Why this guide weighs identity over routing

What question does the rubric answer?

We ask one question of every gateway. When an agent makes a tool call, does the gateway know who the agent is, who it acts for, and whether that person may do this? Everything else in the rubric supports that question.

Per-call authorization carries 25 percent. Credential brokering carries 20 percent. Human approval carries 15 percent. Registry, audit, standards and deployment share the remaining 40 percent, at 10 percent each.

Why not weigh routing and performance?

Routing, load balancing, caching, retries and rate limits are well understood. The open source gateways we scored, such as agentgateway, Docker MCP Gateway and IBM ContextForge, handle much of this well. Kong and Microsoft bring mature API gateway foundations.

Those are real strengths. They are not what this guide measures. A buyer who mainly needs to federate many MCP servers behind one endpoint may prefer one of them, and should read their datasheets with that in mind.

Why does identity come first?

An agent that holds a broad token can do anything that token allows. If the gateway only checks that the token is valid, the agent can still delete records, move money or email customers.

Identity-bound checks change that. The gateway asks whether the person behind the agent is allowed to take this action, on this resource, right now. If not, the call stops before it reaches the tool.

Credential brokering closes the second gap. If the agent never holds the tool credential, a prompt injection cannot make it leak one. Short-lived, task-scoped tokens limit what a leaked token could reach anyway.

Human approval closes the third. Some calls are fine for one person to approve and wrong for an agent to make alone. A gateway that can pause the call and ask a named person turns a risky action into a reviewed one.

What does this mean for the ranking?

Gateways built by identity vendors rank higher, because they were designed around these questions. NewCore leads on per-call authorization, brokering and approval. Aembit leads on standards. Silverfort is strong on approval and audit.

Infrastructure gateways rank lower, mostly because they do not describe identity-bound checks or human approval on the pages we read. Our evidence rule caps any capability we could not find at a score of 3 or less.

How should you use the scores?

Treat the total as a starting point. The pick-by-need pages reweight the same scores for six common situations, and the leader changes on some of them. Self-hosting teams, for example, get a different first place.

Many companies will run two gateways: an existing AI or API gateway for traffic, and an agent governance layer for identity and approval. Several products here say they work alongside the gateway you already run.

We update the scores monthly. If a vendor publishes new documentation that changes a score, write to the corrections address and we will review it.