Uber MCP Gateway: architecture behind 800+ servers and 5,000+ tools

Primary source: Uber Engineering (October 1, 2026). SML's per-call scored judgment is our independent analysis, not an Uber product claim. Updated October 26, 2026.

The architecture, with dated receipts

Why Uber built it: early MCP integrations were built team by team — agents got more capable once they could reach live business context, but as hundreds of teams explored agentic workflows, "tools were hard to discover, difficult to operate reliably, and coupled to particular services or agents." One layer now hides protocol differences, applies consistent security and observability, and makes tools easy to create, find, and reuse.

What Uber gated — and what it didn't

Uber's write-up is the most mature enterprise MCP authorization design published in 2026. Read it as three layers:

Layers 1 and 2 are provisioning-time authorization: they answer may this tool ever be called, and by whom. That's enablement — consent granted in advance. But an LLM-written description (AutoCrawler writes them from doc comments) plus a one-time enablement decision plus 5,000 tools means the call pattern is never re-judged. Enablement is consent. Consent is not judgment.

This slots directly into September's authorization arc: RSA Agent ID (Sept 30) answered who may act; Uber's gateway (Oct 1) answers which tools may be exposed to whom; the per-call gate answers whether this particular invocation should fire. Three different questions, three different layers — and only the third one scores the call itself.

Proof: two calls, two receipts, minted today

We scored two gateway-shaped tool calls against the live decision gate (local-heuristic-v1, bands ≥0.80 auto / 0.50–0.79 confirm / <0.50 escalate) on October 4, 2026 ~14:20 EDT:

Exact request shape, so you can mint your own:

curl -s -X POST https://scriptmasterlabs.com/api/harness/decide \
  -H "Content-Type: application/json" \
  -d '{"state":{"environment":"staging","actor":"agent"},
       "questions":[{"id":"q1","type":"score","scale":[0,1],
       "question":"Should the agent call a newly enabled third-party MCP tool
        to batch-delete 40 resolved tickets, with no per-call review and no
        human confirmation, during a production incident?"}]}'

The second gap: 800 servers and nobody scores the listing

Uber's stated original pain: "tools were hard to discover." Their answer: AutoCrawler generates agent-friendly descriptions with an LLM, and owners refine them. But LLM-written descriptions are exactly what drifts — every description change needs an owner-approved config diff, and 800 servers of owner-refined copy is a discoverability lottery. An agent picks tools from their descriptions; a vague description at 5,000-tool scale is an invisible tool.

That's what SqueezeRank MSO grades: any MCP server listing across six axes — Purpose Clarity, Usage Guidelines, Behavioral Transparency, Parameter Semantics, Conciseness, Contextual Completeness — with per-tool grades and a prioritized fix list. Sold pay-per-call via x402: $0.003 per score, $0.023 for a full optimization cycle (score, rewrite, audit, registry probes, fix plan). Uber built the plumbing by hand; the grading layer for the listings that flow through it is a $0.023 fix per server.

Do it yourself: add the per-call layer (5 steps)

1. Default-deny, like Uber. Every tool starts disabled; ownership and enablement live in one registry. Steal this wholesale — it's the correct floor.
2. Score the call, not just the caller. Charter policies answer who may call; add a per-invocation confidence score (state + question + scale) with three bands: ≥0.80 auto-fire, 0.50–0.79 confirm, <0.50 escalate and log.
3. Put the proxy where you can see it. The data plane already translates every call — that's where the scoring hook lives, one policy evaluation per invocation, no per-team plumbing.
4. Grade your listings. If an LLM wrote your tool descriptions, score them before agents discover them: purpose verb first, when-to-use guidance, described parameters, trimmed server description.
5. Log like the FTC is watching. Every scored decision — instruction, confidence, band, action, timestamp — appends to the audit trail (why this matters).

Claim receipts

Reading the field

The write-up is already drawing second-order analysis. Forkast (Oct 3, 2026) called it "the first publicly documented Fortune 500 MCP deployment at this scale" and read the disabled-by-default design as treating "discovery as a starting point, not an authorization — a distinction that matters when thousands of services are involved." That framing agrees with ours — and invites the next question: authorization to expose a tool still isn't authorization to fire a specific call. The primary source is Uber's engineering blog (Designing MCP Gateway).

FAQ

Is Uber's MCP Gateway open source? The design write-up is published on Uber's engineering blog (Oct 1, 2026); we found no open-source release of the gateway itself in the sources we could verify.

Does the gateway handle payments? Not in the published design — it's authorization, routing, and observability. The payment layer for tool calls is exactly what per-call paid-MCP work (the spending-guard landscape) and decision-gated payments address.

How does this relate to Uber's consumer business? It doesn't directly — this is internal developer infrastructure for Uber's AI agents, not a rider product.