MCPCommerce: Designing a Secure Multi-Tenant MCP Gateway for Natural Language E-Commerce Operations

API gateways were built for human-driven REST clients. They were not built for autonomous agents that chain tool calls across multiple service providers without human review of each step. MCPCommerce is a prototype-scale, multi-tenant e-commerce gateway built on Anthropic's Model Context Protocol (MCP) that tries to close that gap. It connects one natural language interface to eight independent e-commerce companies through twelve MCP tools, enforcing salted SHA-256 authentication, role-based access control, database-persistent rate limiting, and query-level tenant isolation on every call. The Global Customer Pattern lets a single API key reach all eight companies without relaxing data isolation boundaries. Load testing across 500 sequential and 100 concurrent requests shows 0.47 ms average latency and 2,973 requests per second at peak. All 32 SQL injection vectors tested were blocked. Twenty natural language tasks run end-to-end through Claude Desktop completed at an 88% full success rate. To our knowledge this is the first published implementation of a secure, multi-tenant MCP gateway.