MCP gateway comparison
Last updated: October 19, 2026.
MCP gateways sit between AI clients and the MCP servers they call, and the options differ mostly in where they come from. Dedicated MCP gateways (Mintive, Obot, Runlayer, IBM ContextForge, Microsoft MCP Gateway, Docker MCP Gateway) start from tool-call governance. Kong adds MCP to an API gateway, TrueFoundry, Portkey and LiteLLM add it next to LLM routing, Composio pairs it with a hosted tool catalog, Speakeasy builds and hosts MCP servers from your APIs inside an AI control plane, and Amazon Bedrock AgentCore Gateway offers it as a managed AWS service.
How we compared
The facts come from each vendor's public documentation and pricing pages, and for open-source projects the repository license, checked on October 19, 2026. A cell says "not documented" when we couldn't find the fact on the vendor's own pages, which doesn't mean the capability is missing. There is no ranking column: the right gateway depends on what you already run, so each row ends with when it fits best.
Deployment, license and pricing
| Gateway | Type | Deployment | License | Pricing model | Best fit when |
|---|---|---|---|---|---|
| Mintive | Dedicated MCP gateway, plus LLM gateway and Agent Monitor | Managed cloud service in the US or EU; Private Networks reach internal services (Enterprise); on-premise or self-hosted by arrangement | Paid plans | Plans on mintive.com/pricing; Mint Guard and ZDR on the Enterprise plan | You want one managed service that governs agent tool calls, model calls and coding-agent activity under the same identities and roles |
| Kong AI Gateway | API gateway with LLM, MCP and A2A support | Konnect-managed control plane with cloud, serverless or hybrid gateways; fully self-hosted via Enterprise | Kong Gateway is Apache 2.0; MCP plugins are Enterprise tier | Public tiers from $25/month plus usage; Enterprise custom | You already run Kong for APIs and want MCP and LLM traffic on the same platform |
| Obot | AI control plane with MCP gateway, catalog and LLM gateway | Self-hosted (Docker, Kubernetes) or Obot Cloud | MIT; Enterprise unlocked by license key | Community free (up to 100 users); Cloud and Enterprise by contact | You want an open-source gateway and catalog you can run yourself |
| TrueFoundry | AI gateway (LLM, MCP and agent gateway) on an AI deployment platform | SaaS, customer-hosted gateway plane, or fully self-hosted | Proprietary | Free (3 users); Pro $25 per user/month; Enterprise custom | You want LLM and MCP gateways on a platform that also deploys models and agents in your cloud |
| Portkey | LLM gateway with a separate MCP gateway | SaaS, hybrid, private cloud or self-hosted | Gateway repo is MIT; enterprise features paid | Free; Production $49/month; Enterprise custom | You want MCP governance on the same control plane as a multi-provider LLM gateway |
| LiteLLM | LLM gateway (proxy) with MCP gateway | Self-hosted | MIT except the enterprise/ directory | Open source $0; Enterprise annual, contact sales | You run the LiteLLM proxy for model traffic and want MCP access controls in it |
| Docker MCP Gateway | Open-source gateway that runs MCP servers as containers | Local or self-hosted (Docker Desktop, Engine, Compose) | MIT | Free | Developers want containerized MCP servers from a signed catalog on their own machines |
| IBM ContextForge | MCP gateway and registry that also federates A2A agents and REST/gRPC APIs | Self-hosted (PyPI, Docker, Kubernetes, OpenShift, major clouds) | Apache 2.0 | Free open source | You want an Apache-licensed gateway and registry with a plugin framework you extend yourself |
| Runlayer | AI control plane with MCP gateway, runtime security and catalog | Runlayer-hosted single tenant, or self-hosted on AWS or Kubernetes | Commercial | Contact sales | You want an MCP gateway with ML-based runtime threat detection |
| Composio | Tool integration platform with a managed MCP gateway | Composio Cloud; private VPC or self-hosted on Enterprise | SDK is MIT; platform commercial | Hobby $0; Pro $29/month plus usage; Enterprise custom | You want a large hosted catalog of app integrations with managed per-user auth |
| Speakeasy | AI control plane with MCP gateway, MCP server builder and hosting | Managed SaaS; its site also states a self-hosted or own-VPC option | Platform repository is AGPL-3.0 | Enterprise plan, contact sales | You want to generate and host MCP servers from your own OpenAPI documents or TypeScript functions, with a gateway and guardrails around them |
| Amazon Bedrock AgentCore Gateway | Managed AWS gateway for tools, agents and models | Managed AWS service | Commercial AWS service | Public consumption pricing (per 1,000 invocations) | Your agents run on AWS and you want IAM, CloudTrail and Bedrock Guardrails in one place |
| Microsoft MCP Gateway | Open-source MCP gateway and control plane for Kubernetes | Self-hosted (Kubernetes, or your own AKS) | MIT | Free; you pay for your own infrastructure | You run Kubernetes on Azure and want Entra ID roles on MCP servers and tools |
Microsoft also documents MCP support in Azure API Management, a separate managed service with its own pricing. Portkey's site states that it is now part of Palo Alto Networks as "Prisma AIRS AI Gateway".
Identity and access control
| Gateway | Client authentication | SSO and SCIM | Per-user credentials to downstream tools | Access is granted to |
|---|---|---|---|---|
| Mintive | OAuth 2.0 with PKCE and dynamic client registration on every Virtual MCP; API keys, M2M tokens or workload identity federation (on request) for agent identities | SSO (Okta, Google Workspace, Microsoft Entra ID, OneLogin, JumpCloud, Auth0, PingFederate, other SAML/OIDC) and SCIM | Yes: per-user OAuth with automatic refresh, shared service credentials, or cross app access; user identity forwarding to MCP servers | A Virtual MCP per role with curated tools, granted to users, directory groups and agent identities; per-tool enable, disable and approval |
| Kong AI Gateway | OAuth 2.1 resource server for MCP; key auth or OpenID Connect | SSO via OIDC/SAML; SCIM listed on the pricing page | Token exchange before the upstream MCP server | Individual tools, by consumer or consumer group |
| Obot | OAuth for MCP clients | Entra, Okta, JumpCloud, Auth0, GitHub, Google; SCIM not documented | Yes: OAuth exchange and refresh per user | MCP servers, and virtual MCP profiles with selected tools, by user or group |
| TrueFoundry | Personal and service tokens, external IdP tokens, OAuth for IDE clients | SAML/OIDC SSO and SCIM | Yes: per-user OAuth token storage and refresh, on-behalf-of exchange | MCP servers and tools, by user, team or virtual account |
| Portkey | OAuth 2.1 with PKCE, API keys, external IdP tokens | OIDC/SAML SSO and SCIM | Yes: per-user OAuth tokens with refresh | MCP servers and tools, by org, workspace, team or user |
| LiteLLM | Virtual keys; OAuth 2.0 proxying for MCP clients | SSO and SCIM on Enterprise | Yes: per-user OAuth, per-user keys, on-behalf-of exchange | MCP servers and tools, by key, team or organization |
| Docker MCP Gateway | Bearer token on HTTP transports | Not documented | OAuth flows for upstream services, stored per local user | Profiles and per-tool allowlists |
| IBM ContextForge | JWT bearer tokens | SSO via OAuth2/OIDC (Entra ID, Okta, Keycloak, others); SCIM not documented | Yes: OAuth authorization code and user-scoped tokens | Teams and roles on gateways, servers, virtual servers and tools |
| Runlayer | OAuth through Runlayer's authorization server | Okta, Entra and other IdPs; SCIM | Yes: each user authorizes connectors; OAuth broker | Servers, tools or resources, by user, group, role, agent or attribute |
| Composio | Browser sign-in for MCP clients | SAML/OIDC SSO and SCIM 2.0 on Enterprise | Yes: managed per-user OAuth with storage and refresh | Organization, team, user, agent or toolkit policies |
| Speakeasy | OAuth 2.1 with PKCE and dynamic client registration | SAML 2.0 or OIDC SSO and SCIM, by plan | Yes: per-user OAuth tokens stored encrypted and refreshed | Servers, toolsets or tools, by person, role or agent |
| Amazon Bedrock AgentCore Gateway | JWT from any OIDC provider, or IAM | Via your OIDC provider; SCIM not documented | Yes: AgentCore Identity token vault per agent and user | IAM principals; tool and parameter level through interceptors and Cedar policies |
| Microsoft MCP Gateway | Entra ID bearer tokens | Entra ID; SCIM not documented | Not documented | Adapters and tools, by Entra ID app role |
Audit, guardrails and model traffic
| Gateway | Audit log and export | Prompt injection and sensitive data screening | LLM routing and budgets | Hosted connectors and registry | Compliance stated by the vendor |
|---|---|---|---|---|---|
| Mintive | Tool calls, prompts and access changes exported in real time over OTLP or Splunk HEC, or as batched files to S3; usage through the Admin API | Mint Guard (enabled on request), Mintive's managed guardrail, screens tool arguments and results out of the box for prompt injection, credentials and secrets, PII and harmful content; plus rules and middleware that block or mask, with PII and DLP templates | LLM gateway (early access): OpenAI, Anthropic, Fireworks and Amazon Bedrock; budgets by group and per user, allowed models by group | Yes: pre-vetted catalog, hosted connectors from container images, the hosted CLI or private npm packages, and a custom registry; tool change alerts | SOC 2 Type II and HIPAA, with a BAA available (details) |
| Kong AI Gateway | MCP logs and OpenTelemetry; Konnect audit webhook to a SIEM | Prompt guards and PII sanitizer on LLM traffic; MCP inspection through partner plugins | Yes: multi-provider routing, token quotas | Generates MCP servers from REST APIs; MCP Registry in tech preview | Not documented on the pages checked |
| Obot | MCP and LLM audit logs exported to S3, Google Cloud Storage or Azure Blob | MCP filters (webhook or MCP server) that can block or modify calls | Yes: LLM gateway with model access policies | Yes: hosts MCP servers; catalog and registry API | SOC 2 Type II in progress |
| TrueFoundry | Audit logs and OpenTelemetry export | Guardrails on LLM requests and MCP tool calls, before and after | Yes: budgets and rate limits | Yes: prebuilt and hosted MCP servers, OpenAPI to MCP | SOC 2 Type II, GDPR, HIPAA |
| Portkey | Every tool call logged; OpenTelemetry export | MCP guardrails on tool inputs and outputs; PII redaction on LLM traffic | Yes: budgets and rate limits | Registry and registry API (beta) | SOC 2, ISO 27001, GDPR, HIPAA |
| LiteLLM | Audit logs (Enterprise) to S3; OpenTelemetry, Datadog, Splunk callbacks | MCP guardrails before, during and after tool calls; Presidio PII masking | Yes: core product, budgets per key, team and org | Third-party MCP servers, OpenAPI to MCP | SOC 2 Type II |
| Docker MCP Gateway | Call logging and OpenTelemetry | Secret blocking on tool arguments and responses; container isolation | Not documented | Docker MCP Catalog of verified servers | Not documented |
| IBM ContextForge | Audit trail (off by default); OpenTelemetry export | Plugins: PII filter, deny lists, LlamaGuard, OPA | LLM provider proxy; budgets not documented | Registry, federation and virtual servers | Not documented |
| Runlayer | Audit logs; continuous SIEM export to S3 | ToolGuard models for prompt injection, tool poisoning and exfiltration; PII rules | Model routing for some clients; budgets not documented | Yes: connector catalog and custom MCP server hosting | SOC 2, HIPAA, GDPR |
| Composio | Audit logs on every plan; Logs API with SIEM recipes | Policy enforcement in the request path | Spend controls on Pro | Yes: hosted MCP servers and an app toolkit directory | SOC 2 Type II; BAA available |
| Speakeasy | Per-tool-call audit log; OpenTelemetry export to Datadog, Splunk, Grafana or any OTLP collector | Guardrail policies for secrets, PII and financial data; prompt-injection detection | Not a model proxy; spend tracking; budgets in preview | Yes: generates and hosts MCP servers from OpenAPI or TypeScript; registry and catalog | SOC 2 Type II, ISO 27001, GDPR; BAA available |
| Amazon Bedrock AgentCore Gateway | CloudTrail events; CloudWatch with OpenTelemetry | Bedrock Guardrails through AgentCore Policy | Yes: model routing and per-caller limits | Lambda, OpenAPI, Smithy and MCP targets; integration templates | AgentCore: HIPAA eligible, SOC 2, ISO 27001 |
| Microsoft MCP Gateway | Server logs; Application Insights on Azure | Not documented | Not documented | Hosts MCP servers as containers | Not documented |
Which kind of gateway fits
For platform and security teams
If the goal is to approve MCP servers once and give each team a governed set of tools, look for SSO and SCIM, per-user credentials to downstream tools, tool-level access by role, and an audit trail you can export to your SIEM. Dedicated gateways and AI control planes (Mintive, Runlayer, Obot, Portkey, TrueFoundry) document all four in some form, so compare how each one scopes access and what its audit events contain. See RBAC and audit and observability for how Mintive handles both.
If you already run an API gateway
Kong, Azure API Management and AWS can proxy MCP traffic and expose REST APIs as MCP tools inside infrastructure you already operate. Check how each documents per-user OAuth to the tools behind it, tool-level access, and screening of tool results, since agent traffic carries a user's identity through to the tool. Many teams keep their API gateway for service traffic and add an MCP gateway for agent traffic; the two don't conflict.
If you need self-hosted or open source
IBM ContextForge (Apache 2.0), Obot (MIT), Docker MCP Gateway (MIT), Microsoft MCP Gateway (MIT) and LiteLLM (MIT, with an enterprise directory) all run in your own infrastructure. You operate upgrades, connectors and identity integration yourself. Mintive runs as a managed cloud service and offers on-premise or self-hosted deployment by arrangement (contact Mintive), and Runlayer, TrueFoundry, Portkey and Composio also document self-hosted or customer-cloud options.
When you don't need an MCP gateway
A small team running a few local MCP servers with personal credentials, with no SSO or audit requirement, can start without a gateway. The case for one grows with the number of users, shared connectors, and security reviews: at that point you need a single place to approve servers, issue credentials and answer "who called which tool."
FAQ
What is the difference between MCP gateways?
They differ mainly in where they come from. Dedicated MCP gateways govern tool calls first, API gateways add MCP to existing API traffic management, LLM gateways add MCP next to model routing, open-source projects are self-hosted, and cloud providers offer managed gateways inside their own platforms.
Is an API gateway enough for MCP?
An API gateway with MCP support can proxy MCP traffic, apply OAuth and rate limits, and turn REST APIs into MCP tools. Teams also need per-user credentials to downstream tools, tool-level access by role, and an audit trail that names the user behind each agent call, so check how the gateway documents each of those.
Open source or managed MCP gateway?
Open-source gateways such as IBM ContextForge (Apache 2.0), Docker MCP Gateway (MIT), Microsoft MCP Gateway (MIT) and Obot (MIT) run in your own infrastructure, and you operate them. Managed gateways move hosting, upgrades and connector maintenance to the vendor. Several vendors offer both.
Which MCP gateways also route LLM traffic?
Mintive (LLM gateway, early access), Kong AI Gateway, TrueFoundry, Portkey, LiteLLM, Obot and Amazon Bedrock AgentCore Gateway all document model routing alongside MCP. Budget and spend controls vary by vendor and plan.
Which MCP gateways screen tool calls for prompt injection?
Mintive (Mint Guard), Runlayer (ToolGuard), Speakeasy, TrueFoundry, Portkey, LiteLLM and Amazon Bedrock AgentCore Gateway document screening on MCP tool traffic. Others document guardrails for LLM traffic, partner plugins, or filter hooks you connect yourself.
Do I need an MCP gateway if only a few developers use MCP?
Not always. A small team running a handful of local MCP servers with personal credentials can start without one. A gateway becomes useful once you need SSO, shared connectors, per-role tool access, or an audit trail for security review.
Related
- Comparison articles on the blog: AI gateway vs MCP gateway vs agent gateway, Agent gateway vs API gateway, Agent gateways for self-hosted deployments
- Architecture: how a tool call flows through the Mintive MCP gateway
- Security overview: MCP security risks and controls