Uber has deployed a new platform to manage how its artificial intelligence agents interact with thousands of internal services, offering a potential blueprint for other large enterprises grappling with AI governance. The Model Context Protocol (MCP) Gateway is now operating at production scale, serving as a centralized control surface for over 5,000 tools running on more than 800 servers. According to Uber's engineering team, the system was built to solve the "operational complexity, security risk, and developer friction" that arose from ad-hoc AI integrations across the company's vast microservice architecture.
Before implementing the gateway, Uber faced a challenge common in large-scale AI adoption: a proliferation of integrations that were difficult to govern. With thousands of backend services using different protocols like HTTP, gRPC, and TChannel, allowing AI agents to interact with them directly created fragmented, invisible data flows and security risks. An analysis from Codingscape highlighted that without a centralized strategy, companies can end up with "no oversight, no cost visibility, and no idea what data is leaving the building." Uber's solution was to create a unified architecture to standardize how AI agents discover and use tools, ensuring all interactions are secure and observable.
Dual-Plane Architecture: Separating Governance from Execution
The core of Uber's solution is a dual-plane architecture that separates governance from execution. This design consists of a control plane, the MCP Registry, and a data plane, the Proxy Gateway. This separation allows Uber to enforce company-wide policies and manage tool definitions centrally without creating a bottleneck for the high volume of live requests handled by the agents. The Agentic AI Foundation described this approach as a "control plane," noting that Uber adopted it not for elegance, but because it was a practical solution to the problem of "agents that move faster than the humans trying to govern them."
The control plane, or MCP Registry, acts as the system's brain. It is responsible for cataloging all available tools, managing access policies, and handling agent registration. Service owners can define which of their APIs are exposed as tools, but the process is managed centrally through code, with changes submitted as pull requests that undergo security scanning before deployment. The data plane, or Proxy Gateway, is the workhorse. It serves as the orchestration and routing layer that handles all live MCP interactions, translating agent requests into the appropriate backend protocol and directing them to the correct service.
Uber's MCP Gateway: Architectural Components and Functions
To manage the complexity of AI agent interactions at scale, Uber's MCP Gateway is built on a dual-plane architecture that separates governance from live operations. The system's key components each have a distinct role in ensuring that agent actions are discoverable, secure, and auditable. The following table breaks down these components and their primary functions based on Uber's design.
| Component | Architectural Plane | Primary Function |
|---|---|---|
| MCP Registry | Control Plane | Provides centralized governance. Manages the catalog of all available AI tools, defines access policies, and handles agent registration. All changes are managed as code and subject to security reviews. |
| Proxy Gateway | Data Plane | Handles live request execution. It routes agent calls to the correct backend service, translates between different protocols (e.g., HTTP, gRPC), and abstracts the complexity of the underlying service mesh from the agent. |
| Security Token Service (STS) | Security Layer | Issues short-lived, single-hop security tokens (JWTs) for each agent action. This enables low-latency, fine-grained authorization without significant performance overhead. |
| Actor Chain Propagation | Security Mechanism | Ensures end-to-end accountability by embedding a verifiable lineage in every request. This chain traces an action from the originating user, through any intermediate agents, to the final tool invocation. |
Integrated Security: Accountability with Low Latency
A critical feature of the MCP Gateway is its integrated security model, designed to provide strict oversight and accountability for every action an AI agent takes. According to a 2025 update from Uber's identity and access technology team, the ability to answer “who did what, when and why” is essential for auditing and trust. To achieve this, the system uses a mechanism called actor chain propagation, which embeds a verifiable lineage in every request, tracing the action from the original user through any intermediate agents to the final tool invocation.
To authorize these actions securely without slowing down operations, the gateway uses a dedicated Security Token Service (STS). This service issues short-lived, single-hop JSON Web Tokens (JWTs) for each tool call. This approach avoids the performance penalty of traditional, multi-hop authentication methods. Uber reported that in its production environment, the P99 latency for this token exchange is consistently below 40 milliseconds, demonstrating that robust security can be achieved without compromising the speed required for complex, multi-step agentic tasks.
Unlocking Developer Productivity and Future Growth
By centralizing agent interactions, the MCP Gateway has also simplified the developer experience at Uber. Engineers can now use an internal command-line interface, aifx, to allow coding agents to invoke any of the 5,000 tools through the gateway without needing to install or configure local servers. This standardization has made "Code Mode" the company default for tool use in coding agents. The gateway also employs a "gradual discovery pattern," which allows agents to find and load information about tools incrementally, optimizing the use of the model's limited context window.
Uber's work on the gateway is ongoing. According to a report from Forkast, the company's 2026 roadmap includes adding a Unified Policy Enforcement Plane and Dynamic Access Control. These features suggest a move toward even more granular, session-aware authorization, further tightening control over what agents can do within production systems. This evolution underscores the gateway's role as a foundational piece of infrastructure for safely scaling AI capabilities across the enterprise.
Implications for Enterprise AI Architecture
Enterprises considering large-scale AI agent deployments should evaluate a dual-plane gateway architecture with integrated security, similar to Uber's MCP Gateway, to address governance, accountability, and scalability challenges. The system provides a clear model for abstracting the complexity of a microservice environment while enforcing consistent security and observability. For other organizations, the key takeaway is the necessity of a centralized control plane to manage agent interactions before they become a source of operational risk.
A successful implementation of this architectural pattern would be marked by the ability to enforce centralized agent policies and maintain auditable logs of all agent actions within a complex production environment. Uber's deployment demonstrates that with the right infrastructure, it is possible to unlock the power of AI agents at enterprise scale without sacrificing control or security.
Sources
- Designing MCP Gateway Uber's MCP Management Platform
- Inside Uber's AI & MCP gateways: blueprint for engineering leaders — Codingscape
- How Uber Runs 60,000 AI Agent Tasks Per Week With MCP - Agentic AI Foundation (AAIF)
- Solving the Identity Crisis for AI Agents — Uber
- Uber Ships MCP Gateway at Production Scale — 800 Servers and 5,000 Tools Behind a Single Control Surface — Forkast
