MCP

What MCP is

Model Context Protocol (MCP) is a standard for giving AI agents access to tools and data. Before MCP, every agent-builder framework handled tool-calling its own way. MCP provides a common interface: a server exposes a set of tools with typed inputs and outputs, and any MCP-capable agent can discover and invoke them.

Think of it as an API pattern tailored for the LLM era — with discovery, streaming, and error handling designed for how agents actually work.

Anthropic released MCP in November 2024, OpenAI adopted it in March 2025, and the Linux Foundation now hosts it. It is supported by Claude, OpenAI, Copilot Studio, the major agent frameworks, and a large ecosystem of third-party MCP servers.

Why the enterprise needs to care

MCP is powerful because it makes agent capability composable — you expose a tool once, any agent can use it. It’s also dangerous for exactly the same reason. Unmanaged MCP servers mean:

• Security exposure — research consistently shows high exploit rates on unmanaged MCP endpoints.
• Cost surprises — LLMs call MCP tools unpredictably; unmanaged endpoints can burn tokens quickly.
• Audit gaps — who called what tool against which data with what authority? Hard to answer without governance.
• Shadow IT amplified — individual teams deploy useful MCP tools; collectively, the organization loses visibility.

Gartner projects 40% of enterprise MCP deployments will be affected by security incidents by 2027 without governance interventions.

How Tray.ai handles it

Agent Gateway for MCP is Tray.ai’s governed MCP layer. It provides:

• Managed MCP Servers — spin up, version, publish, deprecate on a governed path.
• Connectors as MCP Tools — every Tray.ai connector becomes a governed agent tool.
• RBAC + audit — who can call what, logged completely.
• Composite tools — a Customer 360 tool queries Salesforce, Zendesk and Stripe in one call. Replacing dozens of raw tool calls with one cuts token use by up to 10×, and the steps run the same way every time.
• Direct to the API, no proxy — Agent Gateway connects to each system’s API through Tray’s connectors instead of routing agents through vendor MCP servers, so there is no third-party server in the path.
• Flexible auth — OAuth, API keys, JWT, rotatable centrally.

See J.W. Pepper, which reduced 500+ MCP tools to about 20 governed workflows with zero raw database access, for what governed MCP looks like in production.

The broader point

MCP is the right primitive for agents to reach into enterprise systems. The question isn’t “should we use MCP” — it’s “who governs our MCP deployment.” That’s where Agent Gateway for MCP fits.