[Blog](https://cohesivity.ai/blog) MCP Published Jul 13, 2026·Updated Aug 30, 2026 ![](https://cohesivity.ai/authors/shouryamaan.webp)![](https://cohesivity.ai/authors/arag.webp)[Shouryamaan](https://www.linkedin.com/in/shouryamaanjain/) and [Arag](https://www.linkedin.com/in/aragagrawal/) # The MCP Infrastructure Stack: Servers, Gateways, Tools, and Permissions [Read as Markdown](https://cohesivity.ai/blog/the-mcp-infrastructure-stack.md) MCP stack Server Gateway Tools Permission A production MCP stack includes transport, protocol handling, authentication, routing, tool definitions, authorization policy, execution credentials, backend APIs, operation state, and telemetry. A small deployment can combine layers in one process, but every responsibility still needs one owner. Most failures come from hidden boundaries. A handler validates a token, decides tenant access, retries a provider call, and logs the result, so nobody can tell which rule failed. ## The stack in one view ```mermaid flowchart TD C[MCP clients] --> T[Transport edge] T --> S[Protocol server] S --> G[Authentication and routing] G --> R[Tool registry] R --> P[Authorization policy] P --> E[Tool executor] E --> K[Credential broker] K --> B[Backend APIs and data] E --> O[Operation state] S --> X[Telemetry and evaluations] P --> X E --> X B --> X ``` This is a responsibility map. It does not require eleven separate products. ## Transport edge The edge terminates HTTPS for remote servers, validates request size and origin, enforces connection limits, and routes Streamable HTTP sessions. Local stdio servers inherit the local process and operating-system boundary instead. The [MCP transport specification](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports) defines stdio and Streamable HTTP behavior. It does not provide tenant rate limits or application authorization. ## Protocol server The server handles initialization, capability negotiation, JSON-RPC messages, pagination, cancellation, and notifications. It exposes tools, resources, and prompts declared by the implementation. Protocol errors should remain distinct from domain failures. An invalid `tools/call` request is different from a valid `create_invoice` call that the business policy denies. ## Authentication and routing Authentication establishes the client and represented user. Routing selects the correct server, tenant context, or tool group. A gateway can centralize connection limits and auth discovery across several MCP servers, but it does not need to exist as a separate service for a small deployment. The [MCP authorization guide](https://cohesivity.ai/blog/mcp-authentication-and-authorization-guide) explains the remote OAuth flow and why audience validation belongs here. ## Tool registry The registry contains the exact names, descriptions, schemas, output contracts, and annotations visible to the client. It may filter the list by tenant, role, feature, or environment. Keep tool selection separate from resource authorization. Hiding a tool helps the model choose, while the backend still rejects forbidden requests. The [MCP tool design guide](https://cohesivity.ai/blog/how-to-design-mcp-tools-agents-can-use-reliably) includes a selection-only evaluation for this layer. ## Authorization policy Policy decides whether the represented identity may use this tool against this tenant, resource, and action now. It also decides whether approval is required. Keep broad business rules in the service that owns the resource. A central policy layer can reject early, but it should not become the only place that knows one user cannot read another user's invoice. ## Tool executor and credential broker The executor validates inputs, calls internal code or an upstream API, and shapes the result. The credential broker supplies a separate upstream credential with the narrowest available scope. The model should not receive that credential. The [MCP secret-handling guide](https://cohesivity.ai/blog/mcp-security-api-keys) shows how to test prompts, logs, errors, and generated artifacts for leakage. ## Backend and operation state The backend enforces data integrity and final authorization. Operation state records logical writes, attempts, idempotency keys, provider request IDs, and outcomes. Session state and chat history do not replace this ledger. After a timeout, the executor reads operation state before deciding whether to call the provider again. ## Telemetry and evaluations Telemetry connects the user request to the tool call and backend effect. Evaluations test whether models select the right tools and respect no-tool cases across changes. Record stable IDs and bounded result classes. Exclude credentials, raw sensitive data, and unbounded provider payloads. ## Split only where the boundary helps Separate a layer into its own service when it needs independent trust, scaling, ownership, or release behavior. Do not add a gateway merely because an architecture diagram has one box for it. The prompt below maps the owners in the existing deployment and finds the first mixed responsibility that creates real risk. or send it to[Claude Code](https://claude.ai/new?q=Inspect+this+MCP+deployment+and+map+transport%2C+protocol+handling%2C+authentication%2C+gateway+or+routing%2C+tool+registry%2C+authorization+policy%2C+tool+execution%2C+upstream+credentials%2C+backend+APIs%2C+operation+state%2C+telemetry%2C+and+evaluations.+Do+not+edit+code.+For+every+layer%2C+name+the+exact+owner+and+trust+boundary.+Flag+missing+layers+and+handlers+that+own+unrelated+responsibilities+such+as+token+validation+plus+business+authorization+plus+provider+retries.+Return+a+diagram+and+the+smallest+separation+that+would+reduce+security+or+recovery+risk+without+adding+unnecessary+services. "Send to Claude")[Cursor](https://cursor.com/link/prompt?text=Inspect+this+MCP+deployment+and+map+transport%2C+protocol+handling%2C+authentication%2C+gateway+or+routing%2C+tool+registry%2C+authorization+policy%2C+tool+execution%2C+upstream+credentials%2C+backend+APIs%2C+operation+state%2C+telemetry%2C+and+evaluations.+Do+not+edit+code.+For+every+layer%2C+name+the+exact+owner+and+trust+boundary.+Flag+missing+layers+and+handlers+that+own+unrelated+responsibilities+such+as+token+validation+plus+business+authorization+plus+provider+retries.+Return+a+diagram+and+the+smallest+separation+that+would+reduce+security+or+recovery+risk+without+adding+unnecessary+services. "Send to Cursor")[Codex](https://chatgpt.com/codex?prompt=Inspect+this+MCP+deployment+and+map+transport%2C+protocol+handling%2C+authentication%2C+gateway+or+routing%2C+tool+registry%2C+authorization+policy%2C+tool+execution%2C+upstream+credentials%2C+backend+APIs%2C+operation+state%2C+telemetry%2C+and+evaluations.+Do+not+edit+code.+For+every+layer%2C+name+the+exact+owner+and+trust+boundary.+Flag+missing+layers+and+handlers+that+own+unrelated+responsibilities+such+as+token+validation+plus+business+authorization+plus+provider+retries.+Return+a+diagram+and+the+smallest+separation+that+would+reduce+security+or+recovery+risk+without+adding+unnecessary+services. "Send to Codex")[opencode](https://opencode.ai/?q=Inspect+this+MCP+deployment+and+map+transport%2C+protocol+handling%2C+authentication%2C+gateway+or+routing%2C+tool+registry%2C+authorization+policy%2C+tool+execution%2C+upstream+credentials%2C+backend+APIs%2C+operation+state%2C+telemetry%2C+and+evaluations.+Do+not+edit+code.+For+every+layer%2C+name+the+exact+owner+and+trust+boundary.+Flag+missing+layers+and+handlers+that+own+unrelated+responsibilities+such+as+token+validation+plus+business+authorization+plus+provider+retries.+Return+a+diagram+and+the+smallest+separation+that+would+reduce+security+or+recovery+risk+without+adding+unnecessary+services. "Send to OpenCode")