Securing MCP in Production: Defense-in-Depth beyond the Gateway
MCP deployments need four separate control layers: safe tool execution, an isolated management plane, bounded outbound trust, and semantic integrity. The gateway still handles authentication, authorization, auditing, and registration, but it cannot prevent shell injection inside a tool, protect an exposed inspector, constrain egress, or detect a tool manifest changing after approval.
The practical rollout is concrete: block unsafe exec/eval patterns in CI, authenticate and isolate management surfaces, apply egress allow-lists with scoped tokens, then pin manifests and review material diffs. The article has no substantive reader comment section; its strongest evidence is the concrete CVE examples and four-week deployment plan.