Top MCP Governance Platforms in 2026: Evaluating Gateways and Security Controls

TL;DR

• Model Context Protocol (MCP) governance platforms secure autonomous tool execution, enforce least-privilege scoping, and prevent unauthorized data exfiltration across enterprise AI workflows.
• Gateways serve as the central policy enforcement point between AI clients and MCP servers, handling identity federation, tool filtering, rate limiting, and immutable audit logging.
• Bifrost is the leading solution for enterprise deployments, combining an ultra-low-latency 11-microsecond gateway with Bifrost Edge for fleet-wide endpoint discovery and on-device enforcement.
• Traditional API gateways like Kong and network proxies like Cloudflare offer strong ingress controls but lack specialized MCP awareness such as prompt-time tool filtering or client-side server isolation.
• Organizations deploying agentic workflows require dual-layer governance: network gateways for centralized server management and endpoint agents to eliminate shadow MCP servers on developer workstations.

Model Context Protocol (MCP) integrations in production environments expanded rapidly over the past year as autonomous coding agents and workplace assistants gained direct access to internal databases, file systems, and enterprise APIs. Bifrost, an open-source AI gateway written in Go, provides centralized routing, tool filtering, and runtime controls designed specifically for high-throughput AI workloads. Without structured governance, agentic tool execution exposes organizations to prompt injection attacks, tool poisoning, privilege escalation, and unintended data egress. This article evaluates the top MCP governance platforms available in 2026, breaking down how each handles authentication, runtime policy enforcement, and client-side tool discovery.

Key Criteria for Evaluating MCP Governance Platforms

Evaluating infrastructure for MCP governance requires looking past standard API management capabilities. MCP is a stateful, bi-directional protocol where AI models actively discover schemas and initiate tool executions based on prompt context. Traditional layer-7 proxies cannot inspect the semantic intent of tool calls, nor can they determine whether an agent has drifted into executing unapproved actions.

A production-grade MCP governance platform must fulfill specific technical requirements across five architectural pillars:

Evaluation Criterion	Technical Requirement	Architectural Purpose
Tool Filtering and Scoping	Dynamic restriction of exposed schemas per user, team, or virtual key	Prevents models from seeing or calling unauthorized tools; reduces prompt token overhead
Latency and Throughput	Sub-millisecond internal proxy latency with high concurrent request processing	Prevents infrastructure bottlenecks during multi-step, chained agent tool invocations
Identity and Access Control	OIDC federation, per-user OAuth token propagation, and granular RBAC	Maps AI agent actions back to authentic human identities and scoped non-human credentials
Endpoint and Desktop Visibility	Detection and enforcement on developer workstations and local MCP hosts	Prevents shadow MCP installations in desktop clients like Claude Desktop and Cursor
Security Guardrails and Auditing	Real-time payload inspection, secrets detection, PII masking, and immutable logs	Blocks tool poisoning and prompt injections while satisfying SOC 2 and ISO 27001 requirements

Platforms that focus exclusively on the network edge leave developer laptops unmonitored, allowing shadow MCP servers to execute arbitrary local code via standard input and output (STDIO) transport. Conversely, developer-centric libraries often lack enterprise security integrations such as Single Sign-On (SSO), System for Cross-domain Identity Management (SCIM), and centralized audit logging. Selecting the right platform requires balancing developer velocity with rigorous infrastructure control.

Top MCP Governance Platforms Compared at a Glance

The following matrix compares the leading platforms providing MCP governance, tool mediation, and agent access controls in 2026:

Platform	Deployment Model	Primary Governance Focus	Tool Scoping Method	Added Latency	Open Source
Bifrost	Self-hosted (VPC, Bare Metal, K8s, Air-gapped)	Comprehensive (Gateway control plane + Endpoint agent)	Virtual keys, Access profiles, Tool groups	11 microseconds	Yes
Kong AI Gateway	Self-hosted, Hybrid, Managed Cloud	API gateway edge control and multi-protocol proxying	Plugin-based route and consumer policies	2 to 5 milliseconds	Partial (Core OSS)
Cloudflare Access & AI Gateway	Globally Distributed Cloud Edge	Edge network zero trust and ingress filtering	Cloudflare Access policies and service tokens	5 to 15 milliseconds	No
Composio	Managed Cloud, Dedicated Hybrid	Agent-to-SaaS tooling and managed authentication	Scoped user endpoints and toolkit action allowlists	10 to 30 milliseconds	No
Obot	Self-hosted (Kubernetes-native)	Agent runtime management and tool sandbox isolation	Workspace and team permission bindings	5 to 12 milliseconds	Yes
Docker MCP Runtime	Local Workstation, CI/CD, Container Host	Host-level process isolation and filesystem sandboxing	Containerized capability flags and volume mounts	OS container overhead	Yes

1. Bifrost: Unified Gateway Control Plane and Fleet-Wide Endpoint Enforcement

Bifrost ranks as the top MCP governance platform for enterprises due to its unified architecture, high-performance Go core, and end-to-end policy enforcement spanning both infrastructure and endpoint devices. Rather than treating MCP tooling as an afterthought on top of legacy API proxies, Bifrost was constructed specifically to govern modern AI workloads.

┌────────────────────────────────────────────────────────┐
│               Enterprise Clients & Agents              │
│       (Claude Code, Cursor, Custom Agents, SDKs)       │
└───────────────────────────┬────────────────────────────┘
                            │
                            ▼
┌────────────────────────────────────────────────────────┐
│                   Bifrost AI Gateway                   │
│                                                        │
│  ┌─────────────────┐ ┌──────────────────────────────┐  │
│  │  Virtual Keys   │ │   Access Profiles & RBAC     │  │
│  └────────┬────────┘ └──────────────┬───────────────┘  │
│           │                         │                  │
│           ▼                         ▼                  │
│  ┌──────────────────────────────────────────────────┐  │
│  │      MCP Tool Filtering & Tool Groups Engine     │  │
│  └──────────────────────────┬───────────────────────┘  │
│                             │                          │
│  ┌──────────────────────────┴───────────────────────┐  │
│  │ Security Engine: Secrets Detection & Guardrails  │  │
│  └──────────────────────────┬───────────────────────┘  │
└───────────────────────────┬─┼──────────────────────────┘
                            │ │
         ┌──────────────────┘ └──────────────────┐
         ▼                                       ▼
┌─────────────────────────────────┐   ┌──────────────────────────┐
│   Private Enterprise Backends   │   │ Bifrost Edge (Endpoints) │
│ (Databases, Internal APIs, MCP) │   │ (Fleet Discovery & MDM)  │
└─────────────────────────────────┘   └──────────────────────────┘

High-Throughput Gateway Architecture

At the gateway layer, Bifrost acts as both an MCP client and an MCP server. It connects directly to upstream tool servers, discovers their capabilities, and exposes a curated, single endpoint to AI clients such as Claude Desktop, Cursor, or autonomous agent frameworks. Sustained benchmarks document that Bifrost introduces only 11 microseconds of overhead per request at 5,000 requests per second, ensuring that complex, multi-step agent reasoning loops remain unhindered by proxy bottlenecks.

Bifrost enforces fine-grained governance through virtual keys. Administrators attach strict budget and rate limits to these keys, preventing rogue agent execution loops from consuming excessive resources. Crucially, Bifrost provides native MCP tool filtering, which allows security teams to define exactly which tools a specific virtual key can view or invoke. For example, a customer service agent can be granted access to read-only ticketing tools, while administrative modification tools remain entirely hidden from the model context.

For complex orchestrations, Bifrost includes an advanced Code Mode execution pipeline. Instead of passing repetitive, token-heavy JSON schemas back and forth across multiple model turns, Bifrost enables models to generate structured Python scripts that execute within a sandboxed environment, reducing token consumption by over 50% and cutting latency by 40%. Furthermore, enterprise teams can use MCP with federated authentication to transform internal REST APIs into compliant MCP endpoints without writing bespoke glue code.

Closing the Shadow AI Gap with Bifrost Edge

Network gateways can only govern traffic that applications are explicitly configured to send through them. In practical enterprise environments, software developers frequently run tools like Claude Desktop, Cursor, and terminal coding agents that connect directly to unmanaged local or remote MCP servers. This unmonitored activity constitutes shadow MCP usage, which bypasses perimeter security.

Beyond routing, Bifrost applies governance and security controls (virtual keys, budgets, guardrails, audit logs) centrally, and Bifrost Edge extends that same governance and security to AI traffic on employee machines, with endpoint enforcement on each device.

Operating as an endpoint companion to the Bifrost gateway, Bifrost Edge runs quietly on macOS, Windows, and Linux devices, delivering comprehensive app governance and MCP governance across the enterprise fleet. Bifrost Edge provides several critical operational controls:

• Fleet-Wide MCP Discovery: Scans and catalogs MCP configurations across developer applications, including Claude Code, Cursor, Codex CLI, and Gemini CLI, reporting all active servers to an administrative console.
• On-Device Enforcement: Administrators can approve or deny discovered MCP servers centrally; denied servers are actively blocked on the physical endpoint before any socket connection or STDIO process executes.
• Seamless Policy Propagation: Connects via browser-based Single Sign-On (SSO) to automatically sync enterprise access profiles, ensuring virtual key budgets and security guardrails apply to workstation tools.
• MDM Deployment: Supports silent organizational rollouts via MDM integrations such as Microsoft Intune, Jamf, Kandji, Omnissa Workspace ONE, and JumpCloud.

Note: Bifrost Edge is currently in alpha and available via early access registration.

Best for: Enterprise organizations requiring a unified, open-source AI and MCP control plane that couples ultra-low latency gateway routing with workstation-level endpoint discovery and policy enforcement.

2. Kong AI Gateway: Traditional API Management Adapted for MCP

Kong AI Gateway extends Kong's established open-source reverse proxy and API platform into generative AI and Model Context Protocol workflows. Kong approaches MCP governance through its modular plugin architecture, allowing platform engineers who already operate Kong Gateway clusters to apply traditional layer-7 traffic policies to AI systems.

Kong allows teams to route MCP traffic over Server-Sent Events (SSE) and HTTP transports, placing tools behind centralized access control lists, mutual TLS (mTLS), and OpenID Connect (OIDC) identity verification. Kong functions primarily at the enterprise network boundary:

• Centralized Ingress Proxying: Directs client requests to upstream MCP servers through defined routes and services.
• Enterprise Rate Limiting: Applies token-bucket and sliding-window rate limits across MCP consumers to protect backend servers from denial-of-service conditions caused by runaway loops.
• Protocol Transformation: Ingests incoming REST or GraphQL calls and routes them toward AI-compatible service definitions.
• Plugin Ecosystem: Teams can integrate third-party logging, Prometheus metrics, and OpenTelemetry tracing using standard Kong plugins.

While Kong is effective at managing large volumes of traditional API traffic, it exhibits limitations when applied to granular MCP agent governance. Kong does not offer native endpoint visibility into workstation-level tools like Claude Desktop or terminal coding agents. Additionally, configuring dynamic, schema-level tool filtering based on conversational context requires writing custom Lua or Go plugins, making fine-grained tool permissions complex to maintain at scale compared to dedicated MCP gateways.

Best for: Organizations with substantial existing investments in Kong API Gateway infrastructure seeking to route centralized, server-hosted MCP traffic through their existing network edge.

3. Cloudflare Access and AI Gateway: Edge Security and Zero Trust Ingress

Cloudflare AI Gateway combined with Cloudflare Access provides a globally distributed edge proxy for managing external AI traffic. Cloudflare positions its security platform as a protective layer in front of remotely hosted MCP servers.

By routing MCP interactions through Cloudflare's network, organizations can apply Zero Trust network access (ZTNA) policies to agent tool calls:

• Identity-Aware Ingress: Enforces identity checks via Okta, Ping Identity, or Microsoft Entra ID before an AI client or agent can establish an SSE connection to a protected MCP server.
• DDoS and Web Application Firewall (WAF): Protects public-facing MCP endpoints from volumetric attacks, malicious payloads, and unauthorized bot scraping.
• Edge Analytics and Caching: Caches static responses and logs request volumes, latencies, and costs across distributed points of presence.
• Service-to-Service Tokens: Issues scoped service tokens to automated agents to prevent unauthenticated access to downstream tools.

Cloudflare's architecture is well-suited for securing public cloud endpoints and remote agent-to-tool connections. However, it does not address local process communication. Many developer MCP servers operate locally via STDIO pipes inside desktop environments, which do not pass through Cloudflare's network edge. Furthermore, Cloudflare AI Gateway does not parse MCP-specific protocol messages to restrict tool visibility dynamically per user session, functioning instead primarily as a transport-level proxy.

Best for: Teams deploying publicly accessible, remote MCP servers that require global edge caching, DDoS mitigation, and Zero Trust identity gating at the perimeter.

4. Composio: Developer Tooling and Managed Authentication Layer

Composio focuses on developer-first tool management, offering an extensive catalog of pre-built integrations for external SaaS applications. While it serves primarily as an integration platform, Composio provides focused MCP governance capabilities designed to help developers connect agents to third-party services safely.

Composio's approach to MCP governance centers on tool-level authorization and managed identity:

• Action-Level Authorization: Enforces granular allowlists and denylists on specific API actions. For example, an agent can be permitted to read GitHub issues while administrative repository deletion actions remain explicitly blocked.
• Managed Authentication and OAuth: Manages OAuth 2.0 refresh flows, secret storage, and per-user credential injection, preventing agent frameworks from handling raw API tokens directly.
• Pre-Built Integration Catalog: Provides managed MCP endpoints for hundreds of business platforms, including Jira, Slack, Salesforce, and Google Workspace.
• Scoped User Endpoints: Generates separate MCP server endpoints for different teams or operational contexts.

Composio simplifies the process of giving agents safe access to commercial SaaS platforms. However, it is fundamentally a developer integration service rather than an enterprise infrastructure proxy. Organizations cannot use Composio to govern local CLI agents, secure internal bespoke databases running within private clouds, or inspect raw on-premise network sockets without routing requests through Composio's platform.

Best for: Product engineering teams rapidly assembling autonomous agents that require managed OAuth authentication to popular third-party SaaS applications.

5. Obot: Open-Source Agent Orchestration and Tool Sandboxing

Obot, created by the team behind Rancher, is an open-source autonomous agent platform that incorporates a dedicated MCP gateway layer. Obot focuses on running, sandboxing, and governing agents and their tools within Kubernetes infrastructure.

Obot addresses MCP governance by isolating execution environments and managing access permissions directly:

• Kubernetes-Native Sandboxing: Runs MCP servers and agent scripts inside containerized environments, preventing compromised tools from executing unauthorized commands on host servers.
• Enterprise Identity Integration: Federates with corporate identity providers to govern which users and automated service accounts can trigger specific tool configurations.
• Dynamic Server Registration: Maintains a catalog of internal and external MCP servers, allowing administrators to configure tool availability per workspace.
• Audit Trails: Records conversational turns and the specific tool calls triggered by agents during task execution.

Obot provides solid protection for autonomous agents operating inside controlled infrastructure. However, its architecture is tightly coupled with its own agent runtime environment. It is less suitable for organizations seeking a lightweight, high-performance proxy to place in front of arbitrary external clients like Claude Code or Cursor without adopting Obot's broader agent execution stack.

Best for: Platform engineering teams running containerized AI agent workloads in Kubernetes who require an integrated execution sandbox and tool control plane.

6. Docker MCP Runtime: Container-Level Isolation for Local Tools

Docker has established itself as an essential tool for securing local MCP execution through containerization. Rather than acting as a network gateway, Docker provides process-level governance, isolating local MCP servers from the host operating system.

Because MCP servers frequently execute local system utilities, shell scripts, and database clients, running them natively on developer machines introduces severe security risks. Docker addresses this vulnerability through runtime isolation:

• Filesystem Isolation: Restricts an MCP server's file access to explicitly mounted directories, preventing a compromised tool from accessing sensitive system files or credentials.
• Network Scoping: Limits container egress traffic, ensuring that local tools cannot silently transmit internal network data to unauthorized remote command-and-control servers.
• Resource Constraints: Limits CPU and memory usage, protecting host workstations from resource exhaustion caused by runaway tool loops.
• Standardized Packaging: Allows infrastructure teams to distribute approved, pre-configured MCP tools across developer teams as immutable container images.

Docker provides an indispensable defense-in-depth layer for local process security. However, it does not constitute a complete governance platform on its own. Docker lacks centralized virtual keys, prompt-level content inspection, cross-server audit aggregation, and dynamic runtime tool filtering. It is best utilized as an underlying execution sandbox beneath a comprehensive MCP gateway.

Best for: Development teams needing strong process isolation and file-system boundaries for individual MCP tools running on local workstations or CI/CD runners.

Architectural Deep Dive: Gateway Proxy vs. Endpoint Governance

A common mistake in enterprise AI planning is assuming that deploying an MCP gateway in the cloud fully solves tool security. In reality, AI tool execution in enterprise organizations is divided across two distinct physical environments:

┌──────────────────────────────────────────────────────────────────────────────────┐
│                             Enterprise Environment                               │
│                                                                                  │
│   Workstation Perimeter (Edge)              Network Perimeter (Gateway)          │
│                                                                                  │
│   ┌──────────────────────────────┐          ┌────────────────────────────────┐   │
│   │ Developer Laptop / Desktop   │          │ Central Cloud / Private VPC    │   │
│   │                              │          │                                │   │
│   │  ┌────────────────────────┐  │          │  ┌──────────────────────────┐  │   │
│   │  │ Desktop AI Applications│  │          │  │ Production Agent Services│  │   │
│   │  │ (Claude Desktop,Cursor)│  │          │  │  (LangChain, Autogen)    │  │   │
│   │  └───────────┬────────────┘  │          │  └────────────┬─────────────┘  │   │
│   │              │               │          │               │                │   │
│   │              ▼               │          │               ▼                │   │
│   │  ┌────────────────────────┐  │          │  ┌──────────────────────────┐  │   │
│   │  │ Local STDIO MCP Servers│  │          │  │ Bifrost AI Gateway       │  │   │
│   │  │ (Filesystem, Terminal) │  │          │  │ (Tool Filtering, Auth)   │  │   │
│   │  └───────────┬────────────┘  │          │  └────────────┬─────────────┘  │   │
│   │              │               │          │               │                │   │
│   │  [ Governed by Bifrost Edge ]│          │               ▼                │   │
│   │  - Discovers local servers   │          │  ┌──────────────────────────┐  │   │
│   │  - Enforces allow/deny policy│          │  │ Enterprise MCP Backends  │  │   │
│   │  - Intercepts local STDIO    │          │  │ (Databases, Core APIs)   │  │   │
│   └──────────────────────────────┘          │  └──────────────────────────┘  │   │
│                                             └────────────────────────────────┘   │
└──────────────────────────────────────────────────────────────────────────────────┘

1. Centralized Production Agent Workloads: Automated agent systems running inside Kubernetes clusters, AWS VPCs, or internal microservice environments. These services connect to centralized MCP servers using HTTP or Server-Sent Events (SSE). A network gateway like Bifrost sits naturally in front of these backends, terminating connections, inspecting payloads, enforcing audit logs, and filtering available tools.
2. Decentralized Local Developer Tools: Coding agents and chat interfaces running locally on employee laptops. These tools frequently launch local sub-processes running over STDIO to interact with local git repositories, system files, and staging environments.

If an organization relies solely on a network gateway, the entire workstation perimeter remains completely unmonitored. Developers can install community-developed MCP servers that introduce vulnerabilities or exfiltrate source code without generating a single packet of traffic toward the central network gateway.

This architectural reality demonstrates why the combination of the Bifrost AI Gateway and Bifrost Edge represents a robust governance design. The gateway establishes the central policy registry, access profiles, and upstream routing engine, while the Edge agent extends those identical policies directly onto physical workstations. Security teams achieve unified oversight of both cloud agent runtimes and local developer machines from a single administrative console.

Security Best Practices for MCP Governance in Production

Deploying Model Context Protocol tooling at enterprise scale introduces novel security challenges that conventional API firewalls do not mitigate. Implementing a defense-in-depth posture requires adhering to specific operational standards:

1. Enforce Strict Tool Filtering at the Gateway

Exposing an entire uncurated MCP server directly to an AI agent degrades reliability and introduces security vulnerabilities. When an agent is presented with dozens of irrelevant schemas, models frequently suffer from context confusion, leading to hallucinated arguments or accidental invocations of sensitive endpoints.

Platform teams should utilize MCP tool filtering to partition server capabilities into curated subsets. Restricting visibility to only the specific tools necessary for a given task preserves prompt context tokens, accelerates execution, and prevents unauthorized actions.

2. Implement Enterprise Guardrails and Payload Inspection

MCP tool calls transport dynamic arguments generated directly by LLM reasoning steps. These parameters must be inspected before execution to block prompt injections, command injections, and data leaks.

Enterprises should place guardrails directly into the gateway request pipeline. Using Bifrost's built-in secrets detection and custom regex engine, organizations can automatically detect and redact exposed API credentials, private encryption keys, and Personally Identifiable Information (PII) before any tool invocation payload reaches internal systems.

3. Replace Static Keys with Federated Identity

Static service accounts shared across multiple AI agents eliminate accountability and expand blast radiuses during security incidents. If an agent's token is compromised, revoking it disrupts other workloads.

Leading MCP governance models utilize identity provider integration with platforms like Okta, Microsoft Entra ID, and Google Workspace. By adopting federated authentication, the gateway verifies the authentic user behind the agent prompt, issuing short-lived, down-scoped credentials valid only for the duration of that specific tool execution.

4. Maintain Immutable Audit Logs for Compliance

Regulated organizations operating under SOC 2, HIPAA, or ISO 27001 must produce auditable evidence demonstrating that automated systems adhere to enterprise access policies. Every tool discovery request, tool invocation, returned payload, and denied execution must be preserved.

Gateways should emit structured, tamper-resistant audit logs that record the requesting virtual key, source IP, authenticated user identity, target tool schema, and execution outcome. These logs should stream automatically to centralized enterprise security systems such as Datadog, AWS S3, or Splunk via log exports.

Frequently Asked Questions

What is an MCP gateway?

An MCP gateway is a specialized reverse proxy that sits between AI applications and Model Context Protocol servers. It provides centralized connection management, authenticates users, filters available tools, enforces rate and budget limits, inspects payloads for security threats, and records immutable audit logs for all agent-initiated tool executions.

Why can't traditional API gateways adequately govern MCP?

Traditional API gateways inspect stateless HTTP paths and request headers, but MCP utilizes stateful, bi-directional transports like SSE and STDIO where tools are dynamically discovered via protocol messages. Standard gateways lack the protocol-aware capabilities required to parse tool definitions, prune tool schemas from prompts, prevent tool poisoning, or manage local desktop processes.

What is shadow MCP and why is it dangerous?

Shadow MCP refers to unmanaged Model Context Protocol servers configured locally on employee workstations inside tools like Claude Desktop or Cursor without security team awareness. It is dangerous because local MCP servers often run arbitrary shell commands, access the host filesystem, or query internal databases without generating network logs or adhering to enterprise access policies.

How does Bifrost Edge enforce MCP security on endpoints?

Bifrost Edge runs as a background endpoint agent that inventories MCP servers configured across local applications such as Claude Code and Cursor. Administrators set allow and deny policies centrally at the gateway control plane, and Edge enforces those rules locally on the device, actively blocking unauthorized MCP servers from executing.

Does an MCP gateway introduce significant latency to AI agent workflows?

Latency overhead depends entirely on gateway architecture. Legacy proxies written in interpreted languages can add 20 to 50 milliseconds per call, which compounds noticeably across multi-turn agent chains. In contrast, high-performance gateways like Bifrost add only 11 microseconds of internal latency, introducing zero perceptible delay to agent operations.

How does tool filtering improve AI model performance?

When an AI model receives hundreds of raw tool definitions, prompt token usage surges, response latency increases, and models experience context confusion that leads to hallucinations or incorrect tool selections. Gateway-level tool filtering presents models with only the relevant tools for a given task, improving execution accuracy and lowering operational costs.

Recommendation and Next Steps

Securing the Model Context Protocol requires moving beyond perimeter defenses to address both centralized production backends and decentralized workstation environments. While general-purpose tools like Kong and Cloudflare secure network ingress, and developers use Composio for external SaaS connectors, they do not resolve the broader visibility and control challenges created by autonomous agents operating across an enterprise.

Bifrost delivers the most complete and performant architecture for enterprise MCP governance available in 2026. Its Go-based core delivers industry-leading 11-microsecond routing latency, unified virtual keys, Code Mode optimization, and granular tool filtering, while Bifrost Edge eliminates shadow MCP blind spots by enforcing policy directly on employee endpoints.

Teams evaluating architectures for MCP governance can explore the Bifrost open-source repository on GitHub or request an enterprise Bifrost demo to review centralized policy controls and endpoint discovery firsthand.

Sources

• Model Context Protocol Specification and Governance - Official architectural definitions and protocol standards for MCP clients, hosts, and servers.
• OWASP MCP Governance & Risk Framework - Technical guidance on server inventory, classification, risk scoring, and runtime enforcement gates.
• Cloud Security Alliance: MCP Security & Governance Initiative - Threat modeling, runtime attack vectors, and defense-in-depth requirements for agent tool calling.
• Bifrost MCP Gateway and Governance Documentation - Technical implementation details for virtual keys, tool filtering, federated auth, and endpoint enforcement.