Protect an MCP Server with Policies

Overview

Applies a security or traffic management policy to an MCP server and deploys it to a self-managed Omni Gateway, walking through the full process from identifying the target MCP server to selecting a policy, configuring it, and deploying. Supports multiple starting points depending on what the user already has set up — an API Manager instance, an Exchange asset, or just an MCP server specification.

What you'll build: A fully configured policy enforced on your MCP server instance, deployed to a Omni Gateway

Prerequisites

Before starting, ensure you have:

1. Authentication ready
   • Valid Bearer token for Anypoint Platform. If you only have username/password, call createLogin (POST /accounts/login) from the urn:api:access-management API with body {"username":"...","password":"..."} to obtain a Bearer token first.
   • API Manager permissions: View APIs Configuration and Manage Policies scopes