Gateways are All You Need — Karan Sampath, Anthropic

Karan Sampath, a Forward Deployed Engineer at Anthropic and the first such hire outside the US, presents the case for MCP gateways as the critical missing infrastructure layer for enterprise adoption of the Model Context Protocol. The talk is framed around a central thesis: while MCP servers are proliferating rapidly (with thousands of servers in the official Anthropic registry and enterprises spinning up new ones across teams), almost no enterprise can effectively deploy more than a single-digit number of MCPs in production due to three foundational blockers Sampath calls the "three-headed hydra" — observability, access control, and security.

On observability, enterprises currently have no visibility into who is using which MCP tools, how frequently, and whether tool definitions are fit for purpose. On access control, enterprises struggle to scope permissions properly — for example, allowing all employees to view observability dashboards via an MCP but only certain roles to modify them. On security, the challenge is two-fold: verifying that MCP servers themselves cannot be used for data exfiltration or infrastructure attacks, and ensuring remote untrusted clients cannot access private internal data.

Sampath argues the root cause is the absence of a centralized "root of trust." The solution he proposes is an MCP Gateway — a middleware layer that sits between all MCP clients (including Claude.ai, Claude for Work, Claude Code, and any third-party agent runtime) and the full internal catalog of MCP servers. The gateway handles authentication (including OAuth and integration with enterprise IDPs), role-based access control, secure tunneling, proxying/routing, an internal sub-registry of servers, and a developer-facing CLI that coding agents can use to scaffold new servers quickly.

The strategic insight is that once a gateway exists, every new MCP server needs only implement business logic — the legal team building a contract-review MCP, for instance, never has to think about auth, scaling, or security review cycles. This decentralization unlocks faster iteration and removes the bottleneck where security teams are overwhelmed evaluating each new server individually.

Sampath enumerates six additional benefits that become "free lunches" once a gateway is in place: (1) multi-surface integration — all MCP servers automatically become available to any new client surface (Claude.ai, Claude Code, Claude for Work) with a single registration; (2) secured encrypted connections between agents and internal data sources, critical for enterprises with sensitive data; (3) faster iteration by eliminating repeated per-server security reviews; (4) standardized primitives that encode enterprise operating procedures into every MCP server by default; (5) pluggable credential management, supporting company-wide, team-wide, or service account auth patterns interchangeably; and (6) horizontal scalability as agent counts grow from tens to hundreds of thousands.

Sampath closes with a forward-looking architectural vision: the gateway enables a clean separation between the agent harness (the "orange box" of orchestration logic) and the data layer (MCP servers and their underlying systems). He cites Anthropic's recently released Claude Managed Agents as an example where this separation is already working — enterprises can run some agents externally and some in-house, while the gateway remains the invariant trusted endpoint regardless of which agent runtime is used. The three headline takeaways are: invest in common MCP infrastructure and avoid per-team siloed rollouts; use gateways to establish the root of trust and enable secured connections; and build toward an architecture where agent harnesses are decoupled from data layers. Sampath notes Anthropic has both open-source examples and direct professional support available for enterprises pursuing this path.