The architecture worked as designed. That was the problem: an untrusted tool result influenced a second, clean request that passed every control. The implementation evidence, the blind spot, and how it changed the design.
MCP fragmentation isn’t a developer-experience problem — it’s a security surface. Part 1: why there’s no single place to ask whether an AI-agent tool call should happen.
The architecture that gives AI-agent tool calls a single place to be decided: one gateway, one port, six checks, per-identity profiles, and brokered credentials. No code — just the design and the trust boundaries.