Blog: MCP Gateways Are Not Runtime Authority

[amavashev]

Summary

• Adds the MCP Gateways Are Not Runtime Authority blog post dated 2026-05-03.
• Explains the boundary between MCP gateway/tool-access controls and runtime authority for budget, risk, scope, and cumulative exposure.
• Adds current MCP and OWASP security sources while keeping the tone complementary rather than anti-MCP.

Validation

• Internal link checks passed for the three reviewed drafts.
• npm test passed: 33 tests.
• npm run build passed before branch split; generated install-cache churn was restored.