Tools MCP and External Integration

Tools MCP and External Integration

MCP Gateway — References

Mcp gateway › References

20 of 65 in this book · 2 min read

The protocol being mediated, the intermediary semantics that govern what a component in the middle may change, and the authorisation mechanics behind credential brokering.

What is being aggregated

  • Model Context Protocol — the specification, including the capability negotiation and change-notification mechanics an aggregating intermediary has to reproduce on both sides. Linked at its root; revision paths have changed.
  • JSON-RPC 2.0 Specification — the message layer, and in particular the error-object structure whose fidelity across a hop determines whether a caller can still recover from an upstream failure.

Behaving correctly as an intermediary

  • RFC 9110: HTTP Semantics — intermediary obligations: which headers are hop-by-hop, what a proxy may alter, and the semantics of the gateway-origin status classes.
  • RFC 9111: HTTP Caching — freshness, validation, and invalidation; the vocabulary for reasoning about how long an aggregated catalogue copy may be served before it misleads.
  • RFC 6585: Additional HTTP Status Codes — the too-many-requests status and the Retry-After convention a mediating component must both honour upstream and emit downstream.

Credential brokering across the hop

  • RFC 8707: Resource Indicators for OAuth 2.0 — requesting a token bound to a specific target, the mechanism that stops an intermediary from reusing one credential against every upstream.
  • RFC 8693: OAuth 2.0 Token Exchange — exchanging an inbound credential for one scoped to a downstream service, including the delegation and impersonation distinction a mediation point has to choose between.

The hazard a mediation point creates

  • The Confused Deputy (or why capabilities might have been invented) — Norm Hardy, ACM SIGOPS Operating Systems Review, 1988. The original description of a privileged intermediary being induced to use its own authority on a caller's behalf. Cited by name.

No verified reference is recorded for aggregate catalogue curation, cross-upstream naming conventions, or health-driven advertisement. These are operational practice rather than anything published.