Best MCP Gateways in 2026: 13 Platforms to Govern and Secure Agent Tool Access

By Camellia · Updated Nov 3, 2026

If you already run on AWS, Google Cloud, or Azure, start with the gateway your cloud sells: AgentCore Gateway with Agent Registry, Google's Agent Gateway, or Azure API Management. If you want a self-hosted gateway you can read and change, IBM's ContextForge, Obot, and the Linux Foundation's agentgateway are all free and open source. If the buyer is a security team that wants to see every AI tool call across the company, Runlayer and Mintive (the new name of MintMCP) are built for that job. And if your platform team already runs Kong or Red Hat OpenShift, the MCP gateway is now a feature of a tool you own. This guide compares 13 options, with prices taken from each vendor's own pricing page wherever one exists.

An MCP gateway is the single endpoint that sits between your AI clients and the MCP servers they call. It decides who can reach which tool, holds the credentials so users and agents don't, and writes down every call. The category is young enough that half the vendors here renamed, launched, or reached general availability this year. So instead of one overall ranking, this guide scores each gateway on four separate jobs, prices a real month of traffic where the math is public, and flags what's still in preview.

Key Facts

• Gartner projects that 75% of API gateway vendors will have MCP features by the end of 2026, up from near zero in 2024, per K2view's summary of Gartner's MCP Innovation Insight report.
• Anthropic's Model Context Protocol became a Linux Foundation project on December 9, 2025, when the Linux Foundation launched the Agentic AI Foundation, per Runlayer's write-up of the launch.
• Google's Agent Gateway reached general availability on June 18, 2026, the same day Agent Registry did.
• AWS bills AgentCore Gateway at $0.005 per 1,000 API invocations, so one million tool calls costs $5 on the invocation meter alone.
• The MCP protocol itself is mid-transition: Red Hat's gateway serves the 2025 protocol versions and the new 2026 stateless version on one endpoint, and Cloudflare's portals support stateless MCP 2026-07-28.

What an MCP Gateway Actually Does

Four separate jobs get sold under this one label, and almost nobody is equally strong at all four:

1. Routing and federation. Presenting many MCP servers behind one URL, so a client configures one connection instead of thirty.
2. Identity and credentials. Signing users in through your identity provider, then holding the downstream OAuth tokens or API keys so they never sit on a laptop or in a prompt.
3. Policy and guardrails. Deciding which tools a person or agent may call, blocking destructive actions, and scanning for prompt injection or data leaks.
4. Audit and observability. Logging who called what, with what arguments, and what came back.

A gateway built by an API-management company is usually strongest at jobs one and two. A gateway built by a security company is usually strongest at three and four. Buying on "it has an MCP gateway" without asking which job you're hiring for is how teams end up with a tidy proxy and no answer when the auditor asks who deleted the record.

Where does a gateway sit in the stack? It's not an agent framework. Agent frameworks decide what an agent does; the gateway governs what it's allowed to touch. It's also not a trace viewer: LLM observability tools record the model's reasoning and cost, while a gateway records the tool call. And it's adjacent to, but different from, AI agent security tools, which focus on agent and non-human identity. Many gateways here blur those lines on purpose, which is why the scoring table below separates the jobs.

Quick Comparison Table

Score by Job: Routing, Identity, Policy, or Audit

Rate each candidate on the four jobs separately before you shortlist. These are editorial ratings based on each vendor's own documentation.

A "Good" in policy usually means access control exists but content scanning for injection or exfiltration isn't the product's reason for being. A "Good" in routing means the gateway proxies a handful of servers cleanly but isn't built to federate hundreds.

The Real Cost of a Million Tool Calls

Free-tier limits are where this category's marketing lives, and they're close to useless for budgeting. Here's what one million tool calls a month costs where the vendor publishes the rates. The billed unit differs, so read the unit column before comparing dollars.

The pattern worth sitting with: the two cloud gateways with public meters (AWS and TrueFoundry) are cheap per call but bill on several axes, while the security-led platforms sell by seat and conversation. The open-source gateways cost nothing in licenses and everything in operations.

Hosting, Self-Hosting, and Licensing

An MCP gateway holds your downstream credentials and sees every tool argument, which often includes customer data. That makes "where does it run" a bigger question here than in most software categories.

If your policy forbids sending tool arguments to a third party's cloud, the self-hostable half of this table is your shortlist: ContextForge, Obot, agentgateway, Kong, Red Hat, TrueFoundry, and Docker. For a deeper look at the privacy side of agent data, see our enterprise AI agent platforms roundup.

What Changed in 2026

• MintMCP became Mintive. The company's announcement dated October 12, 2026 says MintMCP is now Mintive, grouping its MCP Gateway, LLM Gateway, Mint Guard, Agent Monitoring, and Coworker Agents under one brand. Existing deployments carry over, and mintmcp.com redirects to the new domain.
• Red Hat's MCP gateway went generally available. On October 16, 2026, Red Hat announced GA inside Connectivity Link 1.5, after a technology preview. The OpenShift console plug-in is still developer preview.
• Google's gateway and registry hit GA in June. Agent Gateway and Agent Registry both went GA on June 18, 2026, with Model Armor for Agent Gateway following on June 24. The overview still marks GKE, Cloud Run, and cross-cloud hosting as coming soon.
• AWS added a registry layer. AWS Agent Registry now has its own meters and a free tier alongside AgentCore Gateway.
• ContextForge reached 1.x. IBM's open-source gateway is at v1.1.0, released October 20, 2026.
• Docker put its gateway under governance. Docker's docs describe the MCP Gateway as an invite-only feature of Docker AI Governance.

1. AWS AgentCore Gateway and Agent Registry: The Metered Cloud Option

AgentCore Gateway is Amazon's managed front door for agent tools. It converts APIs and Lambda functions into MCP tools, authenticates callers, and offers a search API so an agent with hundreds of tools can find the right ones instead of loading every definition into context. AWS Agent Registry sits beside it as the catalog of approved agents and tools, so a team can publish a record once and let others discover it. If your agents already run on AWS, this is the lowest-friction path, and the registry's free tier means a small catalog costs nothing. For how the AWS stack compares with Google's and Microsoft's, see Gemini Enterprise Agent Platform vs Bedrock AgentCore vs Foundry.

Pricing: Gateway API invocations (ListTools, InvokeTool, Ping) $0.005 per 1,000. Search API $0.025 per 1,000. Tool indexing $0.02 per 100 tools a month. Data egress to customer VPCs $0.006 per GB. Agent Registry: first 5,000 records free, then $0.40 per 1,000; first 1,000,000 search calls free, then $0.02 per 1,000; first 2,000,000 list and get calls free, then $0.004 per 1,000. No Gateway free tier is listed. Source: aws.amazon.com/bedrock/agentcore/pricing.

Best for: AWS-native teams that want a managed gateway and a registry on one bill. Not ideal for: multi-cloud shops or teams that need to self-host.

2. Google Agent Gateway: Allow-Lists Written Against a Registry

Google describes Agent Gateway as a governance and security layer at the network entry and exit of agent traffic. In ingress mode it authenticates callers and inspects prompts. In egress mode it governs what agents reach: remote MCP servers, SaaS APIs, and other agents. It reads the JSON-RPC of an MCP call to pull out the tool name, so a policy can allow one tool on a server and block another. Agents get SPIFFE-based identities with mTLS, IAM policies block every connection unless one explicitly allows it, and Model Armor scans prompts and tool responses for injection and data leaks. Agent Registry supplies the approved list of servers and tools those policies refer to.

Pricing: No separate price is listed on the product overview. Source: Agent Gateway overview.

Best for: Teams running agents on Gemini Enterprise Agent Platform who want IAM-native tool control. Not ideal for: teams whose agents run mostly on GKE, Cloud Run, or another cloud and need those environments supported today.

3. Azure API Management: Your API Gateway, Now Speaking MCP

If your company already routes APIs through Azure API Management, the shortest path to an MCP gateway is there. Microsoft's documentation describes two ways in: expose a managed REST API as an MCP server, where each API operation becomes a tool, or front an existing MCP server. Then the policies you already know apply: rate limiting and quotas, JWT validation against Microsoft Entra ID or another identity provider, IP filtering, and caching. Azure API Center acts as the private MCP server registry, and monitoring flows into Azure Monitor and Application Insights.

Pricing: MCP features are available in the Developer, Basic, Standard, and Premium tiers and in the Basic v2, Standard v2, and Premium v2 tiers. Pricing is by tier; use Azure's API Management pricing page for current rates.

Best for: Microsoft-centric enterprises that already manage APIs in APIM. Not ideal for: teams that need MCP prompts or resources proxied.

4. Kong AI Gateway: One Gateway for LLM, MCP, and A2A

Kong's pitch is consolidation. Its AI Management plan includes a "Unified AI Gateway for LLM, MCP, and A2A traffic," and its MCP documentation lists plugins that turn an API into an MCP server, secure MCP access with OAuth, and enforce access controls on which MCP tools get used. MCP traffic audit logs and metrics arrive in Kong Gateway v3.12 and later. An MCP Registry that catalogs your servers in Konnect Catalog is available as a tech preview, so it's a roadmap item rather than something to build a compliance story on.

Pricing: AI Management Plus from $25/month plus usage, billed monthly in arrears. It includes 1M AI/API requests a month, then $200/month per additional 1M, capped at 10M on Plus. Unique LLMs proxied cost $100/month per model, with five allowed on Plus. Enterprise is custom and billed annually. Source: konghq.com/pricing.

Best for: Platform teams that already run Kong and want MCP governance without a new vendor. Not ideal for: teams that need a mature, GA MCP catalog today.

5. Red Hat Connectivity Link: A Kubernetes-Native Gateway, Now GA

Red Hat's MCP gateway is built on the upstream Kuadrant MCP gateway project and shipped as generally available in Connectivity Link 1.5 on October 16, 2026. It lets one team run its own gateway instance, or lets several teams share a gateway with isolated endpoints such as /mcp-team-a and /mcp-team-b. Prompts and resources are federated from upstream servers, and agents can discover tools in steps through discover_tools and select_tools meta-tools. NeMo guardrails check tool call requests and responses against safety policies, independent of authentication. Audit entries are emitted for valid tools/call requests, with five new Prometheus metrics.

Pricing: Pricing on request. Red Hat notes only that a subscription may be required for some services. Source: Red Hat's announcement.

Best for: OpenShift shops that want the gateway inside their existing platform. Not ideal for: teams without Kubernetes expertise.

6. Cloudflare MCP Server Portals: Curated Tool Menus at the Edge

Cloudflare's portals put many MCP servers behind one HTTP endpoint, managed through Cloudflare Access. Users sign in once, then authenticate separately to each OAuth-protected server. Admins choose which tools and prompts each portal exposes and can hide everything by default with an allow-list. They can rename tools and rewrite their descriptions without touching the upstream server. Two features target token waste: an optimize_context parameter that shrinks tool definitions, and a Code Mode that collapses upstream tools into search and execute tools running JavaScript in an isolated Worker. Optional Gateway routing adds HTTP logging and DLP scanning. See the portal documentation.

Pricing: No separate MCP portal price is listed in the documentation. Portals need a Cloudflare domain and an identity provider configured in Zero Trust; Logpush export of portal logs requires an Enterprise plan. Source: portal documentation.

Best for: Teams already on Cloudflare Zero Trust that want a fast, curated tool menu. Not ideal for: teams running local stdio servers they can't expose over HTTP.

7. TrueFoundry: Published Pricing for an LLM and MCP Gateway

TrueFoundry sells one gateway for model traffic and MCP traffic, and it's one of the few in this group that publishes seat prices. Its MCP gateway is a central registry with per-server RBAC, federated sign-in through Okta or Azure AD, OAuth 2.0, and request tracing filterable by user, tool, team, or cost. It has prebuilt servers for Slack, Confluence, Sentry, and Datadog, and lets teams register internal APIs as MCP servers. It can run in your VPC, on-prem, or air-gapped. The things to watch are the pooled usage allowance and the performance claims on its marketing pages, which come without benchmarks.

Pricing: Developer $0 (up to 3 users, 10K requests and tool calls per user a month, up to 5 MCP servers, 7-day log retention). Pro $25 per user per month billed monthly (20K requests and tool calls per user a month, pooled across the team; overage $20 per additional 100K; unlimited virtual MCPs, 30-day log retention, SSO). Enterprise custom, annual commitment. Model-provider charges are separate. Source: truefoundry.com/pricing.

Best for: Teams that want one gateway for models and tools with a published price. Not ideal for: very high-volume workloads, where pooled seat allowances and overage need modeling first.

8. Mintive (Formerly MintMCP): Role-Based Tool Bundles for the Whole Company

Mintive's gateway is aimed at a different buyer than most here: the IT or security lead rolling MCP out to employees, not just developers. Teams approve which MCP servers staff may use, block the rest, and group servers into role-based bundles with destructive actions turned off. Staff then reach those tools from ChatGPT, Claude, Microsoft 365 Copilot, Cursor, or Claude Code. The company's rename announcement lists five products now sold together: MCP Gateway, LLM Gateway, Mint Guard, Agent Monitoring, and Coworker Agents. Monitoring data can be exported to a SIEM or streamed over OTLP.

Pricing: Pricing on request, set by team size and needs, with per-user licensing and platform fees across four bands: 1-100, 101-1,000, 1,001-9,999, and 10,000+ users. Source: mintive.com/pricing.

Best for: Companies governing MCP use across non-engineering staff. Not ideal for: small engineering teams that want a self-serve price and a free tier.

9. Runlayer: A Control Plane with Shadow-AI Discovery

Runlayer calls itself the operating layer for AI. Beyond routing MCP and LLM calls through one gateway, it discovers shadow AI activity across endpoints, clients, and agents, applies policies per user, agent, and tool call, and requires human approval for risky actions. Built-in scanners look for intent drift, PII, and data exfiltration, with an alert-only mode to set a baseline before you switch to blocking. It also offers an internal catalog of approved connectors, skills, and agents. Its site lists customers such as Decagon, Gusto, PagerDuty, and Opendoor, and it joined the Agentic AI Foundation as a Gold-tier sponsor in December 2025.

Pricing: Pricing on request; the site offers a demo. Source: runlayer.com.

Best for: Security-led rollouts where the first question is what AI tools employees are already using. Not ideal for: teams that want to self-serve a gateway this afternoon.

10. IBM ContextForge: A Free Registry and Proxy You Can Read

ContextForge is an Apache-2.0 project in IBM's GitHub organization that describes itself as an open source registry and proxy federating tools, agents, and APIs into one endpoint. A Tools Gateway handles MCP and REST (with gRPC-to-MCP translation), an Agent Gateway handles A2A and OpenAI- and Anthropic-compatible agent routing, and an API Gateway acts as a reverse proxy with rate limiting. Unified registries cover tools, prompts, and resources. Auth supports Basic, JWT, custom schemes, and user-scoped OAuth tokens, and OpenTelemetry tracing exports to Phoenix, Jaeger, Zipkin, or any OTLP backend. The latest release is v1.1.0 from October 20, 2026. Its repository lists community channels such as issues and discussions rather than a commercial support tier.

Pricing: Free and open source (Apache-2.0). Source: github.com/IBM/mcp-context-forge.

Best for: Platform teams comfortable operating open-source software who want a federated registry without license fees. Not ideal for: teams that need a vendor-backed SLA.

11. Obot: Open-Source Gateway Plus Server Hosting

Obot goes beyond proxying: it can run npx, uvx, and containerized MCP servers as Docker containers or Kubernetes workloads, and turn OpenAPI-described HTTP APIs into hosted MCP servers. Virtual MCP servers combine catalog servers behind one endpoint, with access controlled by user or identity-provider group. Catalogs of MCP servers and skills are exposed through the standard MCP Registry API. Identity controls include SSO and Okta SCIM provisioning, and audit logs cover MCP, LLM, device, and egress activity. It also ships an LLM gateway for OpenAI, Anthropic, Bedrock, and Azure endpoints. Obot Sentry for device-level inventory is in beta.

Pricing: Community edition is free (MIT). Community and Enterprise run the same open-source code and container image and differ only in license key; Enterprise pricing isn't published. Source: github.com/obot-platform/obot.

Best for: Teams that want one open-source platform to host, gate, and catalog MCP servers. Not ideal for: teams without Kubernetes experience, since production use points there.

12. agentgateway: The Linux Foundation's Open-Source Proxy

agentgateway is an Apache-2.0 open-source proxy for agent-to-LLM, agent-to-tool, and agent-to-agent traffic, hosted as a Linux Foundation project. Its MCP Gateway federates tools across stdio, HTTP, SSE, and Streamable HTTP transports, integrates with OpenAPI, and supports OAuth. Its A2A Gateway handles agent discovery and task collaboration. You can run it as a standalone binary or in Docker on a server, or deploy it on Kubernetes with a built-in control plane and the Gateway API.

Pricing: Free and open source (Apache-2.0). Source: github.com/agentgateway/agentgateway.

Best for: Kubernetes-native teams that want a vendor-neutral proxy under foundation governance. Not ideal for: teams that want a managed service or built-in guardrails.

13. Docker MCP Gateway: Isolation by Container

Docker's MCP Gateway is a proxy between AI clients and MCP servers that starts each server as a container on demand. Servers run with restricted privileges, network access, and resource usage, and the gateway injects credentials and applies security restrictions before forwarding a request. Built-in logging and call tracing cover tool activity, and profiles control which servers a client can use. With Docker Desktop and the MCP Toolkit enabled, the gateway runs automatically; on Docker Engine alone, you install the docker-mcp binary. The same documentation describes it as an invite-only feature of Docker AI Governance.

Pricing: No price is published; Docker directs interested teams to Docker Sales. Source: Docker MCP Gateway docs.

Best for: Developer teams already standardized on Docker who want sandboxed servers. Not ideal for: company-wide rollouts that depend on SSO and group-based policy.

Stage and Sizing Fit

Buying Mistakes to Avoid

• Treating the gateway as a proxy only. Credential custody is half the value. Check where downstream tokens live and who can read them.
• Skipping tool-level policy. Allowing a server isn't the same as allowing every tool on it. Pick a gateway that can switch off destructive actions per role.
• Trusting a preview feature for compliance. Kong's MCP Registry is a tech preview and Red Hat's console plug-in is developer preview. Ask which pieces of a gateway are GA before it's in an audit scope.
• Ignoring protocol drift. MCP's 2026 stateless version sits next to the older 2025 versions, and some features, like Red Hat's progressive tool discovery, only work on the stateful path. Test your actual clients.
• Not asking who owns the vendor. MintMCP just changed its name. Confirm roadmap and support terms at purchase and again at renewal.
• Pricing off the free tier. Pooled per-seat allowances and multi-meter cloud bills behave differently at real volume. Model a month of your own traffic.

How to Choose: Decision Framework

What to Do Next

Pick the five MCP servers your team uses most, put them behind one candidate gateway from the shortlist above, and run it for two weeks. Confirm you can see who called which tool, that a user can't reach a tool you blocked, and that revoking a person removes their access everywhere at once. Then price a month of your real call volume from the cost table, not the free-tier headline.

If the agents behind those tool calls also need persistent context, the agent memory tools roundup covers what to pair with the gateway, and the RAG tools roundup covers the retrieval side. Teams picking a full platform rather than a gateway alone should read the AI agent platforms roundup.