MCP gateway adapter production boundary hardening

[dinpd]

Outcome

Harden the reference MCP gateway adapter into a production-credible integration boundary while keeping AgentPass separate from the network gateway itself.

Coverage gap

The adapter demonstrates tools/list filtering and tools/call authorization, but its documented limitations include transport/session handling, cancellation, streaming results, downstream authentication, JIT orchestration, provider-specific mapping, and drift reporting.

Scope

• Explicitly supported MCP transports and protocol lifecycle.
• Session negotiation, cancellation, and streaming behavior for guarded calls.
• Downstream authentication and credential isolation.
• JIT challenge/approval continuation behavior.
• Provider-specific argument mapping extension points.
• Tool-list drift reporting and fail-closed policy.
• Durable-state integration guidance for production deployments.

Acceptance criteria

• The supported transport and session matrix is documented and tested.
• Cancellation and streaming cannot bypass authorization or produce ambiguous execution records.
• Downstream credentials never enter model-visible or broadly propagated telemetry.
• A challenged call can resume with a correctly bound approval/JIT grant.
• Provider argument mappers are deterministic, testable, and fail closed on missing required context.
• Tool drift produces structured findings before sensitive calls are forwarded.
• At least one production-style deployment example passes automated integration tests.

Non-goals

• Turning AgentPass into a universal MCP gateway product.
• Replacing provider business authorization.