2026 Cloud Solutions Report, #6: API Management
MCP became shadow IT before it became a standard. Six API gateways race to become the control point for AI traffic.
Twenty-some years ago, the corporate IT department’s view of company PCs was chaotic. Employees would search the web, find a site, and install screen savers, free codecs, and utility executables (.exe) of unknown origin — and the company had almost no way to track what was inside any of them. What ended that era wasn’t better antivirus. It was the arrival of a control point that consolidated what executable, through what path, with what permissions enters the company — endpoint management, group policy, software catalogs.
May 2026 looks a lot like that period. Developers browse GitHub and the npm registry, pick the Model Context Protocol (MCP) servers with the highest star counts, and connect them to company data. But stars are a signal of popularity, not safety — and they’re not hard to inflate. The AI agent calling those tools doesn’t even know where they came from. In a March 2026 report, Qualys called MCP servers “the new shadow IT of the AI era.” It sounds like a metaphor; it’s actually a precise diagnosis [1]. Since Anthropic released MCP in late 2024, active public servers have crossed 10,000 within about a year, and OpenAI, Google DeepMind, and Microsoft have all adopted the standard — effectively making it the industry default [1]. At the same time, picking one up is so easy that the IT department has lost the ability to track who is connecting what to where.
How wide is the blind spot? The numbers speak. A public-internet scan by Knostic found more than 1,800 MCP servers running without authentication [2], and analysis from Astrix found that 53% of MCP servers depend on static secrets — long-lived tokens hard-coded into source or environment variables [1]. Servers exposed without authentication, connections leaning on long-lived tokens, dependencies that quietly settled into production without ever being formally approved — all of these are problems that emerge from not controlling who is connected to what, and they only become visible (and stoppable) once a control point is in place.
There’s a different kind of threat too: an incident where the package itself enters through the supply chain and operates inside an approved server. Even servers that were approved once aren’t re-checked at every update — so a single update to a trusted package can flip straight into a threat. The remote-code-execution vulnerability in the mcp-remote package (CVE-2025-6514) reached 437,000 download environments, and the popular Postmark MCP server — at 1,500 weekly downloads — quietly BCC’d every email a user sent to the attacker [2]. CVE-2025-32711 in Microsoft 365 Copilot enabled data exfiltration through hidden prompts, and a bug in Asana’s MCP exposed data between separate customer instances [2]. This category happens inside the approved server, so as discussed later, simply routing traffic through a gateway doesn’t stop it.
Anthropic’s own April 2026 roadmap reads like a confession of the same gap. The company named “Enterprise Readiness” as one of four priorities — while admitting it was the area where the definition was thinnest. The gaps it pointed to: audit trails, single sign-on (SSO) integration, gateway behavior, configuration portability [3]. Wide adoption arrived before the standard’s details did.
What’s different from twenty years ago is that it’s relatively clear where the control point belongs. The seat is being filled by the API gateway. If the Infrastructure-as-Code (IaC) layer covered in #4 defined infrastructure as code, and Kubernetes serves as the operating system for workloads, then the API gateway is the chokepoint that all AI traffic on top has to pass through. Six vendors compete for that seat. The ones covered in this report are Kong, Apigee (Google Cloud), Amazon Bedrock AgentCore, MuleSoft (Salesforce), Tyk, and Postman. In a 2026 where every vendor has announced “MCP support,” the meaningful criterion isn’t do you support it? — it’s how do you bring the shadow MCP already spreading inside companies under the gateway’s control?
Three Major Currents in 2026 API Management
The Reality of Shadow MCP
MCP servers are lightweight JavaScript and Python processes you can pull from GitHub or npm and run immediately — and that lightness is both the engine of explosive growth and the reason IT loses sight of the connection graph. The Qualys report breaks the evasion pattern into three: random high-numbered ports running locally, out of monitoring’s reach; embedded inside IDE plugins and developer tooling, staying outside IT’s field of view; and starting as a test, then quietly settling into production as a dependency without formal approval [1]. The 1,800+ unauthenticated servers Knostic found represent only what’s exposed on the public internet — unmanaged servers on internal networks aren’t in that count. The mcp-remote and Postmark cases show the package supply chain itself has become a threat vector — one update to a popular package puts tens of thousands of installations at risk simultaneously.
Governance is, fundamentally, an organizational-layer problem, not a protocol-layer problem. DX Heroes’ early 2026 analysis puts it plainly: tool annotations and OAuth flows “are not a substitute for organizational policy and monitoring.” It points out that fine-grained per-tool rules aren’t the default — the protocol gives you server-level allow/deny, but not standardized tool-level control — and that local MCP setups sit outside the same enforcement model as registry-backed servers [4]. For governance-as-policy to actually function, there must be an operational-layer control point that enforces it. That control point isn’t built at the protocol layer — it’s built at a single operational entrance.
Return of the Control Point — API Gateway Becomes the AI Control Point
API gateways are not a new invention. Authentication, rate limiting, logging, traffic routing, policy enforcement — these have been gateway standard features for the past twenty years. What’s different in 2026 is that these features are being applied to new targets. The target of authentication is shifting from humans and apps to AI agents; the unit of rate limiting is expanding from requests-per-second to tokens-per-minute; the unit of auditing is widening from per-call payloads to decision traces of agents.
One thing worth making clear: gateways don’t replace security tools. The work of detecting threats and judging permissions belongs to the security layer — the territory of CNAPP (Cloud-Native Application Protection Platform), zero trust, and non-human identity covered in #3 (Security). The gateway’s unique role is inline enforcement — making every piece of AI traffic pass through one point, by force. If security tools decide what is dangerous, the gateway creates the single path through which that decision can be applied. So the unauthenticated and unapproved category from earlier becomes visible and blockable via the gateway, but acts inside an approved server — like Postmark’s BCC — have to be caught by the security layer, not the gateway. If identity and access management (to be covered in a future installment) judges who, the gateway enforces through which path.
Six vendors compete for that role; the next chapter compares them across evaluation axes. That said, not every organization needs to build and operate this control point right now. If MCP is already in production inside the company, or if agents are touching internal data, the timing is moved up; otherwise it’s not too late to start with inventory (the threshold for when to act is sharpened in the closing recommendations). If you already have an API gateway, replacing it isn’t the play — but you do need to check the roadmap for whether it can handle MCP and A2A (Agent-to-Agent) traffic on the same plane, whether you can constrain LLM token cost through policy, and whether per-agent authorization is supported. Kubernetes has taken the seat of the AI workload operating system, but a separate control point has to sit on top of it.
The Right Way to “MCP-ify”
“MCP-ify” is the process of taking an existing API and exposing it as an MCP tool that AI agents can call. It can look like a simple conversion, but an MCP-ify done without going through a gateway creates a new entrance straight to company data — no different, in principle, from the .exe-installation era from the opening.
The right sequence is three steps.
- Discovery: tidy up the internal API inventory.
- Controlled exposure: enforce the gateway as the single path, while also verifying the source and integrity of any MCP server being exposed.
- Auditable operation: run agent-call traces and token-cost tracking together.
Skip discovery and start with exposure, and shadow MCP only grows. Vendor automation — Kong Context Mesh, AgentCore Gateway, Apigee API Hub Spec Boost — reduces friction in the controlled-exposure step, but the responsibilities for discovery and auditable operation still sit with the adopting organization. The same principle #4 (IaC) raised — “when AI writes infrastructure code, set guardrails with Policy as Code” — applies here. When an agent calls an API, the gateway policy is the same guardrail.
The Six Vendors: A Comparison of Control Point Capabilities
The comparison runs on four capability axes — discovery automation (does it make shadow MCP visible?), authorization separation (does it separate permissions per agent?), cost control (can it constrain LLM token cost via policy in advance?), and audit traces (can agent calls be traced?) — bracketed by each vendor’s core positioning and its sharpest weakness, including how tightly it locks you into a single cloud or ecosystem.
That said, the six vendors aren’t all standing on the same plane. Postman is closer to a complement that strengthens the discovery and catalog stage than a runtime control point — so it sits out of comparison on the authorization and cost-control axes. The other five compete directly for the control-point itself.
Kong — From API Gateway to AI Connectivity Platform
In February 2026, Kong declared a new category: “AI Connectivity.” At the center of it sits Context Mesh — Kong’s industry-first attempt to automatically discover internal APIs, convert them into MCP tools, and deploy them with runtime governance [5]. The MCP Registry integrates with Kong Konnect’s API service catalog to consolidate MCP server and tool registration, discovery, and governance in one place. The flow — scan existing internal APIs, auto-generate MCP tool definitions including authentication, deploy them on the Kong AI Gateway, and inherit existing access control and policy — tries to handle the three-step discover → controlled-exposure → auditable-operation process inside one product. A partnership with Solace, a real-time event-streaming company, extends the same idea — folding API, event streaming, and AI services into a single control point [6].
Where it hurts. Context Mesh and the MCP Registry are both in tech preview, so production validation is limited. The “AI Connectivity” category is still forming as a market, which weakens the case for budget allocation. And adding AI-agent traffic onto an API-traffic-based pricing model makes cost forecasting hard.
Apigee (Google Cloud) — Gartner Leader Meets LLM FinOps
Apigee has held a leader position in Gartner’s API Management Magic Quadrant for ten years running, and in the 2025 evaluation took the highest spot on “Ability to Execute” [7]. It runs as part of an ecosystem with MCP support integrated across Google Cloud — Maps, BigQuery, and more — and converts managed APIs into custom MCP servers, which means existing Apigee customers can expose their own APIs to AI agents immediately. APIM Operator for GKE has reached general availability (GA), delivering lightweight API management on Kubernetes environments [8].
The differentiator: two LLM workload policies have shipped GA, allowing token-usage monitoring and rate limiting to control the cost and resource consumption of AI calls. This is the “API FinOps for the AI era.” API Hub’s Spec Boost has AI analyze existing API specifications and auto-enrich examples, descriptions, and error documentation — a discovery-stage automation that helps agents understand APIs better.
Where it hurts. Pricing runs high against competitors, which raises the entry bar for low-traffic deployments. Lock-in to Google Cloud makes it hard to operate as a standalone tool in multi-cloud environments. Customer complaints persist about the migration complexity between Apigee X (next-gen) and Apigee Edge (legacy).
Amazon Bedrock AgentCore — From API Gateway to Agent Gateway
Amazon Bedrock AgentCore Gateway converts API Gateway endpoints, Lambda functions, and existing services into MCP-compatible tools with a few lines of code, and exposes them to agents. For organizations with AWS workloads, it’s the lowest-friction path to controlled exposure.
The centerpiece is Policy, which reached GA on March 3, 2026. It intercepts an agent’s tool calls through the gateway in advance and applies fine-grained permissions — counted as the first production-grade implementation of agent governance [9]. Evaluations (GA since March 31, 2026) provide quality assessment based on the agent’s actual behavior; Episodic Memory is long-term memory that lets the agent learn from experience and adapt to similar situations; and bidirectional streaming supports natural conversation for voice agents.
Where it hurts. AgentCore Gateway delivers its full capability only inside the Bedrock ecosystem, so integration with other LLM providers — direct Anthropic API or Azure OpenAI — is limited. The relationship between an existing API Gateway and AgentCore Gateway is unclear; there can be situations where the two have to run side by side. And a core feature like Episodic Memory remains in preview.
MuleSoft (Salesforce) — From Integration Platform to Agent Orchestrator
MuleSoft Agent Fabric aims to be the integration hub of the agent era. The three-axis composition: Agent Registry (catalog of agents and AI assets), Agent Broker (intelligent routing between agents), and Flex Gateway (MCP and A2A security and management) [10]. It’s a rare configuration that handles MCP and A2A together, and combined with Salesforce Agentforce 3’s native MCP support, delivers an uninterrupted flow from CRM data to AI agent actions. Anypoint Code Builder enables MuleSoft development inside MCP-aware IDEs like Cursor and Windsurf, with Einstein for Anypoint auto-generating API specifications and DataWeave transformations. In 2026 it also took the Leader spot in Gartner’s iPaaS (Integration Platform as a Service) Magic Quadrant.
Where it hurts. Lock-in to the Salesforce ecosystem makes it overkill for organizations not running Salesforce. Anypoint Platform pricing sits at enterprise-only levels, which raises the bar for mid-size and smaller organizations. The complexity of an integration platform makes the full stack overweight for organizations that just need API management.
Tyk — The Open-Source Alternative AI Gateway
Tyk is an open-source API gateway supporting REST, GraphQL, TCP, and gRPC, with a “batteries-included” philosophy of no feature lock-in as its differentiator. It maintains open-source authenticity as a member of CNCF, the Linux Foundation, and the OpenAPI Specification. Tyk AI Studio is an open-core AI gateway that handles routing, governance, and security for LLMs, agents, MCP toolchains, and RAG (Retrieval-Augmented Generation) workloads from a single control point. Core controls like rate limiting are available even in the Community Edition. Just as OpenTofu was the open-source alternative to Terraform covered in #4 (IaC), Tyk is the open-source alternative to Kong’s commercial strategy. For regulated industries where data sovereignty matters and self-hosting is preferred, it’s the most natural choice.
Where it hurts. Brand recognition is lower than Kong, Apigee, or AWS, which makes enterprise adoption harder to argue for. AI Studio is open-core (open-source core with commercial extensions), so the boundary between what’s open-source and what’s commercial-AI is unclear. Global PoP (Point of Presence) and infrastructure are more limited compared to the cloud service providers’ gateways.
Postman — From API Testing Tool to AI-Native API Platform
In March 2026, Postman declared “a new era of AI-native API development” and rolled out a platform-wide rework [11]. Agent Mode is an agentic feature where AI edits and generates collections, tests, and mocks across the repositories connected to Postman, and the platform adds native MCP-protocol support alongside HTTP, GraphQL, gRPC, and WebSockets. The API Catalog provides a single view across specifications, collections, test runs, CI/CD activity, and production observability — positioned as a “system of record” for the API portfolio. AI test generation automatically adds contract, load, unit, integration, and E2E (end-to-end) tests to APIs; Agent Mode receives context from MCP servers and automates multi-step changes.
Where it hurts. Postman’s traditional strength is API testing, not API management, so it doesn’t provide the runtime gateway features Kong, Apigee, and AWS offer. The AI-native features shipped in March 2026 and lack enterprise production validation. Pricing on paid plans tends to climb fast with team size, a frequent complaint.
A Closing Note for CIOs and CTOs: 2026 API Strategy
The 2026 API strategy doesn’t start with adopting a new standard. It starts with restoring the control point. That said, not every organization needs to bring in a new gateway right now. If MCP servers are already deep in production internally, or AI agents are touching internal data, or LLM token cost has reached non-trivial levels, restoring the control point can’t be deferred. If none of the three apply, the work right now isn’t acquiring a tool in a hurry — it’s running inventory and monitoring, and gauging the timing of adoption. For organizations where the control point needs restoring, the first question is one. How do you bring shadow MCP — already spreading inside the company — under the gateway, and settle it into auditable operation? Four recommendations.
Recommendation 1: Run the shadow MCP inventory first.
Before building the control point, find out what MCP servers exist inside the company, where they’re connected, and how. The recommended approach uses three paths: GitHub and npm usage analysis, internal network traffic analysis, and developer interviews. Without this work, you’d be starting with no idea what the control target even is.
Recommendation 2: Force the gateway as the single entrance.
Once the inventory is in hand, set network policy so all MCP traffic must pass through the gateway. This is the same principle as blocking unapproved .exe installation through group policy in the .exe era. If your existing API gateway doesn’t support MCP and A2A, the short-term move is an adapter in front; the medium-term move is gateway replacement or addition.
Recommendation 3: Design LLM token cost as part of API FinOps.
The LLM token cost an agent generates by calling an API has a different volatility profile from existing API cost. Design gateway-level controls — Apigee’s LLM workload policy, Kong AI Gateway’s token limits — as part of FinOps. This is a place where pre-set policy controls matter, not after-the-fact invoice analysis.
Recommendation 4: Unify the governance of the API team and the AI team.
If the API team and the AI team operate as separate governance, APIs stay in a state agents can’t use safely, and agents call APIs without control. Operate both strategies inside a single governance framework. As the earlier DX Heroes diagnosis put it, the failure of governance happens at the organizational layer, not the protocol layer [4] — restoring the control point is, in the end, an organizational job.
The things to avoid are also clear. Bringing in a gateway without an inventory. Opening exposure before discovery. Expecting that a vendor’s “MCP support” announcement means the gateway also blocks incidents inside approved servers. All three add new entrances instead of building a control point.
What ended the .exe era twenty-some years ago wasn’t better antivirus. It was the arrival of a control point. The same thing is happening to AI infrastructure in 2026, and the API gateway is taking that seat.
References
[1] Qualys. “MCP Servers: The New Shadow IT for AI in 2026.” Qualys Blog, March 19, 2026. https://blog.qualys.com/product-tech/2026/03/19/mcp-servers-shadow-it-ai-qualys-totalai-2026
[2] Hou, J., et al. “Securing the Model Context Protocol (MCP): Risks, Controls, and Governance.” arXiv:2511.20920, 2026. https://arxiv.org/html/2511.20920v1
[3] Model Context Protocol. “The 2026 MCP Roadmap.” Model Context Protocol Blog, April 2026. https://blog.modelcontextprotocol.io/posts/2026-mcp-roadmap/
[4] DX Heroes. “MCP Governance in the Enterprise: What the Landscape Looks Like in Early 2026.” 2026. https://dxheroes.io/insights/mcp-governance-landscape-early-2026
[5] Kong. “Kong Launches Context Mesh to Connect Enterprise Data to AI Agents.” PRNewswire, February 10, 2026. https://www.prnewswire.com/news-releases/kong-launches-context-mesh-to-connect-enterprise-data-to-ai-agents-302683492.html
[6] Kong. “Kong and Solace Announce Partnership to Unify API and Real-Time Data and Event Streaming.” PRNewswire, February 18, 2026. https://www.prnewswire.com/news-releases/kong-and-solace-announce-partnership-to-unify-api-and-real-time-data-and-event-streaming-302691193.html
[7] Google Cloud. “Apigee, a Leader in 2025 Gartner Magic Quadrant for API Management.” Google Cloud Blog, 2025. https://cloud.google.com/blog/products/ai-machine-learning/apigee-a-leader-in-2025-gartner-api-management-magic-quadrant
[8] Google Developers. “Google Cloud Announces APIM Operator for Apigee General Availability.” Google Developers Blog, May 12, 2025. https://developers.googleblog.com/google-cloud-announces-apim-operator-for-apigee-general-availability/
[9] AWS. “Amazon Bedrock AgentCore adds Quality Evaluations and Policy Controls for Deploying Trusted AI Agents.” AWS Blog, March 3, 2026. https://aws.amazon.com/blogs/aws/amazon-bedrock-agentcore-adds-quality-evaluations-and-policy-controls-for-deploying-trusted-ai-agents/
[10] Salesforce. “Salesforce Launches MuleSoft Agent Fabric to Orchestrate and Govern Any AI Agent Across the Agentic Enterprise.” Salesforce News, 2026. https://www.salesforce.com/news/stories/mulesoft-agent-fabric-announcement/
[11] Postman. “New Postman is Here.” Postman Blog, March 2, 2026. https://blog.postman.com/new-postman-is-here/
Part of the 2026 Cloud Solutions Report — an ongoing series on the 2026 cloud tooling landscape. See the full series →
Originally published in Korean by NIA Digital Service Issue Report, June 2026. Written as Adjunct Professor at KAIST College of Business.
Korean version on Brunch: brunch.co.kr/@chaesang/188
Comments