MCP Egress Control: Decide Which Tools Your Agents Can Reach
TL;DR: Tetrate Agent Router Enterprise treats MCP calls as egress traffic, so your team sets a tool allow list per agent and gets an audit record for each call.
MCP tool calls leave your cluster and reach outside systems. Treat MCP calls as egress, with an allow list, authentication, and audit on each call.
An agent with open MCP access can reach any tool on any server the agent can name. One server may search files. Another server may move money or delete records. The agent picks tools during a run, and no person approves each pick. Your security team finds the tool list after an incident, and the incident review starts with a search through agent config files.
Tetrate Agent Router Enterprise puts MCP calls on the governed outbound path. Your platform team admits MCP servers to a catalog. Your team grants tools to projects and agents through profiles. The gateway records each call. AI ingress vs. AI egress covers the full traffic model.
Open MCP Egress Lets Any Agent Reach Any Tool
MCP servers run outside the agent. Some servers run in another namespace. Some servers run at a vendor. Each call crosses a trust boundary with arguments from the agent and data from the tool.
Tool risk varies by action. A search tool reads data. A ticket tool writes records. A payments tool moves money. A single allow decision for a whole server gives the agent every tool on the server, including tools your team never reviewed.
Client config files make the problem hard to govern. Each developer or agent can list servers in local config. Your platform team cannot see every config file. A server removed from one file can stay in nine other files. How to govern MCP server traffic with an MCP gateway covers catalog, profile, secret, and audit design in depth.
Set Controls per Tool and per Agent
| Control | Egress question the control answers |
|---|---|
| Server catalog | Which MCP servers may agents reach at all? |
| Tool allow list | Which tools on an approved server may an agent call? |
| Per-agent profile | Which tools does this agent get for this job? |
| Authentication | Which identity does the gateway present to the server? |
| Audit record | Which agent called which tool, with which result? |
| Project scoping | Which teams can use this server and this profile? |
Start with the catalog. Your platform team reviews a server, records the server URL and authentication type, and admits the server. Agents get no path to servers outside the catalog when you close direct outbound paths with NetworkPolicy.
Grant tools through profiles. A profile groups servers and tools for one job. A support agent may get file search and ticket read tools. A finance agent may get a ledger read tool and no write tools. The Tetrate docs on governing MCP server access and scoping MCP to a project show the catalog and project steps.
Keep secrets at the gateway. Client config should hold a gateway key and a profile URL. Server credentials and OAuth settings belong in gateway config. The Tetrate docs on securing MCP secrets and identity cover secret stores and identity pass-through.
Two limits. A gateway can allow or deny a tool call, and the gateway cannot judge whether an allowed call serves a good business purpose. Tool owners must still set safe defaults inside each tool, such as read-only modes and amount caps. Audit records help reviews after a call. Audit records do not undo a write or a payment.
How the MCP Gateway in Agent Router Enterprise Applies the Controls
The MCP gateway in Agent Router Enterprise checks each tool call against the catalog and the profile for the caller. A call to a server outside the catalog fails. A call to a tool outside the profile fails. The gateway presents the configured authentication to the server and writes an audit record with the agent identity and the tool name.
Your team can retire a server in one place. Remove the server from the catalog or from a project grant. Agents that used the server lose access at the gateway, with no hunt through client config files.
Pair MCP egress control with model egress control. The same agent sends prompts to a model provider and tool calls to MCP servers. One outbound gateway can apply destination rules, token limits, and tool policy in one policy model. What is an AI egress gateway? covers the outbound gateway role. The MCP learn pages under MCP overview and MCP security best practices cover protocol and security detail.
Agent Router Enterprise
Tetrate Agent Router Enterprise routes AI agent traffic across providers and your own models, with policy, cost controls, and audit on every request — in cloud, on-prem, or edge.
The AI gateway glossary defines MCP gateway terms. AI gateway vs. API gateway explains how tool controls differ from web API controls. The AI gateway performance benchmarks publish gateway overhead for MCP traffic, best enterprise AI gateway compares current options, and who created Envoy AI Gateway covers the open source data plane project.
Availability and How to Get Started
Tetrate Agent Router Enterprise is available now with an MCP server catalog, project scoping, profiles, and audit for tool calls. Start with the docs on governing MCP server access and MCP audit logging. Book a demo to set a tool allow list for one of your agents.
Frequently Asked Questions
What Is MCP Egress Control?
MCP egress control governs tool calls that leave your cluster for MCP servers. Controls include a server catalog, a tool allow list per agent, authentication, project scoping, and an audit record for each call.
Why Are MCP Tool Calls Egress Traffic?
An MCP call leaves the agent and reaches a server that can sit outside the cluster. The call carries agent arguments out and brings tool data back, so the call crosses the cluster boundary like a model call.
Can I Allow One Tool and Deny Another on the Same Server?
Yes. A profile can grant a chosen set of tools from an approved server. The gateway rejects calls to tools outside the profile for the caller.
Where Should MCP Server Credentials Live?
Server credentials and OAuth settings belong in gateway config. Client config should hold a gateway key and a profile URL, so secrets stay out of developer and agent files.
What Should an MCP Audit Record Include?
An audit record should name the agent or caller key, the project, the MCP server, the tool, the time, and the result. Teams also record approvals and catalog changes.
How Do I Retire an MCP Server for Every Agent?
Remove the server from the gateway catalog or from the project grant. The gateway rejects new calls to the server for agents governed by the gateway.
Sources
- Govern MCP server access, Tetrate docs
- Secure MCP secrets and identity, Tetrate docs
- Scope MCP to a project, Tetrate docs
Related: How to govern MCP server traffic with an MCP gateway, on catalog, profile, secret, and audit design in depth.
