Uber MCP Gateway: How 84% of Engineers Went Agentic at Scale

Uber built an internal MCP Gateway that now handles 60,000 agent task executions per week across 800+ servers and 5,000+ tools, after weekly AI coding agent use among its engineers jumped from 32% in February 2026 to 84% in March 2026. The gateway separates a control-plane MCP Registry, which catalogs servers, tools and ownership, from a data-plane Proxy Gateway that translates MCP calls into HTTP, gRPC or TChannel and enforces authorization, PII redaction and rate limiting before responses reach agents. A Cadence-powered AutoCrawler scans Uber's internal IDL registry for new Protobuf and Thrift services and schema changes, generates MCP schemas and agent-friendly tool descriptions, and registers each tool disabled until its owning team reviews and enables it.

By February 2026, 32% of Uber’s engineers were using AI coding agents weekly. By March — one month later — that number was 84%. That is not a gradual rollout. That is a phase transition, the kind where infrastructure either scales with the demand or breaks beneath it. Uber chose to build infrastructure. The result is an MCP Gateway that now handles 60,000 agent task executions per week across 800+ servers and 5,000+ tools. Here is how it works, and what every platform team needs to take from it. The Problem With Letting Every Team Figure It Out When AI agent adoption accelerates without a platform, you end up with the same mess every time: duplicated MCP server infrastructure, inconsistent authentication, no audit trail, tools leaking PII into agent responses, and API credentials scattered across agent contexts where any prompt injection can find them. Industry data puts only 11% of organizations experimenting with MCP actually in production https://baeseokjae.github.io/posts/mcp-ecosystem-2026/ — a governance gap 39 points wide. The other 89% are either stuck or accumulating security debt they have not measured yet. Uber faced this exact trajectory as agent adoption exploded. The fix was a centralized gateway — a single control surface for every tool call in the company. Dual-Plane Architecture: One Registry, One Proxy The gateway follows a clean dual-plane design that separates what agents can discover from what gets executed at runtime. The MCP Registry is the control plane. It maintains a catalog of servers, tools, ownership records, and enablement state. This is where tool authoring happens, where versions are managed, and where the enabled/disabled status of every tool lives. Nothing runs until the registry says it can. The Proxy Gateway is the data plane. It translates MCP protocol calls into HTTP, gRPC, or TChannel requests and converts responses back into MCP-compatible output — all without requiring any changes to the downstream services being exposed. Authorization enforcement, PII redaction, and rate limiting all happen here, at the proxy layer, before any tool response reaches an agent. The practical outcome: a team can expose an existing internal API as an MCP tool without touching their service code. The gateway handles protocol translation. The registry handles governance. AutoCrawler: Tools Start Off, Owners Turn Them On Uber’s AutoCrawler is what makes the catalog manageable at scale. It is a Cadence-powered workflow that runs on a schedule, scanning Uber’s internal IDL registry for new services, Protobuf and Thrift definitions, and schema changes. For each discovery, it generates an MCP schema and runs a language model over code comments to produce agent-friendly tool descriptions. Then it registers the tool — disabled. Every tool starts disabled. The owning team must explicitly review and enable it before any agent can call it. This is the governance principle that scales: opt-in, not opt-out. Auto-discovery handles catalog growth; mandatory owner sign-off handles security. The two together prevent the sprawl that breaks most enterprise MCP deployments. Security at the Proxy Layer, Not Bolted On Later Three security decisions in Uber’s design are worth copying directly. First, authorization is enforced at both the server level and the tool level. The gateway relays the caller’s user token downstream rather than using a shared service identity. Every call carries the invoking engineer’s identity — which means the audit log actually means something. Second, PII redaction runs on every tool response before it hits the agent. It is not opt-in. It is infrastructure. For context: a 2026 security analysis https://stacklok.com/blog/mcp-security-best-practices-what-every-enterprise-team-needs-to-know-in-2026/ found only 8.5% of community MCP servers implement the required OAuth 2.1 standard. Uber baked the defense into the layer every call passes through. Third — credentials live in the gateway and are injected server-side. They do not appear in the agent’s context. An agent that cannot see a credential cannot leak it. The Numbers, With One Honest Caveat The scale is real: 800+ MCP servers, 5,000+ tools, 60,000 agent task executions per week. Agents open 11% of Uber’s pull requests. An internal background agent submits 1,800 code changes per week. According to InfoQ’s analysis https://www.infoq.com/news/2026/11/uber-mcp-gateway-ai-agents/ , this represents one of the largest documented MCP deployments at any company. The honest caveat: Uber burned through its entire 2026 AI budget by mid-April — primarily on Claude Code usage. The MCP Gateway solved the governance problem. It did not solve the cost problem. These are different problems. Building the governance layer is the right call regardless; it is the foundation everything else runs on. But if you are pitching this to finance, the ROI conversation is still live. What Platform Teams Take Away Three principles from Uber’s design that apply whether you have 10 MCP servers or 800: - Gateway-first: Centralize all MCP access through one proxy. Agents never call tools directly. This is the only architecture that gives you audit logs, rate limiting, and consistent security without asking every team to implement them separately. - Disabled-by-default: Auto-discover tools but require owner sign-off before exposure. The catalog will grow faster than your security review capacity. The only way to stay ahead of it is to make discovery automatic and enablement manual. - Credential isolation: Keys live in the gateway layer, injected at execution time. They do not belong in agent context. If an agent can read a credential, it can leak it. Uber’s full architecture writeup is on their engineering blog https://www.uber.com/us/en/blog/designing-mcp-gateway/ . The pattern is documented, the design decisions are explained, and the tradeoffs are honest. The only question left is whether your organization builds this governance layer now or waits until the debt comes due.