Answers

MCP is a transport and discovery protocol with no built-in security model, so an MCP server is only as secure as the credentials, isolation, and logging around it. The four risks that matter in practice are prompt injection, over-scoped credentials, unvetted third-party servers, and missing audit records. All four are addressable, but not by the protocol.

An MCP gateway is a single control point that sits between your AI clients and every MCP server they call. It handles authentication, access control, and logging once, centrally, instead of once per tool and per client. You need one when more than one team or more than one AI client needs the same integrations.

An MCP tool is a single callable action, like creating an issue or sending a message. A Skill is a packaged procedure that tells an agent which tools to use, in what order, and under what constraints. Tools are the verbs; a Skill is the instruction that uses them. You need both, and they are not alternatives.

An API is a contract between two pieces of software, invoked by code someone wrote in advance. MCP is a protocol that lets a model discover the available tools at runtime and choose one, without anyone writing per-tool integration code. MCP does not replace APIs, it wraps them so a model can use them.

Agent observability splits in two. LLM-level tools such as LangSmith, Langfuse, Braintrust, and Arize Phoenix trace prompts, tokens, and model quality. Tool-level tools such as Metorial Tracing record what the agent actually did in external systems and under whose identity. Most teams debugging production agents need both, because a prompt trace cannot tell you which record got updated.

The MCP servers worth deploying first are the ones covering systems most of the company already touches: GitHub for engineering, Slack for context, Salesforce for revenue teams, Google Workspace for documents, Jira and Linear for tracking, Notion or Confluence for knowledge, and your data warehouse for analysis. What makes a server enterprise-ready is per-user authentication, scoped permissions, and a record of every call, not the length of its tool list.

Teams outgrow Zapier MCP over three things: actions run as one shared connection rather than as each user, the audit record is built for automation runs rather than agent sessions, and per-task pricing scales badly when an agent makes many calls per request. Metorial, Composio, Pipedream Connect, and self-hosting are the usual replacements, chosen by which of those three is binding.

Arcade.dev is specialized in agent authorization, so the alternatives split by what you need instead. Metorial for getting AI past engineering with self-hosting and Skills, Runlayer for externally audited inspection, Barndoor for cost, MintMCP for speed of rollout, Composio for breadth of connectors, and self-hosting when the scope is one or two integrations.

The strongest Composio alternatives are Metorial for open-source MCP infrastructure with self-hosting, Arcade.dev for agent authorization, Runlayer for externally audited security, Barndoor for cutting AI cost, MintMCP for the fastest setup, Pipedream Connect for low-code workflows, and self-hosting when you only need one or two integrations. Most teams leave Composio for self-hosting, per-user isolation, or observability.

Connect Salesforce to Claude through an MCP gateway rather than by pasting an API key into a local config. Set up the Salesforce integration, grant it to the right group, add the gateway endpoint to Claude, and start read-only. Each person then authenticates as themselves, so an agent can only reach the records that person could already reach, and every call is recorded with their identity.