Spotify’s Journey to an Open, Secure MCP Gateway

Spotify engineers explain how the company adopted MCP, built an internal gateway, and later moved toward standardized, open-source components. Using Spotify’s experience, they discuss how to make MCP services easier to discover and use while managing authentication and access securely.

- MCP adoption at Spotify: the initial need, gRPC integration, and service discovery
- Gateway evolution: moving from custom code to Envoy and open-source building blocks
- Security: delegated tokens, least-privilege access, account linking, and autonomous agents
- Standards and next steps: enterprise authentication management and designing for change

The discussion focuses on architectural decisions and lessons rather than detailed implementation instructions. It is aimed at platform, infrastructure, and security teams planning MCP deployments; viewers can take away practical considerations for using existing standards, keeping interfaces narrow, and identifying custom components to replace as mature alternatives become available.