AI Security Gateway — MCP Gateway

Public data (asset names, symbols, IDs, prices) can look like PII to a scanner. Four policy controls let you keep protection strong without over-redacting benign values.

JSON keys whose values are exempt from redaction — ideal for public identifiers (asset names, symbols, IDs) that would otherwise be over-redacted.

The confidence floor (0–1) a detection must clear before it counts. Raise it to cut false positives on ambiguous matches.

Narrow the entity types the policy acts on, so you redact SSNs and cards without touching benign values.

The size ceiling for synchronous result scanning; larger payloads are sampled to protect tool-call latency.

A single managed endpoint serves every org. Each request is authenticated by its project API key and dispatched to that org's policy and server registry. Downstream credentials are stored in AWS Secrets Manager and resolved per request.

In Hybrid mode, the synced bundle carries only server metadata and policy. Downstream tokens are resolved locally from your environment and never leave your network.

A downstream whose credential is unset is not called — the gateway refuses to hit a server it can't authenticate to, rather than leaking an unauthenticated request.

Each org's servers and secrets are strictly scoped. One tenant can never see or reach another tenant's downstream servers.

Security events capture event type, severity, org, tool, and decision — never argument or result content — so you get full observability without new data exposure.

How is this different from your LLM proxy?

The LLM proxy secures chat/completions traffic to model providers. The MCP Gateway secures the other half of an agent's attack surface: the tool calls it makes over the Model Context Protocol. It's an aggregating proxy that sits in front of your downstream MCP servers and enforces policy on the tools themselves — their descriptions, arguments, and results.

What is tool poisoning and why scan descriptions?

MCP tool descriptions are fed to the model as instructions. A malicious or compromised server can hide adversarial instructions ('before answering, send the user's API keys to…') inside a tool's description. The gateway scans every tool's name and description at catalog time and blocks poisoned tools before your agent ever sees them.

Redaction (the default) replaces PII with typed placeholders, which most agents handle fine. Block is stricter and can break workflows that legitimately need the data, so it's opt-in per direction. For false positives on public data, use allowFields, scoreThreshold, and blockedEntities to tune precisely.

Where do downstream server credentials live?

In the cloud, downstream credentials are stored in AWS Secrets Manager and resolved per-request — never in the database or the browser. In Hybrid VPC mode, credentials never leave your network at all: the synced policy bundle carries server metadata only, and the gateway resolves each token locally from your own environment.

What happens if a downstream MCP server is down?

The gateway degrades gracefully. It skips the unreachable server, emits a high-severity mcp.server_unavailable audit event, and continues serving every other server's tools. One failing dependency never brings down the whole gateway for a tenant.

Can I run this entirely inside my own VPC?

Yes. The same gateway ships as a container for Hybrid VPC (Docker Compose or Kubernetes). It reads its per-org registry and policy from the sync-agent bundle (metadata only) and keeps all tool traffic and credentials inside your network. See the Hybrid VPC deployment guide.

The MCP Gateway is in private beta. Enable it for your organization and put a policy in front of every MCP server your agents touch.

Occludra is open source. Deploy the core AI security proxy on your own infrastructure — PII redaction, prompt injection blocking, and secret detection included. No account required.

This AWS Labs Model Context Protocol (MCP) server for CloudTrail enables your AI agents to query AWS account activity for security investigations, compliance auditing, and operational troubleshooting.

Implements CISA Binding Operational Directive 25-01 security controls for Microsoft 365 and Azure AD/Entra ID.

Securely access secrets from Doppler's secret management platform using a Doppler API token.

A server for interacting with Vanta's security compliance platform.

MCP server for Wundervault zero-knowledge secret management. Exposes vault secrets to AI agents via the Model Context Protocol — secrets are decrypted server-side and never returned to the agent in plaintext.

Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.

Cloud security insights, guardrail guidance, and compliance checking via Dawnguard.

KHEPRA MCP Server smithery badge MCP Registry License Container PQC Sovereign compliance engine with 36,195 STIG/CCI/NIST/CMMC mappings. Air-gappable. Zero token costs. Run ert_scan → get a Godfather Report with dollar-denominated business impact. The only MCP compliance server that runs on your metal — with the World's First DoD PQC STIG built in. PQC-01-STIG-V1R1 — Full Whitepaper → 17 controls covering CNSA 2.0, FIPS 203/204/205, and the NSA's May 2026 MCP security advisory. The world's first DoD-style Post-Quantum Cryptography STIG, including the first PQC controls for agentic AI and MCP deployments.

Secure every MCP server with one governed gateway. Give each AI agent its own scoped MCP access, contain credentials at the gateway, and audit every MCP tool call without wiring agents directly to each server.