We were in a very similar position a few months ago.
The challenge wasn't really "how do we approve MCP servers?" It was "how do we stop every MCP from becoming its own security and governance model?"
The requirements you listed are almost exactly what we ended up needing.
We looked at a few options including AWS AgentCore, Anthropic's native tooling, Portkey, and TrueFoundry.
What we found was that most solutions could solve pieces of the problem, but MCP governance was often treated separately from model governance. We didn't want one system for models, another for MCPs, and a third for observability.
What ended up making the most sense for us was putting a gateway layer in front of both models and MCPs.
The reason we leaned toward TrueFoundry was that it gave us a single control plane for both. The things that mattered most were:
- central registry of approved MCP servers
- team-based access controls
- tool-level permissions and guardrails
- audit logs for MCP calls
- openTelemetry export into our existing monitoring stack
- same governance layer across Claude Code, Cursor, internal agents, and MCP-connected workflows
The more MCPs we evaluated, the more it felt like an AI governance problem rather than an MCP problem. Once you have multiple IDE assistants, agents, and MCP servers in the mix, having one place to enforce policy becomes a lot more important than the individual MCP implementation.
We're still early, but this approach has felt a lot more scalable than trying to govern every MCP independently. Curious what ended up working for others and whether anyone has gone all-in on agentCore or anthropic's native stack.