An MCP gateway has to know a read from a write

Wed, 28 Oct 2026 00:00:00 +0000

In April I wrote that my MCP proxy let you say "engineer A gets no access to Slack tools", but not "engineer A can read but not write". I called it "a start, not mature access control". Six months later that sentence is the part of the post I think about most, because it was the whole problem hiding in one line.

The governance problem MCP created without asking was about token sprawl. Every engineer had generated their own Sentry, Slack and Grafana tokens, and nobody could answer how many places we'd have to revoke when someone left. The fix was to put mcp serve in the middle. One endpoint for every AI client, service tokens on the server, one credential per person. That moved the tokens. It didn't decide what an agent is allowed to do with them, and that is the part that turns a proxy into an MCP gateway.

Ai-Agents on Thiago Avelino

An MCP gateway has to know a read from a write