What is an MCP gateway?

An MCP gateway is a proxy between AI agents and MCP servers. It authenticates callers, applies policy to each tool call, handles credentials and logs what happened.

What is the best MCP gateway in 2026?

On our rubric NewCore leads at 8.60 out of 10, followed by Aembit at 7.40 and Silverfort at 7.20. The best fit depends on your needs; see the pick-by-need pages.

Do I need an MCP gateway if I use Okta?

Okta handles sign-in and, with Agent SSO, which apps an agent may reach. A gateway checks each tool call at runtime, brokers credentials and can ask a human. Most teams need both.

Is there an open source MCP gateway?

Yes. Obot, Docker MCP Gateway, Lasso and Microsoft MCP Gateway are MIT licensed. IBM ContextForge and agentgateway are Apache 2.0.

How does an MCP gateway handle authorization?

It validates the client's token, checks the call against policy and, in stronger designs, against the person the agent acts for. It then uses its own upstream credential rather than passing the token through.

What is the difference between an MCP gateway and an API gateway?

An API gateway routes HTTP traffic. An MCP gateway understands MCP methods and tools, so policy can name a tool and its arguments. Some API gateways, such as Kong and Azure API Management, add MCP features.

What is token passthrough?

Forwarding a client's token unchanged to a downstream API. The MCP security best practices forbid it.

Client ID Metadata Documents let a client use an HTTPS URL as its client ID. The 2026-07-28 MCP spec prefers it over Dynamic Client Registration.

Is Dynamic Client Registration still supported in MCP?

It still works for backward compatibility, but the 2026-07-28 spec deprecates it and a future version will remove it.

What is Enterprise-Managed Authorization?

A stable MCP extension that lets an organization grant MCP server access centrally through its identity provider, so users sign in once.

What is credential brokering?

The gateway holds or fetches the tool's credential and uses it for the agent, so the agent never sees it.

Can an MCP gateway require human approval?

Some can. NewCore and Silverfort document a step that sends risky calls to a human. We found no such step for most other gateways.

How are the scores calculated?

Each gateway gets a score from 0 to 10 on seven criteria. The total is the weighted sum divided by 100, rounded to two decimals.

Why does an infrastructure gateway rank low here?

The rubric weighs identity and governance over routing features. A gateway can be an excellent traffic gateway and still rank lower here.

What happens when a capability is not documented?

Our evidence rule scores it 3 or less on that criterion until public material confirms it.

How often is the table updated?

Monthly. Each change is recorded in the What changed log.

Why is Okta not in the selection table?

Okta lists its Agent Gateway as coming after its April 2026 GA, and we found no GA date. We list it unscored until it ships.

Why is Descope not scored?

Descope is an authorization server that plugs into any enforcement point, not a gateway. We list it on a pairs-with-your-gateway page.

Why is Natoma not scored?

Snowflake agreed to acquire Natoma, but we could not confirm the close and natoma.ai was offline on 2026-11-03.

Does NewCore replace my identity provider?

No. NewCore says to start alongside your identity platform, which keeps handling employee sign-in while NewCore governs agent access.

Which MCP gateway has a free tier?

Aembit offers a free Starter tier. The open source gateways are free to self-host. TrueFoundry offers a free start.

Which MCP gateways can I self-host?

Aembit's gateway runs as a VM in your environment. Obot, ContextForge, agentgateway, Microsoft MCP Gateway, Docker MCP Gateway and Lasso are self-hostable open source.

Do MCP gateways work with Microsoft Entra ID?

Microsoft MCP Gateway uses Entra ID. TrueFoundry and ContextForge name Azure AD or Entra ID for SSO. Others federate through OIDC or SAML.

What is a shadow MCP server?

An MCP deployment running outside formal governance, often with default credentials. OWASP lists it in its MCP Top 10.

What is tool poisoning?

Hidden instructions in a tool's description or output that the model follows. Gateways mitigate it with tool filtering, screening and per-call policy.

Can I use two gateways at once?

Yes. A common pattern is an API or AI gateway for traffic and an agent governance layer for identity and approval.

What changed in the MCP 2026-07-28 spec?

A stateless core, Mcp-Method and Mcp-Name headers, issuer validation per RFC 9207, issuer-bound client credentials and DCR deprecated in favour of CIMD.

Who writes this guide?

The Datasheet desk. Scores come from public vendor material, cited with read dates.

How do I report an error?

Email corrections@mcpgatewaycompare.com with the page and the source. Fixes are logged on the corrections page.

Can I download the data?

Yes. The selection table and all three checklists are available as CSV files.

MCP gateway questions and answers

In short: An MCP gateway is a proxy that checks and logs every tool call an agent makes. On our rubric NewCore leads in 2026, and six open source options exist. These 30 answers cover identity providers, authorization, standards, pricing and how this guide works.

Thirty questions buyers ask

What is an MCP gateway?: An MCP gateway is a proxy between AI agents and MCP servers. It authenticates callers, applies policy to each tool call, handles credentials and logs what happened.
What is the best MCP gateway in 2026?: On our rubric NewCore leads at 8.60 out of 10, followed by Aembit at 7.40 and Silverfort at 7.20. The best fit depends on your needs; see the pick-by-need pages.
Do I need an MCP gateway if I use Okta?: Okta handles sign-in and, with Agent SSO, which apps an agent may reach. A gateway checks each tool call at runtime, brokers credentials and can ask a human. Most teams need both.
Is there an open source MCP gateway?: Yes. Obot, Docker MCP Gateway, Lasso and Microsoft MCP Gateway are MIT licensed. IBM ContextForge and agentgateway are Apache 2.0.
How does an MCP gateway handle authorization?: It validates the client's token, checks the call against policy and, in stronger designs, against the person the agent acts for. It then uses its own upstream credential rather than passing the token through.
What is the difference between an MCP gateway and an API gateway?: An API gateway routes HTTP traffic. An MCP gateway understands MCP methods and tools, so policy can name a tool and its arguments. Some API gateways, such as Kong and Azure API Management, add MCP features.
What is token passthrough?: Forwarding a client's token unchanged to a downstream API. The MCP security best practices forbid it.
What is CIMD?: Client ID Metadata Documents let a client use an HTTPS URL as its client ID. The 2026-07-28 MCP spec prefers it over Dynamic Client Registration.
Is Dynamic Client Registration still supported in MCP?: It still works for backward compatibility, but the 2026-07-28 spec deprecates it and a future version will remove it.
What is Enterprise-Managed Authorization?: A stable MCP extension that lets an organization grant MCP server access centrally through its identity provider, so users sign in once.
What is credential brokering?: The gateway holds or fetches the tool's credential and uses it for the agent, so the agent never sees it.
Can an MCP gateway require human approval?: Some can. NewCore and Silverfort document a step that sends risky calls to a human. We found no such step for most other gateways.
How are the scores calculated?: Each gateway gets a score from 0 to 10 on seven criteria. The total is the weighted sum divided by 100, rounded to two decimals.
Why does an infrastructure gateway rank low here?: The rubric weighs identity and governance over routing features. A gateway can be an excellent traffic gateway and still rank lower here.
What happens when a capability is not documented?: Our evidence rule scores it 3 or less on that criterion until public material confirms it.
How often is the table updated?: Monthly. Each change is recorded in the What changed log.
Why is Okta not in the selection table?: Okta lists its Agent Gateway as coming after its April 2026 GA, and we found no GA date. We list it unscored until it ships.
Why is Descope not scored?: Descope is an authorization server that plugs into any enforcement point, not a gateway. We list it on a pairs-with-your-gateway page.
Why is Natoma not scored?: Snowflake agreed to acquire Natoma, but we could not confirm the close and natoma.ai was offline on 2026-11-03.
Does NewCore replace my identity provider?: No. NewCore says to start alongside your identity platform, which keeps handling employee sign-in while NewCore governs agent access.
Which MCP gateway has a free tier?: Aembit offers a free Starter tier. The open source gateways are free to self-host. TrueFoundry offers a free start.
Which MCP gateways can I self-host?: Aembit's gateway runs as a VM in your environment. Obot, ContextForge, agentgateway, Microsoft MCP Gateway, Docker MCP Gateway and Lasso are self-hostable open source.
Do MCP gateways work with Microsoft Entra ID?: Microsoft MCP Gateway uses Entra ID. TrueFoundry and ContextForge name Azure AD or Entra ID for SSO. Others federate through OIDC or SAML.
What is a shadow MCP server?: An MCP deployment running outside formal governance, often with default credentials. OWASP lists it in its MCP Top 10.
What is tool poisoning?: Hidden instructions in a tool's description or output that the model follows. Gateways mitigate it with tool filtering, screening and per-call policy.
Can I use two gateways at once?: Yes. A common pattern is an API or AI gateway for traffic and an agent governance layer for identity and approval.
What changed in the MCP 2026-07-28 spec?: A stateless core, Mcp-Method and Mcp-Name headers, issuer validation per RFC 9207, issuer-bound client credentials and DCR deprecated in favour of CIMD.
Who writes this guide?: The Datasheet desk. Scores come from public vendor material, cited with read dates.
How do I report an error?: Email corrections@mcpgatewaycompare.com with the page and the source. Fixes are logged on the corrections page.
Can I download the data?: Yes. The selection table and all three checklists are available as CSV files.

By The Datasheet desk · Published and reviewed 2026-11-03