How MCPG establishes who a caller is and decides what they may do — a three-tier trust model, native JWT/OIDC verification, and a pre-dispatch authorization chain that fails closed.

Configure inbound identity for humans, workloads and AI agents. The gateway verifies JWT bearers natively; richer or chained identity loads as plugins.

How MCPG uses the AAuth drafts to identify agents, the people they act for, and what they are allowed to do — the access modes, how each is configured, and the nuances that decide whether it works.

Authorize tool calls, prompts, and resources. Three policy engines plus a built-in trust floor; chain them for defense-in-depth.

MCPG runs every backend and extension as a verified plugin. Ed25519 signatures, SHA-256 content pinning, a revocation list, and typed fail-closed capability grants gate what loads and what it can touch. Set Enforce in production.

A tamper-evident, hash-chained, fail-closed compliance ledger. Every authorization decision, payment, and access attempt is recorded with actor, action, resource, and outcome, fanned out to durable sinks.

An honest statement of MCPG's MCP protocol conformance — both supported wire versions pass the upstream third-party conformance suite on every CI run, gated as a required check.