The Model Context Protocol gave the agent economy a transport. It didn't give it a trust layer.
The Model Context Protocol is the best thing that has happened to AI agent development in a year. Before MCP, every integration between an AI agent and an external tool was custom code: bespoke schemas, ad-hoc authentication, brittle parsers. After MCP, there is one protocol. An agent that speaks MCP can use any tool that speaks MCP. The integrations compose.
The ecosystem has exploded. Anthropic supports MCP natively in Claude Desktop and Claude Code. OpenAI added MCP support to ChatGPT. Cursor, Continue, Cline, Windsurf, every coding agent in the developer ecosystem speaks MCP. There are MCP servers for filesystems, GitHub, GitLab, Slack, Discord, Stripe, every major SaaS, every major database, every internal API any company has bothered to wrap.
What MCP did not standardize is security. The protocol defines the transport, the schema, the call/response shape. It says nothing about authentication boundaries, policy enforcement, audit trails, or attack surface. The protocol is, by design, infrastructure. Security was supposed to be someone else's problem.
Nobody has solved it.
Every MCP integration creates an authenticated API endpoint that an AI agent can call. The agent decides which tools to call, with which arguments, in which sequence. The MCP server executes those calls. The server has whatever credentials and permissions the developer gave it. The agent is, effectively, a privileged user of every tool wired to it.
This is fine when the agent is well-behaved. The agent is not always well-behaved. Prompt injection works. Models with tool access execute prompt injections regularly. Adversarial RAG content, malicious tool descriptions, indirect injection through tool outputs — all of these have been demonstrated in the wild.
The May 11 Hard Fork podcast episode was the moment this became mainstream concern. Kevin Roose and Casey Newton — two technology journalists with prominent platforms and substantial personal AI tool usage — spent the better part of an episode worrying about MCP security for their own projects. Roose mentioned his side project AI Box. Both of them are MCP users. Both of them are worried.
They are right to be. Their listeners are right to be. The structural problem is real.
Three categories of products have emerged:
Enterprise MCP gateways (MintMCP, IBM ContextForge, TrueFoundry, Microsoft AGT). These are infrastructure platforms that sit in front of MCP servers, provide authentication, observability, and policy enforcement. They are designed for organizations with security teams, compliance requirements, and infrastructure budgets. They are the right tool for that audience.
MCP scanning tools (Trail of Bits mcp-context-protector, Zenity, Straiker). These analyze MCP server configurations for known vulnerabilities — tool poisoning, server impersonation, line jumping attacks. They protect against attacks on MCP infrastructure rather than attacks through MCP infrastructure.
Nothing for individual developers. No hosted product. No five-minute setup. No sensible-default-with-no-policy-authoring option. The closest thing is Microsoft AGT, which is technically free but requires the developer to deploy a Kubernetes sidecar.
This is a market gap, not a technical gap. The technology exists. The category exists. The audience exists. The product, until now, did not.
Inherence Labs is the security layer that should have shipped with MCP. A hosted gateway your AI agent calls instead of calling tools directly. Sensible defaults configured at signup time block the actions that destroy work or drain accounts. Per-tool overrides handle the edge cases. The whole thing is rate-limited free for personal projects and small-team production.
Underneath the integration is a cryptographic guarantee that signed-log products cannot offer: every authorized tool call produces a zero-knowledge proof that the policy was correctly applied, verifiable independently of our infrastructure, in milliseconds, on any standards-compliant verifier including Ethereum and any EVM-compatible chain. For the use case of "I just want my agent to not get prompt-injected into draining my Stripe," you do not need to think about the proofs. They are there if you ever need to convince anyone of what your agent did or did not do.
MCP is the protocol layer of the agent economy. We are the security layer.