MCP Gateway
Posts about MCP security and Waxell MCP Gateway: one governed URL for every tool call.
8 min readAI Agent Kill Switch: MCP Cancel Is Fire-and-Forget 2026
MCP calls cancellation fire-and-forget: the receiver must not answer it. A stop with no receipt is not a control. Govern it where calls are decided.
10 min readAgentic Architecture: Retry Safety Is a Hint [2026]
In MCP, whether a tool is safe to call twice is a hint the client must distrust. Waxell MCP Gateway decides it per call, before dispatch.
10 min readAgentOps: The Agent Kept Running for Six Days [2026]
Agent telemetry measures duration, tokens and tool calls. A run that completes and does the wrong thing still looks healthy.
12 min readPortkey vs Waxell: Two MCP Gateways, Two Trust Models
Portkey, now Prisma AIRS AI Gateway, enforces MCP tool-call policy. So does Waxell — the difference is when each gateway re-checks the tool itself.
10 min readHuman-in-the-Loop Is a SHOULD in the MCP Spec, Not a MUST
MCP's spec says a human SHOULD be able to deny tool calls — never MUST. Oversight that lives in the client is a liability transfer, not a control.
12 min readDatadog vs Waxell: Where Agent Policy Runs [2026]
Datadog AI Guard evaluates agent actions inside your app process. Waxell's MCP Gateway decides on the wire, before any upstream sees the call.
8 min readPlugin4Shell: SHA Pinning Bypass in 4 AI Agents [2026]
A hash-shaped branch let plugin repos swap pinned code in 4 AI coding agents. Patch status, what to check, and how MCP Gateway treats tools that drift.
8 min readMCP Tool Output Security: NSA's Untrusted-by-Default Rule
NSA guidance says MCP tool outputs are never implicitly trusted. Request-time authorization misses the return path — here's what to govern instead.
14 min readNutanix vs Waxell: MCP Gateway Governance Compared [2026]
Nutanix's MCP gateway governs agent access on infrastructure you run. Waxell's MCP Gateway secures every tool call in flight, hosted and self-serve.
8 min read5-Day Window: Agent Exploited Snowflake CI/CD Flaw [2026]
A Snowflake CI/CD flaw leaked a Jira token to an autonomous agent in 5 days. How to gate the write-path tool calls AI agents make.
8 min readOpenClaw Agent Exploits Gym API: BOLA at Agent Speed [2026]
An OpenClaw agent on Claude cancelled a stranger's gym booking via a broken API. Why destructive agent tool calls need a pre-execution gate.
8 min readCyera Lab: Leaked Composio Key Returns Live Tokens [2026]
Cyera found thousands of exposed AI agent keys; its lab showed what one unlocks. Rotation isn't revocation — how a governed MCP gateway helps.
12 min readMCP Server Authentication: 40.55% Expose Tools [2026]
40.55% of live remote MCP servers expose tools with no authentication. Why the spec permits it, and where the control actually belongs.
14 min readLangChain vs Waxell: Two Perimeters Compared [2026]
LangChain governs the model call and the agents on its own stack. Waxell governs tool calls from assistants nobody built — and the laptop.
12 min readAI Agent Cost Controls: A $6,531 Bill, Found Late [2026]
AWS Budgets updates up to 3x a day; an agent's loop runs in seconds. That gap is where runaway agent spend lives — enforce at the tool call.
16 min readRunlayer vs Waxell: Where Does the Perimeter Sit? [2026]
Runlayer governs the tool layer - MCP calls, catalog, shadow MCP. Waxell governs the model call and workflow step too. A sourced 2026 comparison.
13 min readTrueFoundry vs Waxell: Where Enforcement Lives [2026]
TrueFoundry enforces AI policy at the gateway boundary. Waxell enforces inside the agent, at the gateway, at each step, and on employee devices.
13 min readMaxim AI vs Waxell: Evaluation vs Enforcement [2026]
Maxim AI splits evaluation and gateway governance across two products; Waxell enforces policy across the whole agent lifecycle in one control plane.
15 min readFiddler AI vs Waxell: Two Control Planes Compared [2026]
Fiddler AI enforces inline at the gateway you already run; Waxell owns the gateway, the agent process, and the device.
15 min readSpeakeasy vs Waxell: MCP Governance Compared [2026]
Speakeasy gates MCP tool calls at the gateway before they run; Waxell extends the same enforcement past the gateway to the agents you build, self-serve.
9 min readAI Agent Tool Call Failures: #1 Production Problem [2026]
Tool misuse — wrong arguments, missing fields, malformed JSON — is the most common AI agent production failure. Detect it before it cascades.
14 min readWhat Is MCP Governance? (2026 Definition)
MCP governance controls which MCP servers agents reach and what they do there. See what the 2026-07-28 spec revision changed and how to enforce it.
11 min readPoisoned MCP Tool Descriptions Leak Agent Data [2026]
Microsoft warns poisoned MCP tool descriptions redirect agents to exfiltrate data silently. The mechanism, why it persists, and the controls that stop it.
9 min readAI Agent Context Window GDPR: Data Minimization Gap [2026]
On March 19, 2026, 25 EU data protection authorities started checking AI systems. Most agents fail at the tool call, not the output. Here's the fix.
20 min readWhy Production AI Teams Choose Waxell Over AGT
Microsoft's AGT is a solid answer to one version of the governance question: can you evaluate a declarative policy before a tool call fires? But pre-execution governance isn't the full story. This post covers the six production failure modes AGT doesn't address, the three planes of agent governance, and why teams building at scale choose Waxell.
14 min readPrompt Injection Doesn't Come from Your Users
Most AI agent teams filter user inputs for prompt injection. Attackers are injecting through tool call results — database records, web pages, emails your agent reads. **Primary keyword:** prompt injection AI agents
17 min readMCP Server Evaluation: 5 Checks Before You Connect
Most teams connect MCP servers like npm packages—fast and unvetted. Here are 5 checks to evaluate a server's auth, scope, and tools before you connect.
12 min readYour MCP Agents Are Over-Privileged. Here's How to Fix It.
Most MCP agents run with far more permissions than they need. Here's why that happens, what it costs you when something goes wrong, and how to apply least privilege at the tool layer.
12 min readMCP Governance vs Observability: Why You Need Both [2026]
Most teams with MCP deployments have observability. Almost none have governance. Here's why that gap matters and what it costs when something goes wrong.
20 min readMCP Server Production Checklist [2026]
Your MCP server works. That is not production-ready. The four checks most teams skip: observability, tool scoping, result inspection, budget caps.
22 min readMCP Rug Pull Attack: What It Is and How to Stop It [2026]
An MCP rug pull changes an approved tool with no re-alert. How it works, five real production incidents from 2025–2026, and the controls that stop it.
21 min readMCP Governance: Secure AI Agents in a Plugin World [2026]
91.8% of internet-facing MCP servers audited in 2026 had no OAuth. What MCP governance actually is: allowlisting, result inspection, sequence policy.