{"id":59558,"date":"2026-11-05T07:02:14","date_gmt":"2026-11-04T21:02:14","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/05\/what-the-aks-mcp-gateway-means-for-production-ai-agent-security\/"},"modified":"2026-11-05T07:03:45","modified_gmt":"2026-11-04T21:03:45","slug":"what-the-aks-mcp-gateway-means-for-production-ai-agent-security","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/05\/what-the-aks-mcp-gateway-means-for-production-ai-agent-security\/","title":{"rendered":"What the AKS MCP Gateway Means for Production AI Agent Security"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In this blog post <strong>What the AKS MCP Gateway Means for Production AI Agent Security<\/strong> we will explain why connecting production AI agents directly to a growing collection of MCP servers creates more security risk and operational work than many businesses expect.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p class=\"wp-block-paragraph\">At a high level, Microsoft\u2019s new MCP gateway capability for Application Gateway for Containers puts a controlled front door between AI agents and MCP servers running on Azure Kubernetes Service, or AKS. AKS is Microsoft\u2019s platform for running and scaling container-based applications.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Instead of exposing every MCP server separately, organisations can give approved AI agents one managed entry point. This can reduce the number of internet-facing services, centralise security controls and make it easier to see which agents are accessing business tools.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why direct MCP connections become a business problem<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Model Context Protocol, or MCP, gives AI agents a standard way to discover and use business tools. An MCP server might let an agent search documents, check inventory, update a customer record or open a support incident.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That is useful, but every new MCP connection also creates another path into company systems. If five teams deploy five servers independently, the business may end up with different authentication methods, security settings, certificates and logs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is the same problem we explored in our reference architecture for securing agentic AI and MCP servers. The difficult part is not getting an agent to call a tool. It is controlling who can call it, what they can do and how the business proves those controls are working.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What the Application Gateway for Containers MCP gateway does<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Application Gateway for Containers is a Microsoft-managed traffic service designed for applications running in Kubernetes. In plain English, it receives requests, checks the applicable rules and sends each request to the correct application inside AKS.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft\u2019s MCP support adds protocol-aware routing through a new configuration resource called <code>MCPRoute<\/code>. This tells the gateway which MCP servers sit behind it and how approved clients should reach them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The request flow looks like this:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>An AI agent connects to a controlled HTTPS address.<\/li>\n<li>The gateway checks the connection and any configured identity or security policies.<\/li>\n<li>The <code>MCPRoute<\/code> sends the request to the appropriate MCP server in AKS.<\/li>\n<li>The MCP server performs the approved lookup or action against a business system.<\/li>\n<li>Gateway, application and security logs record what happened.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">A simplified preview configuration could look like this:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apiVersion: alb.networking.azure.io\/v1alpha1\nkind: MCPRoute\nmetadata:\n name: business-tools\nspec:\n parentRefs:\n - name: mcp-gateway\n sectionName: mcp\n rules:\n - backendRefs:\n - name: service-desk-mcp\n port: 8080\n - name: inventory-mcp\n port: 8080<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This is an illustrative example rather than a production template. The MCP routing interface is currently a preview feature, so its configuration and supported options may change before general availability.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">One gateway can reduce your exposed attack surface<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Without a gateway, every MCP server may need its own public address, encryption certificate, authentication configuration and protection rules. Each separate endpoint becomes another service that must be patched, monitored and tested.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A shared gateway can centralise TLS encryption, JWT validation and Web Application Firewall protection. JWT validation checks a digitally signed access token before allowing a request, while a Web Application Firewall helps block common malicious web traffic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The business outcome is consistency. Security teams can manage a smaller number of entry points, while application teams continue to own their individual MCP servers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For sensitive workloads, the connection from the gateway to the backend server should also be encrypted and authenticated. Network policies should prevent users and applications from bypassing the gateway and calling MCP servers directly.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Aggregation makes AI agents easier to operate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The gateway can also combine multiple MCP servers behind one logical endpoint. An agent can discover tools from several servers without being configured with a different address for every system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, a service agent might see approved tools for checking an order, reviewing inventory and creating a support ticket through one connection. The gateway can merge the available tool lists and route each request to the server that owns the selected capability.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This reduces configuration work and makes it easier to add or replace backend services without updating every AI agent. It also helps avoid the unmanaged collection of direct integrations that often appears after successful AI pilots.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, aggregation increases the importance of access design. One endpoint must not mean every agent receives every tool. The principles in our article on why MCP tool access is a security decision still apply.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Session handling improves production reliability<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Some MCP servers keep temporary session information in memory. If consecutive requests are sent to different server instances, the agent may lose its session or produce inconsistent results.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Application Gateway for Containers supports session affinity for this scenario. Session affinity means related requests can continue reaching the same backend instance when required.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This matters because an unreliable AI agent quickly becomes an expensive support problem. Employees stop trusting it, automation fails halfway through a task and IT teams spend time investigating errors that are difficult to reproduce.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The gateway can also use backend health checks to avoid sending traffic to a server that is unavailable. That improves resilience, but critical actions should still have time-outs, retry limits and a safe recovery process.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What the gateway does not solve<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An MCP gateway is an important control point, but it is not a complete AI security strategy.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>It does not decide whether an action is appropriate.<\/strong> The MCP server must still check whether the user or agent is allowed to perform the requested operation.<\/li>\n<li><strong>It does not stop prompt injection by itself.<\/strong> A malicious document may still try to manipulate an agent into using a tool incorrectly.<\/li>\n<li><strong>It does not create least-privilege identities.<\/strong> Each agent and MCP server should receive only the permissions needed for its role.<\/li>\n<li><strong>It does not replace approval steps.<\/strong> Payments, account changes, data deletion and other high-impact actions may still require human confirmation.<\/li>\n<li><strong>It does not make a preview feature production-ready.<\/strong> The organisation remains responsible for testing, fallback plans and accepting preview support conditions.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft Defender can help monitor workloads and suspicious activity, while Wiz can identify exposed services, excessive permissions and risky cloud configuration. Those controls should support the gateway rather than be replaced by it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A practical business scenario<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Consider a 200-person Australian services company building an internal AI assistant. The first version only searches policies, but teams soon add separate MCP servers for customer records, project data and service desk tickets.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If each server is exposed independently, the company now has four endpoints to secure and four sets of access rules to review. A certificate expiry or incorrect firewall rule on any one of them could cause an outage or expose business data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Placing the servers behind one governed MCP gateway gives the company a consistent entry point, common identity checks and centralised monitoring. New tools can be added behind the gateway without repeatedly changing every agent configuration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The likely return is not simply lower hosting cost. It is less operational effort, faster security reviews and a lower chance that an experimental integration becomes an unmanaged production risk.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What technology leaders should require before production<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Classify every MCP tool.<\/strong> Separate read-only searches from tools that create, change or delete business data.<\/li>\n<li><strong>Use dedicated identities.<\/strong> Do not give an AI agent a shared administrator account or broad application credential.<\/li>\n<li><strong>Enforce authentication at the gateway and authorisation at the server.<\/strong> Identity checks at the front door must be backed by permission checks for each action.<\/li>\n<li><strong>Block direct access to backend services.<\/strong> The gateway provides little value if callers can bypass it.<\/li>\n<li><strong>Centralise logs and alerts.<\/strong> Record the agent, user, tool, result and affected system without unnecessarily storing sensitive prompts.<\/li>\n<li><strong>Test failure and abuse scenarios.<\/strong> Include unavailable backends, stolen tokens, prompt injection, excessive tool calls and attempted privilege escalation.<\/li>\n<li><strong>Maintain a fallback plan.<\/strong> Because MCP routing is in preview, avoid making a critical business process dependent on it without a tested alternative.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">These steps also support the Essential Eight, the Australian Government\u2019s cybersecurity framework that many organisations use as a security baseline. The gateway does not deliver Essential Eight compliance on its own, but controlled access, patching, monitoring and restricted privileges strengthen the wider control environment.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The right conclusion is controlled adoption<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Application Gateway for Containers MCP gateway is a meaningful step toward production AI agents on AKS. It gives technology leaders a clearer place to apply identity checks, encryption, routing, monitoring and standard security policy.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It should still be treated as one layer in a broader design covering agent identities, tool-level permissions, human approvals and incident response. Our Microsoft Agent Framework production guide provides further context for governing multi-agent and MCP environments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CloudPro Inc combines more than 20 years of enterprise IT experience with hands-on Azure, Microsoft Defender, Wiz, OpenAI and Claude expertise. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we help organisations move AI workloads from promising demonstrations to controlled business services.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you are considering MCP servers on AKS and are not sure whether the design is secure enough for production, we are happy to review the architecture and identify the practical gaps \u2014 no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Microsoft\u2019s MCP gateway for AKS creates one governed entry point for AI tools. Here is what it improves, what it does not, and how to assess production readiness.<\/p>\n","protected":false},"author":1,"featured_media":59560,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[80,139,13,68],"tags":[],"class_list":["post-59558","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-agents","category-azure-kubernetes-service","category-blog","category-mcp-server"],"jetpack-related-posts":[{"id":59444,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/27\/securing-agentic-ai-and-mcp-servers-in-microsoft-environments\/","url_meta":{"origin":59558,"position":0},"title":"Securing Agentic AI and MCP Servers in Microsoft Environments","author":"CPI Staff","date":"October 27, 2026","format":false,"excerpt":"A practical reference architecture for controlling AI agent identities, MCP tools, business data and automated actions across Microsoft environments.","rel":"","context":"In &quot;AI Agents&quot;","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/securing-agentic-ai-and-mcp-servers-in-microsoft-environments.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/securing-agentic-ai-and-mcp-servers-in-microsoft-environments.png 1x, \/wp-content\/uploads\/2026\/10\/securing-agentic-ai-and-mcp-servers-in-microsoft-environments.png 1.5x, \/wp-content\/uploads\/2026\/10\/securing-agentic-ai-and-mcp-servers-in-microsoft-environments.png 2x, \/wp-content\/uploads\/2026\/10\/securing-agentic-ai-and-mcp-servers-in-microsoft-environments.png 3x, \/wp-content\/uploads\/2026\/10\/securing-agentic-ai-and-mcp-servers-in-microsoft-environments.png 4x"},"classes":[]},{"id":59493,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/02\/azure-mcp-server-3-0-ga-what-it-leaders-need-before-connecting\/","url_meta":{"origin":59558,"position":1},"title":"Azure MCP Server 3.0 GA What IT Leaders Need Before Connecting","author":"CPI Staff","date":"November 2, 2026","format":false,"excerpt":"Azure MCP Server 3.0 makes agents more useful\u2014and potentially more powerful. Here is what IT leaders should check before connecting it to production Azure resources.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/11\/azure-mcp-server-3-0-ga-what-it-leaders-need-before-connecting.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/11\/azure-mcp-server-3-0-ga-what-it-leaders-need-before-connecting.png 1x, \/wp-content\/uploads\/2026\/11\/azure-mcp-server-3-0-ga-what-it-leaders-need-before-connecting.png 1.5x, \/wp-content\/uploads\/2026\/11\/azure-mcp-server-3-0-ga-what-it-leaders-need-before-connecting.png 2x, \/wp-content\/uploads\/2026\/11\/azure-mcp-server-3-0-ga-what-it-leaders-need-before-connecting.png 3x, \/wp-content\/uploads\/2026\/11\/azure-mcp-server-3-0-ga-what-it-leaders-need-before-connecting.png 4x"},"classes":[]},{"id":58659,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance\/","url_meta":{"origin":59558,"position":2},"title":"Microsoft Agent Framework Production Guide for A2A MCP Governance","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"The latest Microsoft Agent Framework releases improve long-running work, A2A reliability, MCP support and runtime controls. Here is what technology leaders should review before production.","rel":"","context":"In &quot;AI Governance &amp; Risk Management&quot;","block_context":{"text":"AI Governance &amp; Risk Management","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-governance-risk-management\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png 1x, \/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png 1.5x, \/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png 2x, \/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png 3x, \/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png 4x"},"classes":[]},{"id":57239,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/what-microsofts-new-ai-stack-means-for-safer-faster-ai-projects\/","url_meta":{"origin":59558,"position":3},"title":"What Microsoft\u2019s New AI Stack Means for Safer Faster AI Projects","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Agent Framework, Foundry, MCP and Aspire can speed up AI delivery without losing control. Here\u2019s what each layer does and how to decide what your business actually needs.","rel":"","context":"In &quot;Azure Foundry&quot;","block_context":{"text":"Azure Foundry","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-foundry\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/03\/post-17.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/03\/post-17.png 1x, \/wp-content\/uploads\/2026\/03\/post-17.png 1.5x, \/wp-content\/uploads\/2026\/03\/post-17.png 2x, \/wp-content\/uploads\/2026\/03\/post-17.png 3x, \/wp-content\/uploads\/2026\/03\/post-17.png 4x"},"classes":[]},{"id":53667,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/build-git-mcp-server-with-the-openai-agents-sdk\/","url_meta":{"origin":59558,"position":4},"title":"Build Git MCP Server with the OpenAI Agents SDK","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"This OpenAI post \"Build Git MCP Server with the OpenAI Agents SDK\" shows how to implement an MCP Server into an agent. Table of contentsWhat\u2019s the Git MCP server?Why MCP with the Agents SDK?Packages you needComponents in the codeTypes of MCP servers (transports)How the run worksScoping Git operations to a\u2026","rel":"","context":"In &quot;AI&quot;","block_context":{"text":"AI","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2025\/08\/build-git-mcp-server-with-the-openai-agents-sdk.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2025\/08\/build-git-mcp-server-with-the-openai-agents-sdk.png 1x, \/wp-content\/uploads\/2025\/08\/build-git-mcp-server-with-the-openai-agents-sdk.png 1.5x, \/wp-content\/uploads\/2025\/08\/build-git-mcp-server-with-the-openai-agents-sdk.png 2x, \/wp-content\/uploads\/2025\/08\/build-git-mcp-server-with-the-openai-agents-sdk.png 3x, \/wp-content\/uploads\/2025\/08\/build-git-mcp-server-with-the-openai-agents-sdk.png 4x"},"classes":[]},{"id":57883,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/using-a2a-and-mcp-together-for-safer-business-ai-systems\/","url_meta":{"origin":59558,"position":5},"title":"Using A2A and MCP Together for Safer Business AI Systems","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"A practical guide for CIOs and tech leaders on combining A2A and MCP to build AI systems that are useful, secure, and easier to govern.","rel":"","context":"In &quot;AI Agents&quot;","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/07\/using-a2a-and-mcp-together-for-safer-business-ai-systems.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/07\/using-a2a-and-mcp-together-for-safer-business-ai-systems.png 1x, \/wp-content\/uploads\/2026\/07\/using-a2a-and-mcp-together-for-safer-business-ai-systems.png 1.5x, \/wp-content\/uploads\/2026\/07\/using-a2a-and-mcp-together-for-safer-business-ai-systems.png 2x, \/wp-content\/uploads\/2026\/07\/using-a2a-and-mcp-together-for-safer-business-ai-systems.png 3x, \/wp-content\/uploads\/2026\/07\/using-a2a-and-mcp-together-for-safer-business-ai-systems.png 4x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/11\/what-the-aks-mcp-gateway-means-for-production-ai-agent-security.png","_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59558","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=59558"}],"version-history":[{"count":2,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59558\/revisions"}],"predecessor-version":[{"id":59561,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59558\/revisions\/59561"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/59560"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=59558"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=59558"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=59558"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}