AI agents become far more useful once they can look things up themselves: the ticket, the merge request, the row in the database. They also become far more dangerous. I built gateway, an MCP server that sits between agents and internal systems. These are the rules it enforces.
#Rules
- Read-only by construction. Tools exist for reading issues, merge requests, commits, files and running
SELECT. There is no write tool, so no prompt can talk it into writing. - Mask before the model sees it. Personal data (passport and tax numbers, phones, emails, card numbers, tokens) is masked inside the gateway. The model never gets the raw value, so it cannot leak it.
- Budgets. Every caller has a rate limit (30 calls a minute) and SQL results are capped at 200 rows. Agents loop; budgets turn a runaway loop into a polite error.
- Schema first. For SQL there is a schema tool, and the query tool accepts only
SELECT. Agents learn the table before they guess at it. - Everything is audited. Every call, its arguments and its result size go to an audit log that a human can watch live, and one kill switch turns access off.
#Why a gateway and not direct credentials
- One place to enforce policy, instead of trusting each agent's configuration.
- One place to see what happened when an answer looks wrong.
- Credentials stay on the server; agents only hold a token for the gateway.
#Shape
agent ──MCP──▶ gateway ──▶ tracker / git hosting / SQL (read-only users)
│
├── mask PII
├── rate limit + row cap
└── audit log + kill switchThe result: agents answer "why did this document fail yesterday?" with real evidence, and nobody has to paste production data into a chat.