NewCore vs agentgateway
| Criterion | NewCore | agentgateway | NewCore reason | agentgateway reason |
|---|---|---|---|---|
| G1 Identity-bound per-call authorization (25) | 10 | 6 | Every tool call passes through the gateway, which identifies the agent and the person behind it and checks the action against policy, keeping agents within that person's permissions. [nc-secure] | Fine-grained RBAC with a CEL policy engine can evaluate MCP requests, but the person behind an agent is not a documented input. [agw-gh] |
| G2 Credential brokering (20) | 10 | 4 | Access is short-lived and task-scoped, and the agent never holds the tool's own credential. [nc-secure] | Upstream auth is configurable, but brokering short-lived credentials so the agent never holds them was not described. [agw-gh] |
| G3 Human approval and escalation (15) | 10 | 2 | Policies return allow, ask or deny; risky calls go to a named approver who confirms with device biometrics, and an agent can never approve its own action. [nc-govern] | No human approval step was found. [agw-gh] |
| G4 Server registry and discovery (10) | 8 | 4 | A connection registry records each MCP server's endpoint, owner and environment, and agents are found through read-only integrations without relying on registration. [nc-secure][nc-discover] | Tool federation across targets is documented, but an owned registry with discovery of unregistered servers was not. [agw-gh] |
| G5 Audit evidence (10) | 9 | 5 | Tool calls, sessions and approvals sit in one audit trail with each call logged against its owner; a SIEM export was not named on the pages read. [nc-govern] | OpenTelemetry metrics, logs and traces are documented; SIEM export tied to a person was not. [agw-gh] |
| G6 Standards (10) | 5 | 7 | MCP, SAML and OIDC are named; OAuth 2.1 and Enterprise-Managed Authorization are not named on the pages read. [nc-foundation] | Supports JWT, OAuth, OAuth metadata and DCR endpoints, and TLS. [agw-gh] |
| G7 Deployment and buying clarity (10) | 4 | 9 | Delivered as SaaS with no list price; an AWS Marketplace listing exists and no free tier or self-host option was found. [nc-aws] | Free to self-host under Apache 2.0. [agw-gh] |
| Total | 8.60 | 5.10 | Weighted sum divided by 100. | |
In short: NewCore totals 8.60 and agentgateway totals 5.10 on our weighted rubric, a gap of 3.50 points. NewCore is ahead on per-call authorization, credential brokering, human approval, registry and audit. agentgateway is ahead on standards and deployment. Choose by the criteria your agents depend on, then check deployment and pricing below.
Which one should I choose?
NewCore totals 8.60 against 5.10 for agentgateway. The largest weighted difference is on credential brokering. agentgateway is ahead on standards and deployment.
Pick NewCore if credential brokering matters most to you.
It scores 10 against 4 there: access is short-lived and task-scoped, and the agent never holds the tool's own credential.
Pick agentgateway if deployment matters most to you.
It scores 9 against 4 there: free to self-host under Apache 2.0.
How do deployment and pricing compare?
| Parameter | NewCore | agentgateway |
|---|---|---|
| Deployment | SaaS. Works alongside an existing AI gateway, and the current identity platform keeps handling employee sign-in. | Self-hosted binary or container. |
| Price as published | No list price published. Listed on AWS Marketplace. | Free under Apache 2.0. |
| Identity provider | Yes. NewCore says to start alongside your identity platform, which keeps handling employee sign-in while NewCore governs agent access. | Yes. JWT and OAuth validation work against an external identity provider, including Entra endpoints. |
Full datasheets: NewCore and agentgateway.
Frequently asked questions
- Which is better, NewCore or agentgateway?
- On our rubric NewCore totals 8.60 against 5.10 for agentgateway. The better choice depends on which criteria matter most to you.
- Do NewCore and agentgateway work with my identity provider?
- NewCore: Yes. NewCore says to start alongside your identity platform, which keeps handling employee sign-in while NewCore governs agent access. agentgateway: Yes. JWT and OAuth validation work against an external identity provider, including Entra endpoints.
- How do NewCore and agentgateway differ on price?
- NewCore: No list price published. Listed on AWS Marketplace. agentgateway: Free under Apache 2.0.
By The Datasheet desk · Published and reviewed 2026-11-03