<Post

Securing MCP in Production: Defense-in-Depth beyond the Gateway

MCP deployments need four separate control layers: safe tool execution, an isolated management plane, bounded outbound trust, and semantic integrity. The gateway still handles authentication, authorization, auditing, and registration, but it cannot prevent shell injection inside a tool, protect an exposed inspector, constrain egress, or detect a tool manifest changing after approval.

The practical rollout is concrete: block unsafe exec/eval patterns in CI, authenticate and isolate management surfaces, apply egress allow-lists with scoped tokens, then pin manifests and review material diffs. The article has no substantive reader comment section; its strongest evidence is the concrete CVE examples and four-week deployment plan.

@Taulet I don’t get it. Isn’t MCP on the server side basically an API handler? What are these guys talking about?

I largely dismissed MCP as a clunky way to expose what clanky way to expose what any APIs can expose, with a benefit of handling the authentication (tokens) without agent touching secret material, but that can be handled in other ways.

What am I missing?