Which path to choose
It depends on size, and there's no need to overdo it.
- Small team (a few people): a shared configuration with trusted servers, read-only access where possible and confirmations on. No infrastructure, just common rules and discipline.
- Structured company (many people, sensitive data): an MCP gateway, that is a single point that sits between the assistants and the servers and decides who can use what, keeps a log (audit) and controls costs. There are several well-known examples on the 2026 market; the choice depends on your requirements.
The rule: start light, add a gateway only when the number of people and servers makes the configuration ungovernable by hand.
How to do it
The steps apply at different scales, but the order is the same.
- Take inventory of trusted servers. Decide on a list of approved servers that collaborators can use. Everything else is forbidden until you assess it. That's "deny-by-default".
- Give each one the minimum. Read-only where it's enough, restricted folders and databases, confirmations on for serious actions. The working syntax for a team configuration with read-only on shared documents:
{
"mcpServers": {
"team-documents": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "/path/shared-folder-read-only"]
}
}
}
- Keep track of what the AI does. In a small team, even just agreeing on which tools are used and for what. In a company, a gateway logs every action (who, when, which tool): it's needed for security and to understand costs.
- Align permissions to people. A collaborator with read-only access to the data must not have an AI that can write. The AI inherits the rights of whoever uses it, never more.
A concrete example
A consulting firm with five people wants to use AI on client documents without risks. The owner defines a shared folder for the working documents, connects a read-only filesystem server to it, and establishes a rule: confidential files sit in another folder, not accessible to the AI.
He agrees with the team that the only servers allowed are the documents one and the calendar one, both with confirmations on. No one connects servers found at random. In six months the AI saves hours of work on documents and there has never been an unwanted access, because the list of servers is short, access is read-only and the rules are shared. No gateway: for five people discipline was enough.
When it does NOT work (and how to fix it)
If the AI has more permissions than the people
It's the most common governance mistake: an assistant that can do more than whoever uses it. Align the AI's permissions to those of the collaborator: if a person can only read a system, their AI must see only read tools. In a company this is enforced with a gateway; in a team it's agreed and verified.
If costs rise with the servers
Every server connected to an external service can generate costs, and with many users they grow fast. Keep the list of servers essential, monitor what consumes the most, and in a company use a gateway that sets spending caps. Restraint with servers is also saving.
If no one knows what the AI does
Without a log, in a company you don't know who had the AI do what. For few users it's enough to agree and trust; beyond a certain size you need an audit (the gateway provides it). Visibility isn't bureaucracy: it's what lets you discover a problem before it becomes serious.
A tip from someone who actually uses it
Write a single page of shared rules on the use of AI in the company: which servers are allowed, what's read-only, what requires confirmation, what must never be fed to the AI. Have everyone read it. It's worth more than any technical tool: most incidents come from a person connecting something without knowing the rules, not from a software flaw.
Frequently asked questions
Do I necessarily need an MCP gateway?
No, for a small team it's almost always overkill: trusted servers, read-only and confirmations are enough. The gateway becomes useful when you have many people, many servers and the obligation to track everything (for example in regulated sectors). Below that threshold it's complexity that doesn't pay off.
How do I manage shared credentials in the team?
Never inside shared configuration files in plain text. Passwords and keys go into a credentials manager, and each person uses their own where possible. A secret pasted into a file that circulates among colleagues is the first place trouble starts from.
Can I have the AI used on client data while respecting privacy?
Yes, with caution: read-only, only the necessary folders or data, and an assessment of what the AI can really see. For third parties' personal data, check the legal privacy obligations with the relevant people: the technology lets you limit access, but the legal responsibility remains yours.