What should you ask an MCP gateway vendor?
In short: Ask each vendor the same 40 questions, grouped by our seven criteria. Those are per-call authorization, credential brokering, human approval, registry, audit, standards and deployment. The answers map straight onto our rubric, so you can score vendors we have not covered. Download the CSV to send as an RFP annex.
Download mcp-gateway-rfp-questions.csv
| No. | Criterion | Question |
|---|---|---|
| 1 | G1 per-call authorization | Does every tool call pass through the gateway before it reaches the tool? |
| 2 | G1 per-call authorization | Does the policy decision include the person the agent acts for? |
| 3 | G1 per-call authorization | Can agents be kept within the permissions of that person? |
| 4 | G1 per-call authorization | Can policy match on tool name, arguments and target environment? |
| 5 | G1 per-call authorization | How are policies tested before they go live? |
| 6 | G1 per-call authorization | What happens when the policy engine is unreachable: fail open or closed? |
| 7 | G2 credential brokering | Does the agent ever hold the tool's own credential? |
| 8 | G2 credential brokering | How long do issued tokens live? |
| 9 | G2 credential brokering | Are tokens scoped to a single task or session? |
| 10 | G2 credential brokering | Do you use token exchange, and is token passthrough disabled by default? |
| 11 | G2 credential brokering | How is a single agent revoked? |
| 12 | G2 credential brokering | Where are upstream secrets stored and who can read them? |
| 13 | G3 human approval | Can a policy return ask as well as allow and deny? |
| 14 | G3 human approval | Who receives approval requests, and how are approvers named? |
| 15 | G3 human approval | What factor does the approver use to confirm? |
| 16 | G3 human approval | Can an agent ever approve its own action? |
| 17 | G3 human approval | What happens to a call when no approver responds? |
| 18 | G3 human approval | Are approvals and rejections in the audit trail? |
| 19 | G4 registry | Does the registry record endpoint, owner and environment for each server? |
| 20 | G4 registry | How do you discover servers and agents that never registered? |
| 21 | G4 registry | Do you detect local stdio servers on endpoints? |
| 22 | G4 registry | Do you alert when a tool definition changes? |
| 23 | G4 registry | Can tools be hidden from agents that may not use them? |
| 24 | G5 audit | Is every call logged with agent, person, tool, arguments and outcome? |
| 25 | G5 audit | Which SIEM exports are supported? |
| 26 | G5 audit | Is the audit trail immutable? |
| 27 | G5 audit | Are denied attempts flagged as a threat signal? |
| 28 | G5 audit | What is the default log retention? |
| 29 | G6 standards | Which version of the MCP authorization spec do you implement? |
| 30 | G6 standards | Do you support CIMD client IDs? |
| 31 | G6 standards | Do you validate issuer per RFC 9207? |
| 32 | G6 standards | Do you support Enterprise-Managed Authorization or Cross App Access? |
| 33 | G6 standards | Do you support DPoP or mTLS sender-constrained tokens? |
| 34 | G6 standards | Do you route on Mcp-Method and Mcp-Name headers? |
| 35 | G7 deployment | Can the gateway be self-hosted? |
| 36 | G7 deployment | Is any part open source, and under which licence? |
| 37 | G7 deployment | Is there a published price? |
| 38 | G7 deployment | Is there a free tier, and what are its limits? |
| 39 | G7 deployment | Does it work alongside our identity provider and our existing AI gateway? |
| 40 | G7 deployment | Which marketplaces list the product? |
See all three on the checklists index, or score answers with our rubric.
By The Datasheet desk · Published and reviewed 2026-11-03