---
title: Securing an MCP server with PingGateway
description: Use PingGateway as a security gateway to intercept, validate, audit, and enforce OAuth 2.0 authorization on AI agent requests to MCP servers.
component: identity-for-ai
page_id: identity-for-ai:identity:idai-securing-mcp-servers-gateway
canonical_url: https://developer.pingidentity.com/identity-for-ai/identity/idai-securing-mcp-servers-gateway.html
llms_txt: https://developer.pingidentity.com/identity-for-ai/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-09-16T20:34:52Z
keywords: ["MCP server", "MCP security", "AI security"]
page_aliases: ["agents:idai-securing-mcp-servers-gateway.adoc"]
---

# Securing an MCP server with PingGateway

When [securing any MCP server](idai-securing-mcp-servers-oauth.html), implementing an appropriate, consistent, documented, auditable, and adaptable security model can be challenging.

![PingGateway acts as an MCP gateway in your AI security architecture.](_images/idai-mcp-gateway.png)

In this architecture, PingGateway:

1. Intercepts and validates an MCP request from an AI agent to an MCP server. It optionally audits and throttles traffic.

2. Authorizes the AI agent request using OAuth 2.0.

3. Protects the MCP server by enforcing OAuth 2.0 scopes. It optionally acts as a policy decision point and transforms security tokens.

PingGateway addresses the challenges in protecting any MCP server by providing a unified layer to:

* Allow only valid MCP requests.

* Audit MCP requests and actors.

* Throttle request rates.

* Enforce coarse-grained OAuth 2.0 security controls.

* Enforce fine-grained access control policies.

* Perform token transformation mapped to your security models.

The [MCP security gateway](https://docs.pingidentity.com/pinggateway/latest/mcp/index.html) tutorial in the PingGateway documentation shows how to protect any MCP server with PingOne Advanced Identity Cloud acting as the OAuth 2.0 authorization server.