Enterprise MCP Gateway: Requirements Before You Buy or Build

An enterprise MCP gateway should integrate with your identity provider, enforce policy per tool, require human approval for risky actions, keep exportable audit logs, isolate tenants and come with documented security and data terms. The word “enterprise” on a product page proves none of that, so test each requirement before you buy or build.

Why enterprises need more than a proxy

A small team can get away with a Bearer key in a config file. A company cannot. Hundreds of people, several assistants, regulated data and a security review process turn a convenience into a governance problem. The questions change from “can it route calls” to “who is accountable for each call.”

Enterprise rollouts also tend to go wrong in the same ways: tools get connected faster than they are reviewed, credentials leak into laptops, and nobody can answer an auditor who asks what an agent did last Tuesday. A gateway is the place to fix that, provided it has the right controls.

The requirements list

Requirement	What good looks like	How to test it
Identity integration	Callers map to people or services in your identity provider, with role-based access	Disable a test user and confirm access ends
Per-tool policy	Policy names tools and data classes, not just endpoints	Call a forbidden tool by name and confirm refusal
Approval workflow	Irreversible or external actions pause for a named approver	Trigger one and verify nothing runs before approval
Audit logging	Caller, tool, arguments, result, time, exportable to your SIEM	Export a day of logs and answer a sample question from them
Tenant isolation	Separation enforced below the app layer	Review the data model and ask for the isolation design
Secrets handling	Upstream credentials encrypted and never exposed to the model	Inspect logs and tool output for tokens
Limits and quotas	Per-key, per-tool or per-run ceilings	Exceed one deliberately and observe the response
Compliance artefacts	Data processing terms, security documentation, sub-processor list	Request and read them
Operability	Monitoring, upgrade path, support commitments	Ask for the runbook and incident history

Identity: the first thing to check

The MCP authorization specification is based on OAuth, and enterprises typically want callers tied to their identity provider. The Microsoft project, for example, authenticates with Entra ID bearer tokens and uses application roles to separate read and write access, according to its README. Whatever you choose, confirm that revoking a person’s identity ends their agents’ access, and that service identities for automated agents are distinct from personal ones.

Standalone Bearer keys are not wrong, but at scale they need an owner, an expiry policy and an inventory. If a gateway offers only shared keys, plan the process around them or look elsewhere.

Policy: tools and data classes

Enterprise review is much faster when policy speaks in terms a reviewer understands. Listing forty tool names is tiring. Grouping them by what data they touch is not. BusinessMCP’s description of its access model uses data classes: revenue, contact personal information, enrichment, behaviour and messaging, with restricted keys advertising fewer tools and having output redacted. Its published tool catalogue also marks plan gates and approval requirements per tool, so a reviewer can see in one place which actions can run unattended.

You do not have to buy that product to borrow the idea. Whatever you run, keep a table of tools, their risk level and the data they touch, and require a named owner to approve additions. Our tool allowlist guide shows a template.

Approval and accountability

OWASP’s list of risks for LLM applications includes excessive agency, meaning an agent with more capability than its task warrants. The enterprise response is to design for least privilege and to put a human in front of consequential actions. Define in advance which actions need approval, who may approve, how long a request may wait and what happens if nobody responds. The decision belongs in policy, not in a prompt.

Key takeaway: in an enterprise, the gateway is where accountability is enforced. If an action cannot be traced to an identity and a decision, it should not be possible.

Build, buy or host

Route	Strengths	Costs and risks
Build on open source	Full control, runs in your network	Staff time, security ownership, upgrades
Self-host a vendor product	Control with vendor support	Licence cost, still need operations
Hosted gateway or endpoint	Fast, no infrastructure	Data leaves your boundary, vendor dependence

A hosted endpoint such as BusinessMCP’s is described on its managed MCP hosting page, which also notes that an enterprise tier adds custom access policies, unlimited usage and custom MCP servers for internal systems. Pricing for that tier is not published there, so budget a conversation, not a number. For regulated data, ask for the data processing terms and security documentation before any connection is made; BusinessMCP lists a DPA and security page on its site, which are the places to start reading.

For plan details, BusinessMCP lists its tiers on a pricing page; the hosting page cited above gives the overall range as Free to $499 per month but does not list each tier’s price, so verify there.

Rollout plan that survives a security review

1. Inventory the tools you intend to expose and classify them.
2. Pilot with one team and read-only tools.
3. Write the policy as code or a reviewed document, with owners.
4. Turn on logging first and confirm you can query it.
5. Add write tools one at a time, each with an approval rule.
6. Run a tabletop exercise: a key leaks, an agent follows an injected instruction. Can you contain and explain it?
7. Review quarterly and remove unused tools and keys.

What to ask in procurement

• What is logged, for how long, and can we export it?
• How are upstream credentials stored and who at the vendor can access them?
• Which MCP protocol versions do you support, and what is the deprecation policy?
• Has the product had an independent security assessment, and can we see a summary?
• What happens to our data and logs if we leave?

Vendors that answer plainly, including about gaps, are easier to trust. For a broader decision frame see the evaluation checklist, and for baseline technical controls read MCP gateway security.