Decoding MCP Gateway Security: ID-Only vs. Parameter-Level Authorization
silentw111 · reddit · 2026-08-19
The author (an agent authorization tool builder) analyzes MCP gateways, arguing the real differentiator is what data the authorization decision can see. They categorize tools into three tiers:
- Tier 1: Identity Only.
- Examples: Kong (MCP Tool ACLs), Permit (MCP Gateway).
- Mechanism: Filters tools based on identity. Cannot express granular rules like "allow refund only for this customer under this amount."
- Tier 2: Arguments Visible via Code.
- Examples: Docker (MCP Gateway interceptors), DashClaw.
- Mechanism: Interceptors receive the full JSON (tool name + arguments) and can block it via custom code (scripts/containers/HTTP). Offers parameter-level enforcement but requires developer maintenance.
- Tier 3: Policy-Language Rules.
- Examples: agentgateway (Linux Foundation).
- Mechanism: Uses CEL-based rules against MCP invocations. The challenge lies in confirming if argument variables are in scope.
The Blind Spot: All tools authorize calls individually. None prevent a sequence of individually allowed calls from accumulating into a malicious action (e.g., Read Customer -> Read Billing -> Write to External).
The author suggests asking vendors specifically about parameter-level evaluation and session-based accumulation detection.
More from coding & agent
- Building E-commerce Agent Systems: Focus on the Layers, Not Just the Model — aishashok14 · 2026-08-19
- Ax introduces named profiles to normalize OpenAI-compatible API quirks — dosco · 2026-08-19
- Uber Reportedly Caps Cursor/Claude Code Usage as AI Coding Bills Balloon — Pavan_Belagatti · 2026-08-19
- User prefers reliable agents over 5% benchmark gains: don't lose the plot mid-task — Vegetable_Basket8574 · 2026-08-19
- Agents fail in production due to memory loss, not reasoning — SucceededMind · 2026-08-19
- Dev View: Bearish on Programming Tools Lacking Agent-Friendly Interfaces — sh_reya · 2026-08-19