Consolidation in MCP gateways during 2026

What happened this year?

Palo Alto Networks completed its acquisition of CyberArk on 11 February 2026. On 12 May 2026 it launched Idira, which includes an AI agent Identity Broker for MCP.

On 27 May 2026 Snowflake announced its intent to acquire Natoma, an enterprise MCP platform with an MCP Gateway. We could not confirm the deal had closed, and natoma.ai was offline when we checked on 2026-11-03.

On 15 June 2026 NewCore emerged from stealth with $66M from Cyberstarts, Index Ventures and Evolution Equity Partners.

MintMCP now redirects to Mintive, which announced an $11M launch on its home page.

Why are we not scoring Natoma?

Our evidence rule needs public material we can read. With the vendor site offline and the acquisition not confirmed as closed, we have nothing current to score.

We mention Natoma in the news log only. If its product reappears under Snowflake with documentation, we will review it.

What does consolidation mean for buyers?

Bundled products often ship as add-ons. Idira's Identity Broker is sold as an add-on licence with no public price.

Bundles can be convenient if you already run the platform. They can also tie your agent governance to one vendor's roadmap.

Independent products carry a different risk. A young company may change its pricing, packaging or name, as MintMCP did.

What should you ask?

Ask how the gateway is licensed today and whether that will change. Ask whether it works alongside your identity provider and any AI gateway you run.

Ask whether policies and audit logs can be exported in a standard form. Ask about the MCP spec version and the deprecation timeline for DCR.

Open source gateways answer some of these questions by design. Docker MCP Gateway, Obot and Lasso use MIT. IBM ContextForge and agentgateway use Apache 2.0.

Ask what happens to your data and contracts if the vendor is acquired. A change of owner can change data residency, support terms and the product roadmap.

Ask for an exit plan too. If you leave, can you take your registry, policies and audit history with you in a usable form?

None of this means avoiding young vendors or large platforms. It means writing these answers into the contract before agents depend on the product.

How do we track this?

The What changed log on the home page records each change to the selection table. The corrections page records any fix to a published fact.

We review the table monthly. Acquisitions, renames and new launches go into the next revision.