Most of the advice about securing MCP tools is sound and vague: "vet your servers," "scan responses," "fail closed." Good instincts, no spec. Microsoft's Agent Governance Toolkit — an MIT-licensed, open repo — turned one of those instincts into something you can actually conform to.
What the spec is
The piece worth reading is MCP Security Gateway 1.0. It describes a policy-enforcing interception layer that sits between an agent and its MCP tool servers — a gateway every tool call and every tool response passes through. And it's written in RFC-2119 conformance language: the MUSTs, SHOULDs, and MAYs are load-bearing, which means an implementation can be measured against it rather than vibe-checked. The repo ships exactly that measurement: a conformance suite of 127 tests against a Python implementation.
The gateway pattern itself isn't new. What's new is having the boundary specified precisely enough to test, instead of each team reinventing it.
The concrete mechanisms
