How Enterprises Are Securing MCP Server Traffic in 2026

MCP has quickly become the preferred standard for connecting AI agents to third-party tools and databases. But in the rush to adopt AI agents, connection standards are outpacing security solutions. Malicious actors have no trouble finding and exploiting new loopholes, and security teams are lagging dangerously far behind.

A Bloomberry researcher recently scanned approximately 1,400 MCP servers to check whether each one required authentication. Of the servers where the researcher could tell one way or the other, 38.7%, almost two out of every five, turned out to require none at all. That means anyone, anywhere, could connect to the server, start a session, see every tool it exposed, and, in some cases, actually call one of those tools to retrieve data.

This is the gap that’s opened up as MCP adoption has outpaced security, leaving a significant share of servers without authentication. A number of security companies have responded by developing firewall-style products designed to monitor and control the traffic passing through these environments.

These solutions might be called “AI firewalls,” but they aren’t the same as the firewalls that use AI to protect networks from traditional threats. Today’s AI firewalls protect AI systems and traffic from threats designed to target them.

There are three main approaches to securing MCP server traffic:

1. Network-layer inspection
2. Dedicated posture management
3. Gateway-based identity controls

Each approach uses a different technical methodology and addresses different concerns. In this article, we’ll look at how these approaches work, where they differ, and the limitations organizations should consider.

Why MCP Security Needs Its Own Attention

MCP is a connector standard rather than a security standard. It gives agents and applications a consistent way to reach external tools and data sources, and while the protocol does define an optional authorization framework, implementation is inconsistent, and it still doesn’t monitor connection requests or inspect the traffic passing through them for malicious activity.

AI agent security tools alone aren’t enough to ensure MCP security. Agent security solutions don’t necessarily inspect or control the MCP layer because there are many ways AI agents can interact with external systems. MCP is just one attack surface within the larger agentic ecosystem, which gives rise to the authentication gap uncovered by the Bloomberry researcher.

Combatting these risks requires dedicated visibility into MCP servers and interactions, something general agent security tools may not offer.

Dependable MCP security should include effective controls over who and what can access MCP servers, which tools they can invoke, and how those interactions are monitored and verified. Examples of technologies addressing different aspects of MCP security include Check Point, Salt Security, and TrueFoundry.

Network-Layer Inspection

Network-layer inspection focuses on identifying and monitoring MCP traffic as it moves across the network. This can include discovering MCP servers and MCP-connected tools, maintaining an inventory of those connections, categorizing activity by risk, and applying policies in real time when traffic falls outside the defined rules. Check Point’s AI network firewall is one example of technology that applies this approach to MCP security.

At the network layer, security controls can also be used to identify potentially malicious interactions, including prompt-injection attempts, before requests reach external tools or data sources. These controls may operate through existing network security infrastructure rather than requiring MCP security to function as an entirely separate layer.

Policy enforcement takes place as MCP traffic passes through the network infrastructure, allowing defined security rules to be applied in real time. One limitation is visibility: network-layer controls can generally inspect only the traffic that passes through infrastructure they can observe. Organizations using this approach therefore need to consider how much of their MCP environment falls within that visibility.

Dedicated MCP Posture Management

Another approach is to use a dedicated security layer designed specifically for AI and agentic infrastructure. Salt Security’s agentic security platform is one example of technology that takes this approach.

Dedicated agentic security tools can map relationships between LLMs, MCP servers, and APIs to provide visibility into how these components interact. This type of approach can also incorporate capabilities such as AI posture management, threat detection, and response to identify risky configurations and potentially malicious activity.

This approach can provide additional visibility into MCP and agentic infrastructure and help identify threats earlier. However, introducing a dedicated security layer can also add operational complexity, as security teams must deploy and manage an additional platform alongside their existing tools.

Gateway-Based Identity Injection

A different approach to MCP security focuses on identity and the credentials associated with individual requests. TrueFoundry is one example of technology that uses this identity-focused approach. Its gateway checks the credentials of the human user behind each attempt to connect with the MCP server and injects them into the request. This makes the user’s credentials an inherent component of the request and prevents agents from relying on broad generic privileges.

With this approach, the credentials carried by an agent’s request reflect the permissions of the human user behind it. Instead of the agent acting under its own account permissions, as many agents do by default, the request carries the human user’s own credentials. This means the agent cannot access more than that specific user is already allowed to access or end up with more privilege than the person behind it.

One limitation of this approach is that it only applies to traffic configured to pass through the gateway.

Which Approach Actually Solves the Problem

Organizations trying to secure their MCP traffic face a dilemma in that there’s no obvious “best” choice. Each of the three approaches addresses different issues. Network-layer inspection surfaces what’s happening on the network and whether connections should be allowed. Dedicated posture management provides deeper visibility into MCP and the broader agentic stack. Identity-focused controls verify that a specific action matches what the human user is authorized to do.

For organizations that are primarily worried about visibility into the MCP servers and tools already operating in their environments, network-layer inspection can provide visibility into traffic and connections using existing network infrastructure. Dedicated posture management may be useful for organizations directly building or managing a large, growing MCP footprint. For environments concerned about agent privilege creep, identity-based controls can help ensure that agent access remains tied to the permissions of the human user behind the request.

What’s most important is to think seriously about all the aspects of MCP security. It’s going to take more than just one tool and a quick fix to close the 38.7% authentication gap mentioned above. Network visibility, MCP posture management, and user-level authorization are all pieces of the same puzzle, and organizations should consider them all.