The data shows a 72-hour window in which $1.2 billion of enterprise security capital moved into agent identity infrastructure. Cyera paid $1 billion for Oasis. Okta paid roughly $200 million for Permiso. Both closed within three days, before sell-side analysts could publish their first coverage notes. This is not venture experimentation. This is institutional capital making a directional bet on a single layer of the emerging AI stack: the gateway that governs how autonomous agents discover, authenticate, and execute tools.
The same week, the NadMesh botnet formally designated MCP as a preferred attack surface. Two acquisitions, one botnet, zero coordinated announcements. The market, as always, moves faster than the narrative.
MCP โ the Model Context Protocol, open-sourced by Anthropic โ has crossed the threshold from developer novelty to enterprise infrastructure. Like all infrastructure that matures, it now attracts three distinct predators: capital, adversaries, and litigants. The question is whether the infrastructure itself is ready for the attention.
Let me ground the technical context. MCP standardizes the interface between AI agents and external tools. It is, functionally, HTTP for agent-to-instrument communication. An agent discovers a capability, authenticates against it, executes a tool call, and receives structured results. The protocol is deliberately stateless โ each request carries its own context. That design simplifies horizontal scaling but complicates exactly what enterprises now demand: session continuity, audit trails, and policy enforcement across multi-step agent workflows.
The stateless specification revision currently moving through the community is the largest since launch, focused on modularity and extensibility. But here is the tension nobody is discussing: gateways require state. To enforce identity across a multi-step tool-call sequence, you need session context. A stateless protocol and a stateful governance layer are not natural allies. The engineering reconciliation has not been publicly addressed. No throughput benchmarks. No latency overhead data. No architectural diagrams. The product exists. The metrics do not.
Snowflake's answer is Cortex AI Gateway, assembled primarily through the acquisition of Natoma. The mandate is precise: enforce identity, policy, and audit at the tool-call layer. Not model inference optimization. Not agent orchestration. Governance โ the unglamorous middle layer that determines whether enterprise AI deployments survive contact with compliance teams.
The commercial context matters. Snowflake reports $1.33 billion in quarterly product revenue. Thousands of enterprise customers already run data workloads inside its cloud. The migration path is legible: from data interoperability โ the company's original wedge โ to agent interoperability. The term itself carries a quiet admission. Data interoperability is now a saturated market; every data platform delivers it. Moving upward into agent execution is not an expansion. It is a necessity disguised as a strategy. When your core wedge commoditizes, you migrate up the stack or you decay.
Seven identity partners launched alongside the gateway: 1Password, Aembit, Cyera, Linx Security, Okta, SailPoint, and Saviynt. That is not a feature list. That is a distribution alliance.
The acquisition pattern is the first signal worth interrogating. Natoma was not a Snowflake R&D project. It was purchased. Cyera purchased Oasis. Okta purchased Permiso. In every case, incumbents chose to buy rather than build. That signals the organic development window has closed. First-mover integration assets are now, in the market's judgment, irreplaceable.
From my 2018 ICO audit work, this pattern is familiar. During the token boom, projects with real traction were acquired at premium valuations because acquirers lacked the internal velocity to build competitive products. โ Scenario: When one protocol's deflationary burn mechanism looks mathematically elegant but evaporates under liquidity stress, you learn that capital formation speed rarely correlates with engineering depth. A $1 billion price tag for Oasis, with no disclosed revenue, tells you more about the buyer's urgency than the asset's intrinsic value.
The security vector is nastier than the press release implies. NadMesh's decision to list MCP as a primary attack surface is the clearest available confirmation that adversaries now view agent-tool communication as a high-value ingress point. The threat model is direct: an agent with tool access is a privileged user. Compromise the MCP server, and you inherit the agent's entitlements โ payment rails, internal APIs, customer data. The reporting cites 57% of organizations admitting significant security and risk management capability gaps. That is the operational reality. Even with gateways deployed, most enterprises lack the personnel to configure policies correctly, monitor alerts, and respond to incidents. The result is security theater: an audit log exists, but no one is reading it. Code is law, until it isn't. When nobody audits the audit trail, the law is fiction.
The 2022 Terra collapse taught me a parallel lesson about feedback loops. UST's algorithmic stability and LUNA's inflationary pressure created a death spiral that the entire industry could model after the fact but nobody could stop in real time. MCP's security dynamics are building toward the same shape. The attack surface expands faster than defensive tooling matures. NadMesh is not a threat report. It is a leading indicator.
The competitive field reads like a topology map of an industry that has not agreed on its own boundaries. Kong approaches from API management heritage, treating MCP gateways as an extension of traffic control. Diagrid comes from the Dapr runtime lineage, arguing that agent workflows need a distributed runtime before a governance layer. MintMCP and Lunar.dev are protocol-native startups building from first principles. Obot embeds gateway functions into the agent's execution environment. Arcade targets the developer experience layer. TrueFoundry approaches from ML infrastructure. That is not competition. That is fragmentation. Seven different philosophical approaches to the same unsolved problem. Nobody has proven product-market fit, and the eventual winner will likely outlast the field rather than out-feature it.
Notably absent from this field is any credible open-source challenger with a sustainable economic model. The gateway layer is being built exclusively by commercial entities. That creates an incentive misalignment at the foundation: a governance layer that charges rent to enforce policy will always favor complexity over simplicity, because simplicity reduces billable surface area. I have seen this dynamic before. In the 2020 DeFi lending cycle, protocols that monetized complexity captured TVL at the expense of protocols that prioritized clean architecture โ until the complexity itself became the attack surface.
The commercial architecture follows a classic bundling playbook. Snowflake's $1.33 billion quarterly product revenue is the war chest. Attach the gateway to existing data cloud subscriptions, reduce marginal sales friction, capture governance spend before specialized rivals establish beachheads. The seven identity partners function as technical integrations and channel alliances. Each brings enterprise security relationships Snowflake does not possess. This is a coalition play designed to preempt the cloud hyperscalers' built-in gateway offerings.
AWS Bedrock and Azure AI Foundry both ship native agent governance capabilities. Snowflake cannot outspend the hyperscalers on cloud infrastructure. So it builds a horizontal layer above the clouds, using data gravity and identity partnerships as leverage. Whether that layer survives contact with hyperscaler pricing power is an open question. My 2024 ETF arbitrage work taught me to respect the structural advantage of the entity that controls the underlying settlement layer. In cloud AI, the hyperscalers are the settlement layer.
Protocol governance is where this gets genuinely fragile. MCP is open source, but its strategic direction remains effectively controlled by Anthropic. Every participant in this market โ Snowflake, Okta, Kong, Diagrid, MintMCP, Lunar.dev, TrueFoundry, Obot, Arcade โ is constructing skyscrapers on a foundation they do not control. The protocol can fork. Licensing can shift. Governance can be captured. My 2026 audit of AI-agent protocols found that 90% lacked robust economic incentives for honest behavior. The governance deficit at the protocol layer is the same disease, one level deeper. A gateway enforces policy. It does not create it. If the protocol's incentive structure rewards extraction over honesty โ which is the current default for most open protocols โ no gateway can compensate.
The legal vector is quieter but equally consequential. Runlayer v. Rippling, filed in the Southern District of New York, is the first major MCP intellectual property dispute. The signal, independent of the merits, is that MCP's economic value has matured enough to sustain litigation. Enterprises evaluating gateways now perform a compound risk assessment: security risk plus IP infringement risk. That doubles diligence burden and lengthens procurement cycles. In a bear market, procurement delays are existential.
The undisclosed details are as important as the announced ones. Where do gateway audit logs physically live? What retention windows apply? What encryption standards โ FIPS 140-3, AES-256, envelope encryption? Which compliance certifications does the gateway itself hold โ SOC 2 Type II, ISO 27001, GDPR adequacy? None of this has been published. For the institutional buyers Snowflake is pursuing, this is not a checkbox exercise. It is the difference between a product that is announceable and a product that is deployable.
The consensus narrative holds that gateway infrastructure is the missing security layer that makes enterprise AI agents safe. I reject that framing. The gateway is a new single point of failure. By centralizing identity, policy, and audit into one logical choke point, the industry is doing the opposite of defense in depth. It is concentrating risk into a more attractive target. โ Scenario: When a gateway is compromised, every downstream tool call inherits the attacker's intent. One exploit, one compromised session key, and the entire corpus of delegated permissions is exposed.
The DeFi composability collapses I analyzed in 2020 followed exactly this arc. Composability generates efficiency, then generates systemic fragility, then generates catastrophic liquidation cascades. The Aave v1 oracle manipulation vectors I modeled in 2020 share structural DNA with MCP server spoofing and prompt injection attacks. The names change. The probability distributions do not.
The second contrarian point: this M&A wave signals weakness, not strength. Incumbents acquiring startups at premium valuations suggests they failed to anticipate the MCP inflection. The Oasis price tag is a strategic tax paid for time. It does not prove agent identity is a proven revenue category. It proves buyers believe the window is closing.
The third, and arguably the deepest irony: the AI infrastructure industry is rediscovering problems blockchain tried to solve a decade ago. Identity, auditability, incentive alignment, trustless coordination โ these are the exact primitives that distributed ledger research formalized. Instead of adopting those primitives, enterprises are building centralized gateways to approximate them. Gateways are authorities, not proofs. They are trust, not verification. That may work for the next product cycle. It will not survive the next systemic stress.
The market is pricing MCP gateway infrastructure as the toll booth of the agent economy. Math doesn't lie, but it also doesn't predict. The numbers we actually have โ $1.2 billion in acquisitions, $1.33 billion quarterly revenue, seven identity partners, one botnet, one lawsuit โ describe a sector at maximum velocity and minimum maturity.
The real question is not which gateway wins the next twelve months. It is whether MCP's governance structure diversifies before the hyperscalers fork it and absorb the value. The players who understand this are not building gateways; they are building influence inside the protocol's governance channels. They are the ones to watch. Gateways defend the perimeter. They do not control the map. Three years from now, we will know which one mattered.