Agent gateway comparison
Last updated: October 23, 2026.
Autonomous agents call tools, call models and, increasingly, call other agents, often with no person watching each step. An agent gateway governs that traffic with the agent as the subject: each agent authenticates as itself, reaches only the tools its job needs, and leaves an audit trail separate from the people who created it. The products here come from different starting points. agentgateway, Bifrost and IBM ContextForge are open-source proxies, Kong and Azure API Management extend API gateways, AgentCore Gateway and Google Cloud Agent Gateway are managed cloud services, and TrueFoundry, Portkey and Runlayer add agent gateways to AI platforms. Mintive's agent gateway gives each agent its own identity and Virtual MCP on the MCP gateway, monitors coding agents with Agent Monitor, and runs hosted Coworker Agents through the same policies.
How we compared these agent gateways
The facts come from each vendor's public documentation, pricing pages and repositories, checked on October 23, 2026. A cell says "not documented" when we couldn't find the fact on the vendor's own pages, which doesn't mean the capability is missing. There is no ranking column: each row ends with when it fits best.
Agent gateway traffic, identity and tool scoping
| Gateway | Type | Traffic governed | Agent identity | Per-agent tool scoping | Acting for a human user |
|---|---|---|---|---|---|
| Mintive | Agent gateway beside the MCP and LLM gateways | MCP tool calls under the agent identity; model calls through the LLM gateway (early access) with a separate gateway API key | A named, org-scoped principal; API keys, M2M tokens or workload identity federation (on request) | Its own Virtual MCP with curated tools; rules and middleware (Enterprise) apply | Per connector: the agent's own credential, a shared credential, or, for Coworker Agent runs started by a person, that person's credential and access; identity forwarding to MCP servers |
| agentgateway | Open-source proxy for LLM, MCP and A2A traffic | MCP, LLM and A2A | Callers authenticate with JWT, API keys or OAuth; no separate agent principal documented | CEL rules per tool on token claims; disallowed tools hidden | Token exchange (RFC 8693), JWT bearer, Cross App Access |
| Solo Enterprise for agentgateway | Commercial distribution of agentgateway | MCP, LLM and A2A | A verifiable identity per call through STS tokens | Tool-level RBAC; OAuth scope restriction | On-behalf-of identity, claim propagation, Cross App Access |
| Kong AI Gateway | API gateway with AI plugins | MCP, LLM and A2A | Kong consumers and consumer groups; OAuth claims mapped to consumers | Per-tool allow and deny lists by consumer or group | Token exchange; claims forwarded upstream as headers |
| Amazon Bedrock AgentCore Gateway | Managed AWS gateway for tools, agents and models | MCP targets, LLM inference targets, A2A through HTTP passthrough | Workload identities in AgentCore Identity; JWT or IAM inbound | Tool, operation and parameter level through interceptors or Cedar | On-behalf-of token exchange, three-legged OAuth, JWT passthrough |
| Google Cloud Agent Gateway | Managed governance gateway in Gemini Enterprise Agent Platform | MCP, A2A, REST and gRPC; LLM token policies announced | A SPIFFE ID per agent; mTLS and DPoP | IAM policies tie agents to registry tools, deny by default | Auth manager handles OAuth for end users |
| Azure API Management | AI gateway features in API Management | LLM APIs, MCP servers, A2A agent APIs | Subscription keys or Entra ID tokens; no agent principal documented | Policies apply to all tools on a server | Headers forwarded to tools; credential manager injects backend tokens |
| TrueFoundry | AI gateway with LLM, MCP and agent gateways | LLM, MCP and A2A or HTTP agents | Agent identity as its own principal type (beta) | Per-server grants; per-agent tool scoping announced | User and agent identity together; on-behalf-of for MCP |
| Portkey | AI gateway with LLM, MCP and agent gateways | LLM, MCP and A2A agents | API keys, OAuth 2.1 or IdP tokens; no separate agent principal | Workspace and server level; per-tool authorization announced | Identity forwarding through claims headers, token passthrough or signed JWTs |
| Runlayer | AI control plane with MCP and LLM gateways | MCP and LLM | Agent accounts as their own principal; client credentials or M2M tokens | Access rules name agent accounts per server and tool | On-behalf-of tokens (RFC 8693) with user-revocable delegations |
| Bifrost | Open-source AI gateway with LLM, MCP and agent gateways | LLM, MCP and A2A | Virtual keys per user or app; no separate agent principal | Tool filters per client, request and virtual key; virtual MCPs | Per-user OAuth and headers; token exchange (RFC 8693) |
| IBM ContextForge | Open-source MCP gateway and registry with A2A federation | MCP; A2A agents exposed as MCP tools; LLM proxy | Users, teams, JWT and API tokens; team-scoped service tokens | Virtual servers with chosen tools; OPA per tool | Identity headers forwarded; optional token exchange |
Agent gateway monitoring, guardrails and audit
| Gateway | Agent activity monitoring | Guardrails and policy | Audit and SIEM export |
|---|---|---|---|
| Mintive | Every tool call attributed to the agent; Agent Monitor hooks capture coding-agent actions | Mint Guard (enabled on request) screens MCP tool calls, with per-connector overrides; rules and middleware (Enterprise) block or mask, with PII and DLP templates | Real-time OTLP or Splunk HEC, or batched files to S3; gateway events carry agent.id |
| agentgateway | MCP metrics per server, method and tool; arguments and results can be logged | Regex, moderation and cloud guardrail integrations; webhooks | Access logs over OTLP |
| Solo Enterprise for agentgateway | Traces across model and tool calls; traffic inspection; cost dashboards | Open-source guardrails plus DLP, WAF and OPA | Audit trail per tool call; traces to existing backends |
| Kong AI Gateway | LLM tokens and cost; MCP tool and consumer; A2A task state | Prompt guard, semantic guards, sanitizer, cloud guardrails | AI audit log; Konnect audit webhook |
| Amazon Bedrock AgentCore Gateway | CloudWatch metrics, logs and OpenTelemetry spans per tool call | Cedar policies plus Bedrock Guardrails | CloudTrail data events; logs to CloudWatch, S3 or Firehose |
| Google Cloud Agent Gateway | Network-layer telemetry to Agent Observability | Model Armor, semantic governance policies, custom authorization | OpenTelemetry traces and access logs in Cloud Logging |
| Azure API Management | Prompts, completions and token metrics per consumer; MCP and A2A traces | Content safety on LLM, MCP and A2A; token and rate limits | Azure Monitor and Application Insights |
| TrueFoundry | Traces that name the agent and the user, with payloads | Guardrails on LLM input and output and before and after MCP tool calls | Audit logs; OpenTelemetry export |
| Portkey | MCP logs with tool, parameters, response and user; agent requests logged | One guardrail engine for LLM and MCP traffic | Audit logs on Enterprise; OpenTelemetry export |
| Runlayer | Sessions with prompts, tool calls, responses and scanner results | ToolGuard, AgentGuard, PII and credential scanners | Audit logs; continuous S3 export for SIEM |
| Bifrost | Agent logs linking sessions, A2A tasks and LLM and MCP calls | Guardrails on LLM and MCP on Enterprise; budgets per virtual key | Signed audit logs on Enterprise; OpenTelemetry |
| IBM ContextForge | OpenTelemetry traces; A2A execution metrics | Plugins: PII filter, OPA, Cedar, LlamaGuard | Structured security events to log platforms |
Agent gateway deployment, licensing and pricing
| Gateway | Runs agents itself | Deployment | License | Pricing | Best fit when |
|---|---|---|---|---|---|
| Mintive | Yes: Coworker Agents (beta), sandboxed runs from your GitHub repository | Managed cloud service in the US or EU; Private Networks reach internal services (Enterprise); on-premise or self-hosted by arrangement | Paid plans | Plans on mintive.com/pricing; Mint Guard and ZDR on Enterprise | Agents call MCP tools and need their own identity, scoped tools and audit trail |
| agentgateway | No; proxy only | Standalone binary or Kubernetes with Gateway API | Apache 2.0 | Free open source | You want a self-run, vendor-neutral gateway for MCP, LLM and A2A |
| Solo Enterprise for agentgateway | No; Solo's agent runtime is separate | Kubernetes or OpenShift, air-gapped, or standalone | Commercial | Custom quote | You run agentgateway and want support and enterprise delegation |
| Kong AI Gateway | Not documented | Konnect SaaS or self-hosted data planes | Core Apache 2.0; MCP and A2A features on paid tiers | Plus from $25/month plus usage; Enterprise custom | You already run Kong and want one gateway for LLM, MCP and A2A |
| Amazon Bedrock AgentCore Gateway | Yes: AgentCore Runtime hosts agents | Managed AWS, serverless | Commercial AWS service | Consumption pricing per invocation | Your agents run on AWS and you want IAM, Cedar and CloudTrail |
| Google Cloud Agent Gateway | No; pairs with Agent Runtime | Google-managed for Agent Runtime | Commercial Google Cloud service | Consumption pricing | Your agents run on Gemini Enterprise Agent Platform |
| Azure API Management | No; agents register from anywhere | Managed Azure tiers; self-hosted gateway | Commercial Azure service | Tier-based | You're Azure-centric and already use API Management |
| TrueFoundry | Yes: a hosted agent harness | SaaS, hybrid or fully self-hosted | Commercial | Free; Pro $25 per user/month; agent gateway custom | You want models, MCP and agents on one self-hostable platform |
| Portkey | No; proxies your own agents | SaaS, hybrid or self-hosted | Gateway repository MIT; platform paid | Free; Production $49/month; Enterprise custom | You're on Portkey for LLM traffic and want MCP and A2A there too |
| Runlayer | Yes: hosted agents with tools, schedules and webhooks | Runlayer-hosted single tenant, or self-hosted on AWS or Kubernetes | Commercial | Not published | You want agent accounts, MCP and LLM governance and hosted agents together |
| Bifrost | No; proxies existing agents | Self-hosted; Enterprise in VPC, on-premise or air-gapped | Apache 2.0 | Open source free; Enterprise custom | You want open-source LLM, MCP and A2A routing with key budgets |
| IBM ContextForge | No; registers external agents | Self-hosted: Docker, PyPI, Helm, OpenShift | Apache 2.0 | Free open source | You want an extensible open-source MCP and A2A registry |
Portkey's site states that it is now part of Palo Alto Networks as "Prisma AIRS AI Gateway".
How to choose an agent gateway
Agent gateway for agents that call company tools
When an agent reaches Salesforce, GitHub or a data warehouse, the questions are the same ones you ask about a person: who is it, what can it touch, and who answers for what it did. Look for a real agent principal (not a shared API key), a toolset scoped to the agent's job, and an audit trail that names the agent. In Mintive, one agent identity gets one Virtual MCP with only the tools it needs, so rotating or deleting its credential affects that agent and nothing else, and every call carries agent.id in the SIEM export.
Agent gateway vs MCP gateway
An MCP gateway governs tool calls for whoever connects, usually people in AI clients. An agent gateway adds the agent as its own subject, so policies and audit attach to the agent rather than to the human who started it. Many teams need both, and in Mintive they share one policy model: agent identities sit on the same MCP gateway as your users, with the same rules and middleware. See the MCP gateway comparison.
Open source and self-hosted agent gateways
agentgateway, Bifrost and IBM ContextForge are Apache 2.0 and run in your own infrastructure, and Solo.io sells an enterprise distribution of agentgateway. You operate upgrades, identity integration and connectors yourself. Mintive runs as a managed cloud service in the US or EU, reaches internal services through Private Networks (Enterprise), and offers on-premise or self-hosted deployment by arrangement (contact Mintive).
Agent gateways from cloud and API platforms
AgentCore Gateway, Google Cloud Agent Gateway and Azure API Management fit best when your agents, tools and logs already live on that cloud. Kong fits teams that already run it for APIs. Check how each documents an identity for the agent itself and per-tool access, since some apply policy per consumer or per server rather than per agent and tool.
Agent gateway FAQ
What is an agent gateway?
An agent gateway sits between autonomous AI agents and what they call: MCP tools, model providers and, in some products, other agents over A2A. It authenticates each agent, applies policy and guardrails, and logs every call under the agent's identity.
What is the difference between an agent gateway and an MCP gateway?
An MCP gateway governs tool calls over the Model Context Protocol. An agent gateway treats the agent as the subject, so identity, tool scoping and audit attach to the agent, and it often covers model and agent-to-agent traffic too. In Mintive, each agent identity gets its own Virtual MCP on the MCP gateway, and the LLM gateway covers model calls.
Is an API gateway enough for AI agents?
Kong and Azure API Management extend API gateways with MCP, LLM and A2A support, so an API gateway can proxy agent traffic and apply OAuth and rate limits. Check how each documents per-tool access, an identity for the agent itself, and an audit trail that names the agent and any user it acts for.
What is A2A?
A2A (agent-to-agent) is a protocol for one agent to delegate tasks to another. agentgateway, Kong, AgentCore Gateway, Google Cloud Agent Gateway, Azure API Management, TrueFoundry, Portkey, Bifrost and IBM ContextForge document A2A traffic.
Is there an open source agent gateway?
Yes. agentgateway, Bifrost and IBM ContextForge are Apache 2.0 licensed and document MCP and A2A traffic, and Solo.io sells an enterprise distribution of agentgateway. You run and operate these yourself.
Do I need an agent gateway?
Not if agents only run on a developer's machine with personal credentials. Once agents run unattended, such as CI jobs, Slack bots or scheduled workers, a borrowed human key mixes the agent's actions into that person's audit trail and gives the agent everything the person can reach. A gateway gives each agent its own credential, a narrow toolset and its own audit trail.
Related
- Agent identities: give an agent its own credential, tools and audit trail
- MCP gateway comparison: 13 MCP gateways side by side
- AI coworker agent comparison
- Agent gateway vs API gateway on the blog
Sources
Every competitor fact on this page comes from that vendor's own public documentation, pricing pages or repository, checked on October 23, 2026.