Companies increasingly need customer, partner, vendor, and auditor agents to access limited context without opening internal systems. An MCP capsule can serve as a context DMZ: a scoped boundary between your organization and outside agents. This talk shows how to create external-access capsules with content scoping that restricts visible URI schemes, deny prefixes that hide sensitive entries, connection identities that distinguish internal from external agents, artifact views that serve documents without raw file access, and activity logs that track what external agents read and write. We demonstrate a customer implementation scenario where internal agents get broad context, customer agents see only approved docs and runbooks, and partner agents access campaign assets — all from the same MCP registry with different grants.