files, hit internal APIs, or run actions on the agent's behalf.
Why MCP needs security and governance
Ungoverned, MCP is a governance blind spot in three ways:
- Shadow tools. Anyone can point an agent at any MCP server. Security has no inventory of what's reachable and no way to say no.
- No audit trail. Tool calls execute directly from the client. When something goes wrong, there's no record of what was called or with what arguments.
- Credential sprawl. Tokens end up pasted into local client configs — copied, synced, and leaked far beyond where they should live.
What an MCP gateway does
An MCP gateway proxies every MCP client through one governed entry point. A good gateway provides:
- An approved-server registry — only sanctioned MCP servers are reachable; everything else is blocked.
- A full tool-call audit — which server, which tool, which arguments, from whom — stitched to one employee identity.
- Credential brokering — secrets stay in the gateway, not in client configs.
Fail-open, and on your infrastructure
Because the gateway sits in the path of real work, it must be fail-open: if it's down, slow, or wrong, it can never hang an engineer's agent. And because tool calls touch your systems and credentials, the gateway should run self-hosted — on-premises or in your own cloud — so no tool call is ever proxied through a third party.
How Sentinel Telemetry does it
ST Gate is our in-house MCP gateway: one governed door for every MCP client, with an approved-server registry, full tool-call audit, and credential brokering — fail-open, and deployed entirely on your infrastructure. Read about ST Gate → or see the broader picture in our AI coding agent governance guide.