MCP tool discovery is untrusted HTTP ingress, so put a gateway in front of it.

The defense-first MCP pattern from Christian Schneider treats every tool schema like a request from a stranger. A control point outside the client runs a five-stage validation pipeline. Stages 01 through 04 gate the discovery path, inspecting every schema before the model ever sees it, and stage 05 gates the invocation path, re-checking every call even after a clean discovery. This is the structural defense against tool-poisoning like CVE-2025-54136, where instructions hide inside tool descriptions. The non-obvious part is re-validating on each call, not just at registration. A server can return a clean schema and then behave differently when invoked. Never wire a third-party MCP server straight into Claude or Cursor.