01 / The operating case
What changes in a real workflow?
An enterprise routes approved MCP calls through a gateway, while a developer tool connects directly to the same underlying server.
- 01Client / task
- 02MCP server
- 03Tool call + arguments
- 04Downstream effect
02 / Decision contract
What the executor must check
Enforce gateway routing, authenticate principals, inspect tool name and arguments, and check the protected executor for bypass paths.
Architecture review / negative test
Make the boundary testable.
A gateway can centralize controls only for traffic that actually traverses it. Diagram client-to-gateway, gateway-to-server and server-to-downstream-API paths. Determine whether the gateway can see arguments and task context, and whether its decision is binding on a server with independent credentials.
03 / Failure and evidence
What goes wrong, and what can be proven?
A gateway records clean traffic yet a direct server connection uses a broad credential without the same policy.
Compare gateway log IDs with server invocation logs and investigate unmatched actions.
04 / Canonical scope
Why this reference stands alone
MCP tool authorization owns the decision for one call; this page owns gateway topology and bypass limitations.
Primary references