Securing Stateful MCP Services: A Multi-Layer Defense Strategy for Cloud Run

As organizations deploy workflow automation tools (n8n) with browser automation capabilities (Playwright MCP) to handle sensitive operations like Google-authenticated workflows, stateful service security becomes critical. This article presents a practical, defense-in-depth architecture that combines internal ingress, IAM-based access control, service-to-service authentication via ID tokens, and per-team isolation. The pattern addresses a fundamental gap in stateful microservice deployment: enabling secure multi-tenant access while maintaining session persistence on Cloud Run.