The most dangerous five words in enterprise AI right now are not a jailbreak. They are: “Our gateway secures MCP.”
Snowflake entered the MCP security game with Cortex AI Gateway, a product that inherits a $1.33 billion quarterly product revenue story but carries a much darker inheritance: the assumption that controlling tool calls through a single chokepoint is the same as making agents safe. It is not. It is the opposite. I have watched this pattern before. Every time the market demands trust, it builds a wall. And every wall eventually becomes a target.
On the same week Snowflake pitched its gateway as the solution, NadMesh — a botnet I had been tracking in on-chain threat intel circles — listed MCP server-side tool invocations as its preferred attack surface. The defender and the attacker arrived at the same conclusion simultaneously. That is not a coincidence. That is a narrative collision.
The Protocol and the Shell Game
MCP, or Model Context Protocol, began as Anthropic’s answer to tool sprawl. It was never meant to be a security boundary. The protocol has now undergone its biggest revision since launch, a stateless spec focused on scalability and modularity. That revision telegraphed what the market already knew: agents were outgrowing their plumbing.
Snowflake’s move was to acquire Natoma, a team that had been building exactly the identity-and-audit layer MCP lacked, and fold it into Cortex AI Gateway. The product sits between enterprise agents and the third-party tools they call, enforcing identity, policy, and audit at the tool-call level. Not model training. Not inference optimization. Governance.
To sell this, Snowflake assembled seven identity partners — 1Password, Aembit, Cyera, Linx Security, Okta, SailPoint, and Saviynt. That is a signal: Snowflake is not trying to be an identity provider. It is trying to be the place where identity meets tool call. When a gateway can say “this specific human, through this specific agent, called this specific API under this specific policy,” it becomes the new center of gravity for enterprise AI.
The data cloud was the first act. Agent interoperability is the second. And Snowflake is betting that the gatekeeper of that handoff wins the entire enterprise stack. The shift from data interoperability to agent interoperability is not a technical upgrade. It is a strategic pivot that says: the data warehouse is no longer enough. You have to own the layer above it.
The Race to Own the Handoff
That race is already being priced in. Cyera agreed to acquire Oasis for $1 billion in under 72 hours. Okta bought Permiso for around $200 million. These are not product acquisitions; they are narrative acquisitions — the market is paying a premium for agents that can assert identity before they act.
This is the same pattern I saw in DeFi when “liquidity fragmentation” was used to justify a new gateway or aggregator every week. The problem was manufactured by the fragmentation itself. We are doing it again with agent security: dozens of MCP gateways, each claiming to be the trusted layer, while the same small pool of enterprise agent deployments gets sliced into ever-thinner compliance slices. This is not scaling. It is disintermediation dressed as protection.
The competitors are scattered across every conceivable entry point: API management players like Kong, agent runtime platforms like Diagrid, dedicated MCP gateway startups like MintMCP, general agent platforms like Obot, plus TrueFoundry, Lunar.dev, Arcade, and more. When the technical entry point is so fragmented, the market has not yet found the standard. What it has found is a land grab.
Snowflake hopes to win not by protocol purity but by proximity. Enterprise decision-makers already trust the data cloud. The gateway becomes a feature extension, priced as part of a subscription, deployed inside a walled garden. That is a powerful distribution story. But it is also a trap: the same enterprise trust that lowers acquisition cost also raises the consequence of failure.
Attackers Are Already Inside the Narrative
Meanwhile, the attack side is moving faster. NadMesh has listed MCP as its primary target because MCP servers are, by design, exposed, semi-trusted, and often operated by third parties. The stateless spec may improve modularity, but it also broadens the attack surface. When a botnet says your brand-new security standard is its favorite on-ramp, you do not get to call the security story solved.
The first major MCP intellectual property lawsuit, Runlayer v. Rippling, is now pending in the Southern District of New York. That matters because legal risk lands on the customer, not the protocol. Enterprises now have to underwrite two unknowns at once: will this gateway stop the next NadMesh variant, and will my MCP server usage survive a copyright claim? Most security frameworks cover neither.
To make it worse, 57% of organizations report a material gap in security and risk management skills. So we are asking teams that are already underwater to configure seven identity vendors, monitor a new audit layer, and respond to an attack class that did not exist two years ago.
From my own audit experience, I can tell you that the bottleneck is never the technology. It is the staffing. A company can buy the best gateway on the market and still be vulnerable because nobody on the team knows how to write a correct policy for a tool-call boundary. The gateway becomes a false floor: it looks solid from above, but underneath there is nothing but the same tired spreadsheets and alert fatigue.
The Contrarian Case: Centralization Is the Vulnerability
Here is the contrarian angle, and it will be uncomfortable for anyone selling governance layers: the gateway is the new single point of failure. Centralized audit is convenient, but it also creates a target-rich environment. Once an attacker compromises the gateway, they do not need to attack every individual MCP server; they just read the token vault and replay the tool calls. The audit trail becomes the treasure chest.
I have seen this in custody systems for years. The thing that was supposed to provide the “single source of truth” turns out to be the “single source of compromise.” Snowflake’s gateway is not immune to that logic. It is the most concentrated expression of it. Every agent that passes through the gateway is handing its keys to a central intermediary. That is not security. That is a honeypot with a nice dashboard.
There is also a deeper structural weakness that Snowflake cannot engineer away. MCP is pushed by Anthropic. The gatekeepers of the standard’s future are not Snowflake, not Okta, not even Microsoft. Any change in MCP governance, licensing, or reference implementation can rewrite the rules of the game in a single GitHub commit. The seven identity partners are an alliance against cloud-platform gateways, but they are still tenants on land owned by the protocol.
Institutional legitimacy is being mapped onto a foundation that can be forked. I have spent enough time mapping institutional narratives in this industry to know that when the protocol layer is controlled by a single powerful actor, the business logic above it is always fragile. The only real moat would be owning the standard itself. Snowflake does not. Anthropic does.
The Myth Repeats
In a way, we are constructing new myths from the ashes of Luna again. The old myth was “code is law.” The new myth is “the gateway is trust.” We already know how that ends when the myth outruns the mechanism.
What comes next is not another gateway. It is verifiable provenance. The enterprise that wins the next cycle will not ask “which tool did the agent call?” but “can I prove who approved that call, in a way that survives an audit, a lawsuit, and a botnet?” That will require more than an enterprise gateway; it will require programmable attestation at the tool-call layer, and a recovery narrative that is not built on a single chokepoint.
The market is currently rewarding gateways because gateways are easy to understand. They fit into existing enterprise procurement. They generate familiar compliance checkboxes. But the next market cycle tends to punish the thing that was easiest to understand first. If I am right, the real winners will be those who build tools that make the gateway itself auditable — self-attesting, distributed, and capable of surviving its own compromise.
The question I keep asking myself is not whether Snowflake can secure MCP. It is whether any centralized chokepoint can secure agents without becoming the next NadMesh. The answer depends on whether we learn from the last collapse — or simply gate the runway.