An introduction to my article published by the Agentic AI Foundation on August 20, 2026.

I wrote this article for the Agentic AI Foundation (AAIF) about the security boundaries enforced by enterprise MCP gateways. Using agentgateway’s public code, fixes, and advisories, it follows three contracts:

  • Protocol translation: tool arguments stay within their intended HTTP fields.
  • Request inspection: a security policy can tell whether it saw the complete request body.
  • Session authorization: a stateful session remains bound to its selected backend.

The article brings together an earlier protocol-translation disclosure and the body-inspection and session-reuse cases I investigated. It explains how the fixes apply to existing stateful MCP deployments and the stateless MCP protocol.

Read the article on AAIF →

For the detailed reproduction of the session issue, see Your Session, My Policy: An MCP Gateway Authorization Bypass in Agentgateway.