Oracle Adds a Gateway to Control AI Agents’ Access to Company Tools

Oracle is planning a gateway that gives enterprise AI agents one controlled route to company tools, instead of letting each agent connect directly to separate Model Context Protocol servers. The product, Oracle Integration MCP Gateway, is due in the Oracle Integration 26.10 release and is designed to centralize identity checks, approved-tool access, policy enforcement, credential handling and activity records.

MCP is a standard way for AI systems to discover and call software tools. Oracle’s design puts a gateway between MCP clients and both Oracle Integration servers and approved third-party MCP servers. Clients connect to one endpoint; the gateway applies an organization’s configured controls before routing an allowed request onward.

The agent no longer carries the keys

The proposed controls begin with authentication and authorization for an AI agent, user or service. Administrators can register participating servers, choose which tools agents may see, and apply reusable security and business policies at the gateway, server or individual-tool level. That structure is intended to support least-privilege access: an agent gets only the tools needed for its task.

• Tool filters can limit clients to explicitly approved MCP tools.
• The gateway can evaluate security and business policies before a request reaches a downstream server and, where applicable, when a response returns.
• It can resolve downstream credentials through controlled stores, so agents need not receive direct access to them.

Policy becomes part of the request path

The distinction matters most when a tool can do more than retrieve information. Oracle’s example is an operations agent that can use approved diagnostic tools but not tools that make production changes. It also describes a customer-service agent that may retrieve customer information while sending sensitive actions to a person for review.

Visibility is part of the product promise

Oracle says the gateway can record request activity, tool usage, outcomes, policy decisions and health signals to support operations, audits and troubleshooting. Its accompanying demonstration covers onboarding multiple MCP servers, turning integrations into MCP tools, setting tool-filter, personally identifiable information and business policies, then monitoring the resulting activity.

The announcement describes the intended controls, not a record of their use in production. The main operational question will be how organizations define their approved tools and policies: centralizing enforcement can reduce scattered access decisions, but it also makes the gateway’s configuration a consequential boundary for what an agent can discover, request and do.