Design an MCP gateway for a company's internal agents

security, mcp, agents, oauth

Prompt

Your company wants a central MCP gateway that lets every internal AI agent, a support bot, a coding agent, a Slack bot, talk to three third-party SaaS APIs and your own GitHub org, instead of each agent integrating directly. Design the gateway's security model.

Interviewer's answers to clarifying questionsopen after you have asked your own

Scale? ~50 engineers use a coding agent through the gateway; ~10 other internal agents register as clients.
What's behind the gateway? GitHub (private and public repos), a CRM, and a ticketing system, none of which speak MCP natively.
Today's state? Each agent currently uses one shared, org-wide PAT/API key with broad scope, the same scope used by the CI pipeline.
Threat model of concern? A compromised or malicious MCP tool server (supply-chain/rug-pull risk) and token misuse/confused-deputy attacks across clients.
Compliance ask? Security wants to know, for any given week, which agent sessions combined a sensitive read with an external write.
Latency budget? The gateway hop should add no more than ~50ms p99 to a tool call.

Follow-upsafter your high-level design

How do you validate that a token presented to your gateway was actually issued for your gateway (audience claim), not replayed from another service?
One of the three SaaS providers doesn't support RFC 8707 resource indicators. What do you do?
Six months after approval, a third-party MCP tool server silently changes its tool description between two tools/list calls. How do you detect and respond to that drift?
Security asks for a report of every session that read a private GitHub repo and then wrote to a public one in the same flow. Can your current design produce that?
You need to onboard a fourth SaaS provider in a week. What part of your design lets you do that without a new security review from scratch?

Answer first: out loud, on paper, or with the interview prompt above. Then compare with the rubric.