Model Context Protocol (MCP) - the open standard that lets AI assistants like Claude and ChatGPT connect directly to tools like Slack, Google Workspace, and Salesforce - has a growing adoption problem. Not with developers. With enterprises.
The protocol itself works fine for individual users. You connect Claude to your Google Drive, it reads your files, everyone's happy. But try deploying that same pattern across 30,000 employees and three things break almost immediately.
The Admin Credentials Trap
An enterprise MCP gateway needs administrative credentials to broker connections on behalf of thousands of users. That means the AI system technically has access to every Teams message, every Salesforce record, every Slack channel in the organization. The protocol has no built-in concept of "User A can see these channels but not those channels." You're left building a permission layer from scratch on top of MCP, which defeats the purpose of having a standard in the first place.
Natural Language Meets Structured APIs
When someone asks an AI assistant to "summarize the marketing channel from yesterday," that request needs to be translated into a structured API call with a specific channel ID, date range, and message type. MCP tools expect precise inputs. Users speak in vague, contextual language. Bridging that gap requires dynamic schema generation per user - knowing which channels they belong to, which projects they work on, which CRM records they can access. None of that mapping exists in the MCP spec.
Token Refresh Is the Boring Problem That Kills You
OAuth tokens expire. When you have thousands of concurrent users hitting dozens of enterprise tools, the gateway becomes a full-time token management system - refreshing credentials, retrying failed requests, translating error responses back into something the AI can work with. It's middleware complexity that MCP was supposed to eliminate.
The pattern emerging from teams actually building this infrastructure is something like an "agent routing layer" - a middleware tier that sits between the AI model and the MCP endpoints, handling per-user permissions, request translation, and credential management. Think of it as the enterprise governance layer that MCP deliberately left out of scope.
This gap matters right now because every major enterprise software vendor is shipping MCP endpoints. Slack has one. Google has one. Microsoft and Salesforce are building them. The connector problem is getting solved fast. But the "how do I safely let my entire company use these connectors" problem is wide open, and it's where the actual engineering challenge lives for any organization beyond a few dozen users.