One MCP gateway beats twelve tool logins

Every product team ends up with a pile of tools and dashboards, and then asks an agent a simple question with no clean path in except screenshots pasted into chat.

I've been building around a simpler shape: one read-only MCP gateway in front of the team's tools. One place to authenticate. One policy surface. One place to answer "what did the agent look at?"

Start read-only on purpose. Agents are good at synthesis and bad at unsupervised mutation of production. Write access can wait until the read path has earned trust.

I won't put internal wiring in a blog post. The portable idea is enough: agents shouldn't collect SaaS logins. Teams should expose one governed door.