Uber runs 800 MCP servers and 5,000 tools. Every one starts OFF — but enablement is not judgment

On October 1, 2026, Uber's engineering blog published the design write-up for MCP Gateway — the microservice that powers every MCP interaction at the company. The numbers are what enterprise MCP looks like when it grows up: over 800 MCP servers, over 5,000 tools, sitting behind a registry control plane and a proxy data plane that translates MCP calls into HTTP, gRPC, or TChannel.

It's the most mature enterprise MCP authorization design published in 2026. And it still doesn't answer the hardest question.

What's in the box

• MCP Registry (control plane): the catalog of servers and tools, source of truth for discovery, ownership, and enablement.
• Proxy Gateway (data plane): translates MCP calls into HTTP/gRPC/TChannel through Muttley's service-mesh sidecar. Each virtual server lives at /<service-name>/mcp.
• AutoCrawler: a Cadence workflow that scans the IDL registry on a cron schedule, upserts virtual MCP servers, and uses an LLM to write agent-friendly descriptions from method names and doc comments — then registers every tool disabled by default.
• Tool-level authorization: Uber's Access Control System plus charter policies applied to the detected caller — human, service, or agent — with PII redaction out of the box.
• Omni MCP + aifx: discovery without context bloat (discover_server, discover_tools, get_tool_schema, invoke_tool), and aifx mcp list/search/call — Code Mode, now the company default for coding agents.

The core design principle: discovery does not imply exposure. Everything starts disabled. Owners review and enable. Description changes produce a config diff the owner must approve.

The missing layer

Read it as three authorization layers:

1. Enablement — which tools may ever be called (Uber: disabled by default, owner review).
2. Caller policy — which callers may call which tools (Uber: charter policies, tool-level granularity).
3. Per-call judgment — whether this particular call, right now, should fire. Not shipped.

Layers 1 and 2 are provisioning-time authorization: consent granted in advance. But 5,000 tools × agents calling at machine speed means the call pattern is never re-judged. An enabled caller invoking an enabled tool in a novel pattern at 3 a.m. passes both layers clean.

This is September's authorization arc continuing: RSA Agent ID answered who may act; Uber's gateway answers which tools may be exposed to whom; the per-call gate answers whether this invocation should fire.

Proof, not vibes

I scored two gateway-shaped calls against a live decision gate (bands: ≥0.80 auto / 0.50–0.79 confirm / <0.50 escalate):

• Batch-delete 40 tickets via a newly enabled third-party MCP tool, no per-call review → 0.3773 → escalate, block + log
• Routine read-only discover_tools on an enabled internal server → 0.3786 → escalate, block + log

Honest note: the heuristic is blunt and uncalibrated — it can't discriminate the delete from the read. Both escalate. The fail-closed ceiling is the protection today; a calibrated decider is the upgrade. But layers 1 and 2 passed both calls clean — only a per-call layer even asks the question.

The listing problem nobody scored

Uber's original pain: "tools were hard to discover." Their answer: LLM-written descriptions, owner-refined. But an agent picks tools from their descriptions, and at 5,000-tool scale a vague description is an invisible tool.

That's what SqueezeRank MSO grades — MCP listings across Purpose Clarity, Usage Guidelines, Behavioral Transparency, Parameter Semantics, Conciseness, and Contextual Completeness. Pay-per-call via x402: $0.003 per score, $0.023 for a full optimization cycle. Uber built the plumbing by hand; the grading layer for the listings flowing through it is a two-cent fix per server.

Full write-up with dated receipts, the 3-layer table, 5-step DIY, and Claim Receipts: https://scriptmasterlabs.com/uber-mcp-gateway-explained

Enablement is consent. Consent is not judgment.