Akamai AI and API Manager
MCP Gateway Features
The full capability map: MCP-native protocol enforcement, a built-in OAuth 2.1 authorization server, default-deny tool governance, inline guardrails, and audit-grade observability — for human users and autonomous agents alike, on one gateway on Akamai Connected Cloud.
OAuth 2.1
Authorization server built in
12
Identity provider presets
10+
Log & SIEM platforms
300+
Edge locations on Akamai
Protocol
MCP-native, end to end
The gateway parses and understands MCP, so policy, audit, and security decisions key off the tool being called and its arguments — not just URLs and headers. That's the difference between an MCP gateway and an HTTP proxy with MCP in the name.
Native MCP parsing
The gateway parses JSON-RPC 2.0 and understands MCP semantics — initialize, tools/list, tools/call, prompts, and resources. Tool lists are rewritten per caller, blocked tools are refused at the protocol level, and every invocation becomes a typed audit event.
Schema validation
Tool arguments are validated against JSON Schema before anything executes — types, ranges, patterns, enums, required fields. Malformed messages are rejected at the gateway with well-formed JSON-RPC errors, so garbage never reaches the servers behind it.
Streamable HTTP, current with the spec
Implements MCP's official remote transport with TLS on every hop, and negotiates protocol versions across every published MCP revision. As the spec evolves, the gateway tracks it — typically as soon as a revision lands.
Speaks MCP on both sides
Paired with MCP Server, the platform also generates spec-compliant MCP servers from your OpenAPI definitions — so customers can publish tools and govern them on one platform.
Agents
Built for autonomous agents, not just users with AI tools
People in Claude or Cursor are only half the story. Agents run headless, chain tools together, and retry aggressively — with no one watching each call. MCP Gateway treats agents as first-class principals: their own identity, delegation they can prove, least-privilege scope, hard ceilings, and per-call attribution.
Agents as first-class principals
Every agent is a registered OAuth client with its own identity — dynamically registered, authenticated with PKCE, and named in every log line. Headless agents that can't do a browser login authenticate with ID-JAG assertions, cloud workload identity, mTLS, or API keys.
Delegated authority, provable
When an agent acts for a person, ID-JAG token exchange carries that delegation cryptographically — short-lived, single-audience assertions with fine-grained authorization constraints. The tool knows exactly who the agent is working for, and the audit trail proves it.
Least privilege per agent
Default-deny catalogs scope each agent to exactly the tools its job requires — a support agent sees ticketing tools, never payroll. An unrecognized agent starts with nothing until you grant it.
Runaway agents hit ceilings
Agentic loops can go wrong fast — retry storms, recursive tool calls, sudden fan-out. Per-agent rate limits, quotas, timeouts, and response-size caps contain the blast radius in real time, no matter what the agent decides to do.
No human in the loop? Fail closed
Autonomous calls don't get a human sanity check, so the gateway provides one: schema validation rejects malformed calls, injection screening guards the agent's context, and destructive tools can be restricted to specific roles or gated behind step-up claims. Enforcement fails closed.
Every action attributed
Which agent, on whose behalf, called which tool, with what outcome — every call is attributed to the specific agent client, including the client info it declared at connection. Incident response starts with answers, not archaeology.
Identity & authentication
A real authorization server, not a pass-through
MCP Gateway is itself an OAuth 2.1 authorization server, and it keeps real identity attached to every hop — human or agent, from client to tool to backend. This is the section that wins security reviews.
A full OAuth 2.1 authorization server
Dynamic Client Registration (RFC 7591) and Client ID Metadata Documents, authorization code with PKCE, rotating refresh tokens, and revocation. Access tokens are resource-bound (RFC 8707): a token minted for one MCP route is rejected by every other.
One login through your IdP
Users authenticate through your corporate identity provider: presets for Okta, Microsoft Entra, Auth0, Cognito, Google, Keycloak, Ping, OneLogin, WorkOS, Clerk, and Logto — plus any OIDC-compliant provider.
End-to-end user identity (Cross-App Access)
Implements ID-JAG identity assertions (RFC 8693 token exchange), so when an agent calls a tool on Alice's behalf, the tool sees Alice — not one over-privileged service account shared by everyone. Few gateways ship this today.
Per-user upstream credentials
Every user gets their own upstream connection, and clients never see upstream tokens. Stored credentials are encrypted with AES-256-GCM; gateway-issued tokens are stored only as one-way hashes — a database leak yields no usable credentials.
Short-lived tokens by default
Gateway-minted access tokens default to 15 minutes with rotating, revocable refresh tokens, and every call is forwarded with a fresh per-user credential resolved at request time. A leaked token has a small blast radius.
Workload & machine identity
Inbound mTLS against a certificate authority you control, federated keyless authentication for GCP, AWS, and Azure workloads, and API-key policies for non-OAuth automation.
Tool governance & authorization
Default-deny governance for every tool
Every tool an agent can reach is explicitly approved, scoped by role, and versioned in git. Denial is real enforcement at the protocol level — not hiding tools from a list while direct calls still work.
Tool-level RBAC that hides and blocks
The capability filter classifies every tool, prompt, and resource as public or restricted to named roles and groups. Non-permitted tools are removed from tools/list and refused on direct invocation — callers can't probe for hidden tools. Fail-closed by design.
Curated, allow-listed catalogs
Declare the approved set; everything else the upstream offers is unreachable. Each entry carries governance metadata — owners, classifications — and descriptions can be overridden at the gateway. Deprecating a tool is a config change that deploys in seconds.
Attribute-based access
Access rules read any claim in the token — department, clearance, tenant — with zero code. Custom resolvers see full request context, and external decision points plug in via AuthZEN, OpenFGA, Okta FGA, and Axiomatics.
Governance as code
Catalogs and policies are configuration in git: pull-request review, CODEOWNERS, and full history make every change to your AI attack surface auditable by construction. Account RBAC gates who can deploy to production.
Environment isolation
Production, preview, and development environments each get their own URLs, secrets, catalogs, and upstream credentials — a tool can be live in dev without existing in prod.
Consent & connection control
Connecting to an upstream on a user's behalf runs an explicit OAuth consent step, and an admin-managed mode restricts who can establish connections. The gateway can inject or correct annotations like readOnlyHint and destructiveHint, so clients get honest signals about what a tool does.
Guardrails & data protection
Inline defenses on every call
Screening for the MCP-specific threats — prompt injection, tool poisoning, data exfiltration — layered over structural controls that hold even when detection alone can't.
Prompt-injection & tool-poisoning screening
A dedicated detection policy screens tool results and descriptions before they reach the agent — an LLM-based detector built for MCP tool-poisoning patterns, with a strict mode that fails closed.
Akamai Firewall for AI, first-class
Firewall for AI is integrated as native gateway policies for inbound and outbound screening — your Akamai security estate extends into MCP traffic instead of stopping at it.
DLP & redaction
Built-in recognizers for PII, financial data, national IDs, and credentials — plus your own patterns and thresholds — mask sensitive values in place, block the response, or log the finding before anything reaches an agent's context window.
Interceptors
Intercept any tool call in flight: enforce rules on arguments before they execute, reshape or trim results before they return. Applied centrally at the gateway — no changes to the upstream server.
Rate limits, quotas & hardening
Multi-dimension rate limiting keyed per user, per client, or per tool, longer-window quotas, and request-size limits — plus MCP hardening defaults covering argument size, capability counts, timeouts, and response size.
Encrypted everywhere
TLS on every client and upstream connection, inbound mTLS support, and mTLS inside the platform with no public IPs on internal services. Stored upstream credentials get application-layer AES-256-GCM on top of encrypted storage.
Observability & audit
An audit trail built for your SOC
Not text logs — a typed MCP event stream that answers “which user, via which agent, called which tool, and what happened” in one correlated trail, streaming in real time into the tools your security team already runs.
User → agent → tool → backend, correlated
Every stage emits structured, typed events sharing correlation IDs: the authenticated user, the OAuth client and the client info it declared, the capability invoked, and the upstream outcome — including every token-lifecycle event. One trail, not four disconnected logs.
OpenTelemetry MCP tracing
W3C trace context flows through JSON-RPC _meta following the OpenTelemetry MCP semantic conventions, so traces survive hops that plain HTTP instrumentation drops. Per-tool spans, duration histograms, and OTLP export to any backend.
Real-time SIEM & SOAR export
Logs and MCP audit events stream to Datadog, Splunk, Sumo Logic, Google Cloud Logging, AWS CloudWatch, Grafana Loki, New Relic, Dynatrace, and any OpenTelemetry backend. Structured JSON with typed fields — SOC playbooks key off fields, not string parsing.
Privacy-first by default
The standard trail is metadata — who, which tool, when, outcome — which satisfies most audit requirements without storing payloads. Payload capture is opt-in, with DLP masking applied before anything is emitted.
Deployment & platform
Runs where you need it — natively on Akamai
Three deployment models on the same gateway, a zero-trust architecture underneath, and TypeScript programmability when a built-in doesn't fit.
Managed edge
Globally distributed across 300+ locations on Akamai Connected Cloud — zero infrastructure to run, scale, or patch.
Managed dedicated
Single-tenant, region-pinned deployments for isolation and data-residency requirements.
Self-hosted
A standard container image in your own Kubernetes or VMs, with the managed control plane for config, deploys, and observability — the hybrid pattern.
One gateway, every server
One gateway fronts every MCP route — GitHub, Stripe, internal servers — each with its own upstream, credentials, and policy stack. Tenant identity is available to routing, policies, and rate-limit keys, and weighted traffic-splitting supports staged rollouts.
Zero trust, structurally
Nothing is trusted by network position. Every call presents a resource-bound token verified per request, upstream hops re-authenticate with per-user credentials or workload identity, OAuth state is signed and single-use — replay attempts become explicit audit events — and customer workloads run in isolated V8 isolates.
Fits your existing estate
Plain HTTPS on both sides: it slots behind Akamai CDN, WAF, and DDoS protection and runs alongside incumbent API gateways — keep them for classic API traffic and add AAM as the MCP governance layer, no rip-and-replace.
Programmable to the edge case
Custom policies, handlers, and logging plugins are written in TypeScript — a real language, versioned and reviewed in git, not a proprietary DSL. Preset configurations cover common servers like GitHub, Stripe, Linear, Notion, and Atlassian.
Standards
Built on the standards your security team will ask about
Every mechanism above is an implementation of an open standard — which is why MCP Gateway holds up in RFPs and security reviews rather than asking anyone to trust proprietary magic.
| Standard | Where it shows up |
|---|---|
| OAuth 2.1 + PKCE | Client and agent authentication at the gateway's built-in authorization server |
| RFC 7591 Dynamic Client Registration + CIMD | MCP clients register and connect without manual app setup |
| RFC 8707 Resource Indicators | Tokens bound to one MCP route — replay against any other is rejected |
| RFC 8693 Token Exchange (ID-JAG / Cross-App Access) | Real user identity propagated agent → tool → backend |
| RFC 9396 Rich Authorization Requests | Fine-grained authorization_details constraints on exchanged tokens |
| OpenID Connect | Federation to your IdP — 12 presets plus any OIDC-compliant provider |
| MCP Streamable HTTP | The spec's official remote transport, across every published protocol revision |
| JSON Schema | Tool-argument validation before any tool executes |
| W3C Trace Context + OpenTelemetry MCP conventions | Distributed traces that survive the MCP hop into your APM tool |
SOC 2 Type II certified
Independent audit of the platform's security controls, report available under NDA.
Penetration tested
Third-party pen-test reports available under NDA through the trust center.
Audit evidence for your programs
Account-level audit logs, the typed MCP event trail, configurable retention, and real-time SIEM export put evidence in your system of record.
A governed MCP route is a config change, not an infrastructure project
See how these features map to real deals in Use Cases and Competition, or contact the AAM team for a demo.