How DoorDash Built a Toolbox for AI Agents

Language models lack native access to external systems such as code repositories, incident reports, and production logs, requiring software integrations referred to as tools. An AI agent is an application that leverages a language model to orchestrate multi-step tasks by selecting and executing these tools. Tool outputs are fed back to the model iteratively to guide subsequent reasoning and actions. Tools encompass both read operations and state-modifying write operations, enabling organizations like DoorDash to connect agents to internal systems, documentation, and third-party services.

The Model Context Protocol (MCP) standardizes capability discovery and invocation between AI agents and external tools, but it does not address higher-level enterprise governance. Companies like DoorDash must manage access control, credential handling, and operational monitoring across disparate agent workflows. To prevent redundant and fragmented integrations across engineering teams, DoorDash identifies three core requirements: access, tool-surface curation, and operations. The Agent Gateway consolidates these responsibilities into a unified platform to govern tool interactions reliably.

DoorDash's Agent Gateway architecture controls agent access by routing Model Context Protocol (MCP) requests to downstream MCP servers. The gateway relies on two core architectural components: a proxy within the data plane and a registry within the control plane. The proxy handles live traffic by verifying callers, enforcing permissions and rate limits, injecting credentials, and logging audit information. The registry acts as the source of truth, storing metadata, tool catalogs, policies, and connection settings managed by engineering teams. To maintain distinct trust boundaries, DoorDash segments internal and external-facing proxy planes while sharing unified governance concepts and libraries.

DoorDash's engineering team built an Agent Gateway that relies on authentication and authorization to control agent interactions. Authentication establishes caller identity, while authorization evaluates fine-grained context including the user, agent, requested tool, and environment. The system distinguishes between read-only and administrative capabilities rather than granting blanket server access. By propagating identity downstream and centralizing security policies, the gateway eliminates the need to encode authorization rules into prompts or individual tools.

In DoorDash's agent gateway architecture, caller identification is decoupled from the credentials required by downstream services. Rather than allowing agents to hold raw API keys or tokens, the gateway implements credential injection, attaching appropriate credentials before requests are forwarded. The architecture supports four credential models: Internal Service Identity, Gateway-held Token, Per-user OAuth, and Service Principal. This approach centralizes secret storage, credential rotation, auditing, and revocation outside of the AI agents.

Tools acting on behalf of a specific user require authorization, typically handled via OAuth access and refresh tokens. DoorDash's agent gateway centralizes user connection flows and encrypted token storage across product teams. When authorization is missing, the gateway initiates an OAuth flow, optionally utilizing MCP elicitation to pause requests while the user authorizes via a browser prompt. For clients lacking elicitation support, the gateway provides a structured response with a connection URL for recovery.

Presenting an agent with an entire server catalog introduces unnecessary choices and complex descriptions that degrade performance. To address this, DoorDash engineering exposes smaller, task-specific catalogs using bundles and filters. Bundles combine tools across multiple Model Context Protocol (MCP) servers into a single endpoint, while filters selectively expose approved capabilities based on agent or environment criteria. Gateways can also improve usability by standardizing descriptions and namespacing overlapping tool names.

Tool discovery and tool execution occur at distinct stages and necessitate independent validation and policy checks. During discovery, an agent issues a tools/list request to a gateway, which uses fan-out across downstream servers to assemble, filter, and return an aggregated catalog. At execution time, the agent issues a tools/call request, prompting the gateway to re-evaluate policy, enforce rate limits, inject credentials, and route to the correct server. This architecture relieves agents from having to manage downstream server routing or provider-specific credentials.

Observability enables teams to monitor and understand systems where multiple agents interact with various tools. Positioned in the path of all tool calls, the gateway captures structured events containing metadata such as identity, timing, errors, and payload sizes. It also aggregates metrics on request counts, latencies, authorization decisions, and downstream failures. This telemetry allows platform, security, and tool teams to audit access, diagnose issues, and analyze adoption.

DoorDash enables broad internal adoption of its centralized agent gateway by providing a self-service management interface and API. Teams register Model Context Protocol (MCP) servers, allowing the platform to discover capabilities via tools/list before teams configure approval, ownership, authentication, and access policies. Bundled tools are continuously monitored for latency, failure rates, authorization decisions, and costs. The gateway now acts as the default access route for DoorDash engineering, managing over 200 MCP servers and millions of weekly tool calls.

DoorDash is planning future improvements to its centralized AI agent-tool gateway architecture. Key planned areas include stronger agent identity and user delegation using cryptographic identities and short-lived scoped credentials. The company is also developing dynamic tool discovery based on tasks, access policies, and usage signals to offer context-relevant capabilities. Additional enhancements target tool quality and security evaluation, such as detecting sensitive data, simplifying server registration, and streaming redacted tool-call events.