Should an MCP gateway ever hold my database credentials?

A gateway necessarily connects to your systems, so it will hold or broker some credentials — the question is how. Acceptable: credentials vaulted, scoped to least privilege, rotatable, never exposed to agents, with agents authenticated via short-lived certificates. Unacceptable: shared service accounts, agent-side connection strings, or credentials that transit the vendor's cloud.

How long should an MCP gateway proof-of-concept take?

For one real source — not a sample dataset — two weeks is generous. Registration of a source should take minutes; the rest of the PoC is your validation work: policy behavior, audit output, failure modes. A vendor who needs six weeks to show you a working connector is telling you something about day-90 operations.

Is a cloud-hosted MCP gateway acceptable for regulated data?

Generally no. Every tool call transits a third party, credentials pool in someone else's infrastructure, and residency claims become contractual rather than architectural. Regulated workloads — PCI, PHI, classified — should require self-hosted or air-gapped deployment where data residency is a property of the system, not a clause in a DPA.

What TCO components do buyers most often miss?

Three: connector maintenance across vendor API changes (often the largest line over five years), the engineering cost of audit evidence assembly if the gateway does not produce it natively, and egress/usage pricing models that scale with the very agent adoption you are trying to encourage. Model all three before comparing sticker prices.

← All insights

Buyer's Guide

How to Evaluate an MCP Gateway: 10 Questions to Ask Your Vendor

Q: What is the fastest way to disqualify an MCP gateway vendor?

Ask where tool schemas come from. If schemas are generated at runtime by an LLM rather than built once, validated, and versioned, the vendor has reintroduced hallucination into the integration layer — and every other answer becomes suspect. Runtime generation is acceptable for prototyping, not for production governance.

By Talentys · September 17, 2026 · 10 min read

Every MCP gateway demo looks the same: an agent lists tools, calls one, and returns a clean answer. That demo proves the protocol works — it says nothing about what happens in month six, under audit, at 10,000 calls a day, with a confused deputy on the other end. If you are writing the RFP or running the PoC, this article gives you ten questions that separate production-grade gateways from protocol demos, and the answers you should expect to hear.

If you are new to the category, start with What Is an MCP Gateway? — this guide assumes you know the basics.

Why MCP gateway evaluation is different from SaaS evaluation

A gateway is not another SaaS seat. It sits in the path between your AI agents and systems of record — which means it inherits your security boundary, your audit obligations, and your uptime requirements. The failure modes are also different: the risk is not "the app goes down" but "an agent does something expensive, irreversible, or non-compliant at machine speed, thousands of times." Your evaluation has to probe the controls that govern behavior, not just features on a checklist.

The 10 questions

Architecture & deployment

Where does it run, and can it run fully on our infrastructure? Look for: self-hosted containers or binaries, no hard dependency on the vendor's cloud, air-gap support if you need it. A "hybrid" answer usually means the control plane phones home. For regulated estates, residency must be architectural, not contractual. (See ArcaX for Government & Defense for what full isolation looks like.)
Where do tool schemas come from? Acceptable: generated once per source at registration, validated, versioned, and fixed at runtime. Disqualifying: schemas re-generated per request by an LLM — that reintroduces hallucination into the integration layer.
How are agents and humans authenticated, and what do agents actually receive? Acceptable: short-lived mTLS certificates per agent identity, agents receive tools never credentials. Disqualifying: shared service accounts, API keys embedded in agent configuration, or long-lived tokens scoped wider than a single tool.

Security & governance

Is policy enforced on every call, and at what granularity? Ask for tenant, agent, tool, and row-level controls with read/write separation — evaluated by a real policy engine (e.g. OPA), not application code buried in the connector. Test it: ask them to deny a specific row to a specific agent, live, in the PoC.
How does it handle prompt injection and tool poisoning? The gateway should treat tool descriptions and returned data as untrusted input: output scanning, behavioral circuit breakers, and budget quotas that stop a runaway agent regardless of what the prompt says. (Deeper dive: our Zero Trust checklist.)
What does the audit trail look like, and can it serve as evidence? Logs are table stakes. You want append-only, cryptographically sealed trails (hash-chained or Merkle) with per-call attribution — agent, tool, parameters, policy decision, result size — exportable in formats your auditors already accept.
What happens when the gateway is down, or a source is misbehaving? Look for: graceful degradation, per-source circuit breakers, no write-path retries without idempotency, and clear failure semantics the agent can reason about.

Operations & economics

How does the connector catalogue match our estate? A long list of SaaS connectors means little if you run SAP, Oracle, mainframe, or proprietary SQL. Ask for a working PoC against one real source you operate — not the vendor's sample data. (ArcaX ships 73 enterprise connectors.)
What does it cost at scale — really? Model three lines most buyers miss: per-call or egress pricing (which penalizes the agent adoption you want), connector maintenance across vendor API changes over five years, and the engineering cost of assembling audit evidence if the gateway does not produce it natively. Compare five-year TCO, not sticker price.
What is the exit plan? Standard protocol on the agent side (MCP), exportable tool definitions, exportable audit history, no proprietary lock-in on your tool schemas. A gateway that owns your tool definitions owns your agent roadmap.

Running the PoC: two weeks, one real source

Two weeks is generous for a first source: registration should take minutes, so most of the PoC is your validation work. We recommend a fixed protocol:

Week 1 — happy path plus controls. Register one production-shaped source, expose three to five tools, verify per-call policy (including a live deny), and inspect the audit output with your security team in the room.
Week 2 — failure modes. Kill the source mid-call, inject a poisoned tool description, exceed a budget quota, and revoke an agent certificate. Watch what breaks and what the logs say about it.

A vendor who needs six weeks to show a working connector is telling you something about day-90 operations.

A note on compliance claims

Whatever the sales deck says, treat compliance as something you verify, not something you are told. The accurate framing for any infrastructure product is an aligned architecture — controls built to map onto PCI-DSS, GDPR, HIPAA or NIS2 requirements — and the vendor should be able to walk you, control by control, through that mapping. A claim of being "certified" or "compliant" on behalf of your deployment is a flag, not a feature: certification applies to audited systems, not to vendor marketing.

Frequently asked questions

What is the fastest way to disqualify an MCP gateway vendor?

Ask where tool schemas come from. Runtime LLM generation of schemas reintroduces hallucination into the integration layer — disqualifying for production.

Should a gateway ever hold my database credentials?

It will broker some credentials — the question is how: vaulted, least-privilege, rotatable, never exposed to agents. Shared service accounts or agent-side connection strings are disqualifying.

How long should a PoC take?

Two weeks for one real source is generous. If registration takes weeks, expect day-90 operations to look the same.

Is a cloud-hosted gateway acceptable for regulated data?

Generally no — residency becomes contractual rather than architectural. Require self-hosted or air-gapped for PCI, PHI, or classified workloads.

What TCO lines do buyers miss most?

Connector maintenance over five years, audit evidence assembly, and per-call/egress pricing that penalizes adoption. Model all three before comparing prices.

Next steps

Bring these ten questions to your next vendor call — and bring your security team to the PoC, not the demo. If you want a reference implementation to score against, ArcaX runs entirely on your infrastructure, registers its first source in minutes, and passes the two-week protocol above on day one. See also our ROI measurement framework for the numbers side of the evaluation.

Request a demo Read the technical docs