Article: Securing MCP in Production: Defense-in-Depth beyond the Gateway

Address MCP security as four control layers instead of one protocol feature. There needs to be an enforcement point for each of execution, management infrastructure, outbound trust, and semantic integrity. Use a gateway for authentication, authorization, and audit. Do not expect it to detect semantic abuse or protect the management plane. Pin tool manifests at registration in order to avoid post-approval schema drift and rug-pull behavior. Consider the diff-based review as the operational model, not a binary allow-or-deny gate. Use outbound egress control and scoped tokens. The Azure MCP Server SSRF (CVE-2026-26118) showed that inbound authentication alone is not enough. Prioritize operationalization with CI gates, isolated tooling, diff-based manifest review, and behavioral baselines. The specification will catch up. Production cannot wait. By the end of 2025, my team decided that MCP would be our integration layer for a production multi-agent platform. We simply asked one question: What architectural controls do we need in place so we could trust automated (tool based) execution at scale? The short answer, and the argument of this piece, is that we need four layers: safe tool execution, an isolated management plane, a bounded outbound trust boundary, and semantic integrity, each enforced at its own point…