A Gateway Architecture for Enterprise MCP Authentication: Unifying Heterogeneous Auth, Identity Delegation, and the User / Non-User Persona Problem

• URL: http://arxiv.org/abs/2608.10760v1
• Date: Tue, 11 Aug 2026 10:19:20 GMT
• Title: A Gateway Architecture for Enterprise MCP Authentication: Unifying Heterogeneous Auth, Identity Delegation, and the User / Non-User Persona Problem
• Abstract summary: The Model Context Protocol (MCP) has become the de-facto interface for connecting LLM agents to enterprise tools.<n>Within a year, large organizations went from zero to dozens of internally built MCP servers.<n>This paper reports an industry deployment that resolves the crisis with a centralized MCP gateway.
• Score: 1.6774701449274187
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The Model Context Protocol (MCP) has become the de-facto interface for connecting LLM agents to enterprise tools, and adoption has been explosive: within a year, large organizations went from zero to dozens of internally built MCP servers. That speed created a governance crisis. Each team implemented authentication independently -- some with no auth, some with API keys, some with full OAuth -- producing a fragmented landscape with no consistent way to authorize callers, track who did what, or offboard a departing employee across the fleet. This paper reports an industry deployment that resolves the crisis with a centralized MCP gateway: a single aggregation, governance, and authentication layer that fronts every downstream MCP server. We make four contributions grounded in production experience. First, a two-axis authentication model crossing persona (interactive user vs. automated non-user) with credential type (no-auth, static/dynamic API key, PKCE, client credentials, platform app-context). Second, a gateway authentication layer supporting three enterprise SSO grants and three token-provisioning models: Bring-Your-Own-Token, Generate-Your-Own-Token, and delegated OAuth via RFC 8693 token exchange. Third, three end-to-end identity flows -- User-to-OAuth2, Non-user-to-Service-Account, and User-to-Service-Account -- composing client, gateway, and server. Fourth, the deployment evolution from CDN/WAF/edge perimeter to private MCP tunnels and enterprise-wide connectors. The architecture is in production, fronting dozens of MCP servers across web, desktop, custom-SDK, and low-code clients.

Related papers

• KeyPooling: Measuring Where LLM API Relay Paths Collapse Prompt Cache Isolation [53.952294884822955]
  Large language model (LLM) API relays authenticate customers separately but often forward requests through shared provider credentials.<n>We present KeyPooling, a measurement method that traces customer identity through cache lookup and write.<n>We derive a defense contract: every customer must enter a provider-enforced domain.
  arXiv  Detail & Related papers  (2026-08-18T08:12:34Z)
• A First Measurement Study on Authentication Security in Real-World Remote MCP Servers [19.129045472743034]
  We present the first measurement study of authentication security in real-world remote MCP servers.<n>We identify 7,973 live remote MCP servers, finding that 40.55% expose tools without authentication.<n>Our findings expose pervasive authentication weaknesses in the MCP ecosystem.
  arXiv  Detail & Related papers  (2026-05-21T11:22:21Z)
• OAuthHub: Mitigating OAuth Data Overaccess through a Local Data Hub [8.302146576157497]
  OAuthHub is a development framework that leverages users' personal devices as the intermediary controller for OAuth-based data sharing between cloud services.<n>Key innovations of OAuthHub are: (1) the insight that discretionary data access is largely unnecessary for most OAuth apps; and (2) a development framework that requires explicit declarations of intended data access.
  arXiv  Detail & Related papers  (2026-03-09T18:43:12Z)
• Orchestral AI: A Framework for Agent Orchestration [45.946776875141666]
  Orchestral is a lightweight Python framework that provides a unified, type-safe interface for building LLM agents across major providers.<n>It operates seamlessly across providers, eliminating manual format translation and reducing framework-induced complexity.<n>It supports advanced agent capabilities found in larger frameworks, including rich tool calling, context compaction, sandboxing, user approval, sub-agents, memory management, and MCP integration.
  arXiv  Detail & Related papers  (2026-01-05T22:02:11Z)
• Binding Agent ID: Unleashing the Power of AI Agents with accountability and credibility [46.323590135279126]
  BAID (Binding Agent ID) is a comprehensive identity infrastructure establishing verifiable user-code binding.<n>We implement and evaluate a complete prototype system, demonstrating the practical feasibility of blockchain-based identity management and zkVM-based authentication protocol.
  arXiv  Detail & Related papers  (2025-12-19T13:01:54Z)
• The OpenHands Software Agent SDK: A Composable and Extensible Foundation for Production Agents [46.254487394746725]
  We present the OpenHands Software Agent SDK, a toolkit for implementing software development agents.<n>To achieve flexibility, we design a simple interface for implementing agents that requires only a few lines of code in the default case.<n>For security and reliability, it delivers seamless local-to-remote execution portability, integrated REST/WebSocket services.
  arXiv  Detail & Related papers  (2025-11-05T18:16:44Z)
• Code2MCP: Transforming Code Repositories into MCP Services [53.234097255779744]
  Model Context Protocol (MCP) aims to create a standard for how Large Language Models use tools.<n>We introduce Code2MCP, an agent-based framework that automatically transforms a GitHub repository into a functional MCP service.<n>We demonstrate that Code2MCP successfully transforms open-source computing libraries in scientific fields such as bioinformatics, mathematics, and fluid dynamics.
  arXiv  Detail & Related papers  (2025-09-07T06:13:25Z)
• Identity Control Plane: The Unifying Layer for Zero Trust Infrastructure [0.0]
  Identity Control Plane (ICP) is an architectural framework for enforcing identity-aware Zero Trust access.<n>ICP model unifies SPIFFE-based workload identity, OIDC/SAML user identity, and scoped automation credentials via broker-issued transaction tokens.
  arXiv  Detail & Related papers  (2025-04-24T17:21:00Z)
• Decoupling Identity from Access: Credential Broker Patterns for Secure CI/CD [0.0]
  Credential brokers offer a way to separate identity from access in CI/CD systems.<n>This paper shows how verifiable identities issued at runtime, such as those from SPE, can be used with brokers to enable short-lived, policy-driven credentials for pipelines and workloads.
  arXiv  Detail & Related papers  (2025-04-20T23:08:17Z)
• A Novel Protocol Using Captive Portals for FIDO2 Network Authentication [45.84205238554709]
  We introduce FIDO2CAP: FIDO2 Captive-portal Authentication Protocol. We develop a prototype of FIDO2CAP authentication in a mock scenario. This work makes the first systematic approach for adapting network authentication to the new authentication paradigm relying on FIDO2 authentication.
  arXiv  Detail & Related papers  (2024-02-20T09:55:20Z)
• Unified Singular Protocol Flow for OAuth (USPFO) Ecosystem [2.3526458707956643]
  We propose a new approach for OAuth ecosystem that combines different client and grant types into a unified singular protocol flow for OAuth (USPFO) USPFO aims to reduce the vulnerabilities associated with implementing and configuring different client types and grant types. It provides built-in protections against known OAuth 2.0 vulnerabilities such as client impersonation, token (or code) thefts and replay attacks through integrity, authenticity, and binding audience.
  arXiv  Detail & Related papers  (2023-01-29T17:22:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.