MCP Gateway: 12 Compared, and When You Don't Need One

An MCP gateway is a proxy that sits between your AI apps and the MCP servers they call, so every tool call passes one checkpoint. MCP is the open standard that lets an AI assistant like Claude or ChatGPT call another product’s tools directly. A gateway puts sign-in, permissions and logs for all of those servers in one place.

That one place cuts both ways. On September 2, 2026, CISA added a bug in LiteLLM, an open-source AI gateway, to its catalog of known exploited vulnerabilities. A made-up Bearer token could open an MCP session, and the advisory says an attacker could then list and call the MCP tools behind it.

Eight of the ten pages ranking for “mcp gateway” today come from companies that ship one. We don’t. So we compared 12 gateways against their own docs and pricing pages on October 15, 2026, and we’ll tell you when not to buy one.

What an MCP gateway does

Without one, every AI app connects to every server on its own. Three apps and five servers make 15 connections, each with its own sign-in and settings. A gateway turns that into one address per app.

Most gateways do some mix of these jobs.

• One endpoint: apps connect to a single URL, and the gateway routes each call to the right server.
• Sign-in: people log in once with company SSO, not once per server.
• Permissions: which people or teams see which servers and tools.
• Credentials: API keys and OAuth tokens live in the gateway, not on laptops.
• Audit logs: who called which tool, with what arguments, and when.
• Rate limits: caps per user, team or tool.
• Tool filtering: hiding tools a team doesn’t need, which also keeps the model’s context small.
• Guardrails: scanning tool descriptions and results for injected instructions, secrets or personal data.
• Observability: traces and metrics, usually over OpenTelemetry.

Every tool description costs context, the problem Code Mode attacks from the other side.

The MCP spec names hosts, clients and servers. A gateway isn’t one of those roles. To your apps it’s a server, and to your servers it’s a client.

The July 28, 2026 spec revision made that job easier. MCP is now stateless, so there’s no session to pin to one machine. Every request carries an Mcp-Method header and every tool call an Mcp-Name header, “so that intermediaries (load balancers, gateways, observability tooling) can route and inspect requests without parsing the body.”

Gateway, proxy or registry?

• A proxy moves traffic: it bridges transports, so an app that only speaks stdio can reach a remote server. sparfenyuk/mcp-proxy, with 2,788 GitHub stars on October 15, 2026, calls itself “a tool that lets you switch between server transports.”
• A gateway governs traffic: it’s a proxy plus identity, permissions and audit.
• A registry lists servers: it never sits in the path of a tool call. The official MCP Registry is “currently in preview,” holds metadata only, and leaves security scanning to package registries such as npm and to downstream aggregators.

The official registry doesn’t take private servers, and suggests hosting your own. GitHub Copilot’s “Registry only” policy can enforce one, though GitHub calls it public preview and “not the recommended method for restricting access to MCP servers.”

Three kinds of product share the name

• Local runners: start servers on your own machine, often in containers, behind one endpoint. Docker MCP Gateway works this way.
• Team control planes: SSO, per-user permissions, a credential vault and audit logs in front of remote servers. Obot, Mintive and Cloudflare’s portals sit here.
• API-to-MCP converters: turn existing REST APIs or functions into MCP tools. AgentCore Gateway and Azure API Management lead with this.

MCP gateways compared

We read each vendor’s own docs, repo or pricing page on October 15, 2026. Star counts are GitHub’s from that day.

Open source

• Docker MCP Gateway: runs each catalog server “in an isolated Docker container” behind one gateway. It ships in Docker Desktop’s MCP Toolkit and also runs on plain Docker Engine. The gateway is free, though Docker Desktop itself needs a paid plan at companies with 250 or more staff or $10 million in revenue. See the docker/mcp-gateway repo.
• Microsoft MCP Gateway: a reverse proxy and control plane for MCP servers on Kubernetes, with Entra ID sign-in and app roles. Its current code requires clients on the July 2026 spec.
• IBM ContextForge: federates MCP servers, A2A agents and REST or gRPC APIs into one endpoint, with an admin UI, rate limits and 40+ plugins. Version 1.0.11 shipped September 28, 2026.
• agentgateway: a Linux Foundation project donated by Solo.io. It routes MCP, A2A and model traffic, with OAuth, CEL policies for RBAC, rate limits and guardrail hooks. Version 1.6.0 shipped October 2, 2026.
• Obot: a gateway plus a server catalog, with access per server and tool by user or identity-provider group. Community is free and self-hosted for up to 100 users, and Obot Cloud has a 14-day trial but no printed price.

To try Docker’s gateway on one machine, its README starts it with one command.

docker mcp gateway run --port 8080 --transport streaming

Managed and commercial

• Cloudflare MCP server portals: one portal URL for up to 80 remote MCP servers, behind Cloudflare Access sign-in with any SAML or OIDC provider. Portals went generally available on September 24, 2026, and Cloudflare One’s Free Plan covers up to 50 users.
• Kong: its AI MCP Proxy plugin turns REST APIs into MCP tools, proxies existing servers and sets per-tool access lists. Its plugin docs say it is “only available as part of our AI Gateway Enterprise offering,” while its pricing page sells AI Gateway paid plugins as an add-on to Plus, so ask Kong which you need.
• TrueFoundry: includes its MCP gateway on every plan, with RBAC per server. The free plan covers 3 users and 5 MCP servers, and Pro at $25 per user a month adds SSO.
• Portkey: now part of Palo Alto Networks, which completed the purchase on May 29, 2026, and its site now calls it Prisma AIRS AI Gateway. Its MCP gateway logs every tool call with user, parameters and response, but the pricing page doesn’t say which plan includes it.
• Zuplo: “MCP Gateway, AI Gateway, and the developer portal are included in every plan,” says its pricing page. Builder allows 3 upstream MCP servers and 10,000 tool calls a month.
• Amazon Bedrock AgentCore Gateway: a managed AWS service that turns APIs and Lambda functions into MCP tools, handles inbound and outbound auth, and lets agents search a large tool list. Searches cost $0.025 per 1,000.
• Azure API Management: exposes a REST API as an MCP server or fronts an existing one, with rate limits and Entra ID token checks as policies.

Of the security-first options, Aembit’s MCP Identity Gateway is free for 3 AI agents, and its Teams plan is $20 per agent a month, starting at 10 agents. Mintive, renamed from MintMCP on October 12, 2026, and Operant both price by quote.

When you don’t need one

This is the part the vendor pages skip. Most teams searching for a gateway need two cheaper things first, an allowlist and OAuth on every server. The apps you already pay for ship the first, and the MCP spec asks for the second.

• Claude Team and Enterprise: owners enable each connector, and only owners or an Enterprise custom role can add custom ones. Each person signs in as themselves, and owners can set each permission category, or a single permission, to Always allow, Needs approval or Blocked. “Individual users can’t override it.”
• ChatGPT Business, Enterprise and Edu: only admins and owners can publish a custom MCP server. For apps that offer action controls, admins pick which read and write actions they may use, and can keep actions a server adds later switched off.
• Claude Code: a managed allowedMcpServers list, with allowManagedMcpServersOnly on, blocks any server a user adds that doesn’t match an approved URL or command. With OTEL_LOG_TOOL_DETAILS=1, its OpenTelemetry export names the server and tool behind each call.
• The spec: a protected remote server is an OAuth 2.1 resource server that checks each token was issued for it, and it “MUST NOT accept or transit any other tokens.”

Claude’s settings are in its connector guide, Claude Code’s in its managed MCP docs and ChatGPT’s in OpenAI’s admin controls guide. Which apps take remote servers on which plans is in our client list.

Even a gateway vendor agrees. Obot’s own guide says you “will likely not need a gateway if you’re a single developer, if you’re in control of all the MCP servers yourself, or if you don’t need OAuth or compliance requirements.”

We run remote MCP servers for ContextBolt SEO and ContextBolt Bookmarks on Cloudflare Workers, with no gateway in front. Both sign users in with OAuth. The SEO server caps each user at 120 tool calls per clock hour as an abuse ceiling, and the real limit is a per-user credit ledger.

When a gateway starts to pay

• Many servers and many people: different teams need different tool sets, and syncing them by hand across Claude, ChatGPT and Cursor stops working.
• An auditor: someone asks who called which tool, as whom, across every app, and you need one log to answer.
• Shared local servers: stdio servers take credentials from the environment, and you’d rather keep that key in one vault than on every laptop.
• Internal APIs: you want your own REST APIs as MCP tools without building a server for each.

If you can’t name the auditor, the tenth server or the second team, wait. Until then, a look at the servers each agent already has now and then keeps the list honest.

What a gateway can’t fix

Gateways do catch real things. A good one blocks a known-bad server, stops a leaked secret and keeps a log for the auditor. Four problems get through anyway.

Prompt injection through tool output

In May 2025, Invariant Labs showed an agent using the official GitHub MCP server leak private repo data into a public pull request. The trigger was a malicious issue in a public repo, and Invariant stressed that “this is not a flaw in the GitHub MCP server code itself.”

Every call in that attack used a real tool, a real token and allowed arguments, so even a gateway with per-tool allow rules would log it and pass it through. Guardrail scanners catch known injection phrasing, which helps. But OWASP says “it is unclear if there are fool-proof methods of prevention for prompt injection.”

What works is a smaller blast radius. Invariant’s own example policy kept the agent to one repository per session.

A backdoored server

In September 2025, a fake postmark-mcp package on npm “built trust over 15 versions, then added a backdoor in version 1.0.16 that secretly BCC’d emails to an external server,” according to Postmark.

A gateway sees the agent ask the server to send an email. It never sees the server’s own request to Postmark, which is where the BCC went in.

Pin versions, prefer servers from the vendor itself, and treat each update like a new install. Anthropic’s connector guide puts it in five words, “Monitor changes in tool behavior.”

Over-broad tokens

The spec warns that a stolen broad token “enables lateral data access, privilege chaining, and difficult revocation.” A gateway can make this worse. If it injects one shared service key for everyone, every user gets that key’s full rights, and downstream logs show one identity.

Claude’s help center says a shared credential such as an API key “gives everyone who uses it that credential’s access.” Per-user OAuth beats a shared key, gateway or not.

The gateway itself

Back to LiteLLM. GitHub’s advisory, published July 22, 2026, traced the bug to an OAuth passthrough fallback that swapped a failed key check for an empty auth object. Version 1.84.0 fixed it.

An earlier LiteLLM SQL injection, on CISA’s list since May 8, 2026, could expose “the proxy and the credentials it manages.”

This isn’t really about one project. LiteLLM has more than 61,000 GitHub stars, and a box that holds every token and fronts every server is worth attacking. The spec’s security guide opens with an attack on MCP proxies that sign in to other services for their users.

Cloudflare’s portal docs add a quieter warning. Blocked users “can still connect to the server (and bypass your Access policies) by using its direct URL.” Patch the gateway like a VPN, and make sure nobody can reach the servers around it.

Which one fits

First, see what your agents can already reach. Paste this into each AI app your team uses.

Copy this prompt

Read only. Do not call any tool that changes data.
1. List every MCP server and tool you can use in
   this chat, grouped by server.
2. Mark each tool read-only or write.
3. Flag every tool that can send data outside the
   company, such as email, posts, webhooks or shares.
4. Count the servers and the write tools. Then tell
   me which tools to block or set to need approval.

If the answer fits on one screen, client controls will do. When it doesn’t, a gateway starts earning its fee.

Where ContextBolt fits

ContextBolt is ours, so weigh the bias. Nothing in the comparison above is ours.

ContextBolt SEO is a hosted SEO MCP server. It puts keyword, ranking, backlink, audit, AI visibility and Search Console data inside the agent. It has a 7-day free trial with 100 credits, card required, then costs $35 a month with 1,000 credits.

ContextBolt Bookmarks is a Chrome extension that keeps saved web pages and X, Reddit and LinkedIn saves in one library. Pro is $6 a month and adds an MCP endpoint so the agent can search it.

Try ContextBolt SEO

Use ContextBolt SEO. Get volume, difficulty and cost
per click for "mcp gateway" and five related terms.
Then list who ranks in the top 10 for "mcp gateway"
and mark which results are vendor product pages.