8 Best Agent Gateways

TL;DR

• An agent gateway governs the three kinds of traffic AI agents create: model calls, MCP tool calls, and agent-to-agent (A2A) calls, under one identity and policy layer.
• Bifrost, Kong AI Gateway, Gravitee, IBM ContextForge, and Amazon Bedrock AgentCore Gateway cover all three paths, though AgentCore forwards A2A without protocol translation and Agent Router's A2A support is still a preview.
• Google Cloud Agent Gateway and Amazon Bedrock AgentCore Gateway are managed services tied to their clouds; Google's currently covers only agents on Gemini Enterprise Agent Platform.
• Bifrost is open source, self-hosted, and links an A2A task to the model and tool calls it triggers through a shared session ID in Agent Logs.
• Model, tool, and agent permissions should be separate grants, so a key allowed to call an agent does not automatically reach every model and tool behind it.

An agent gateway is the control point that authenticates AI agents and their callers and applies policy to the model calls, MCP tool calls, and agent-to-agent requests those agents make. Teams need one once agents call tools and each other, because a gateway that sees only model traffic cannot show who invoked which agent or what it touched. Bifrost, the open-source AI gateway for models, tools, and agents built by Maxim AI, is the best choice for enterprises running mission-critical AI workloads that require top-tier performance, scalability, and reliability. This guide compares the eight best agent gateways on model, MCP, and A2A coverage, agent identity, and deployment, using each vendor's documentation as of November 5, 2026.

What Is an Agent Gateway?

An agent gateway is a gateway that sits between AI agents and everything they call, enforcing identity, access, spend, and logging policy on model requests, MCP tool calls, and A2A calls between agents. It extends the LLM gateway pattern from one traffic type to three, so a single policy layer covers an agent's whole task.

Figure 1: An LLM gateway governs the top path only; an agent gateway applies the same identity and policy to tools and to other agents.

The three paths use different protocols. Model calls use provider APIs such as OpenAI Chat Completions. Tool calls use the Model Context Protocol, and calls between agents use Agent2Agent (A2A), which the Linux Foundation took on in June 2025.

Our enterprise agent gateway guide covers the architecture in depth, and agent gateway vs LLM gateway explains where the two categories overlap.

How We Evaluated Agent Gateways

We evaluated each agent gateway on six criteria drawn from what platform teams test during a trial: coverage of model, MCP, and A2A traffic, how agents and callers are identified, whether one task can be traced across all three paths, and where the gateway can run. Every competitor claim below comes from that vendor's own documentation, read on November 5, 2026.

Figure 2: A gateway that passes all five can say who started a task, what it was allowed to touch, what it cost, and where it went.

Agents act for users and for themselves, so the gateway has to carry both identities through tool calls; our guide to non-human identity for AI agents covers the patterns, and the AI agent registry guide covers how teams catalog the agents a gateway admits.

Agent Gateways Compared at a Glance

The eight agent gateways split into three groups: self-hosted gateways that cover models, MCP, and A2A (Bifrost, Gravitee, IBM ContextForge, Kong with an Enterprise license, and Agent Router with A2A in preview), cloud-managed gateways tied to one provider's agent platform (AWS and Google), and API management platforms extended to agents (Azure API Management).

Competitor details from each vendor's documentation as read on November 5, 2026.

Teams focused only on agent-to-agent traffic can compare a narrower field in our roundup of the best A2A gateways.

The 8 Best Agent Gateways

The eight agent gateways below are ranked by how completely they govern an agent's full task, from the model call through the tool call to the next agent, and by how much control the team keeps over deployment. Bifrost leads because it handles A2A natively over three bindings with card rewriting, keeps agent, model, and tool grants separate, and links each task to its model and tool calls.

1. Bifrost

Bifrost is an open-source, self-hosted AI gateway that governs model calls, MCP tool calls, and A2A calls between agents through one deployment and one set of virtual keys.

Best for: Bifrost is built for enterprises running mission-critical AI workloads that require top-tier performance, scalability, and reliability. It serves as a centralized AI gateway to route, govern, and secure all AI traffic across models and environments with ultra low latency. Bifrost unifies LLM gateway, MCP gateway, and Agents gateway capabilities into a single platform. Designed for regulated industries and strict enterprise requirements, it supports air-gapped deployments, VPC isolation, and on-prem infrastructure. It provides full control over data, access, and execution, along with strong security, policy enforcement, and governance capabilities.

Figure 3: Agent, model, and tool access are separate grants, and the shared session ID lets Agent Logs show the task, its model calls, and its tool calls together.

• Agent Gateway for A2A. The Agent Gateway registers an agent by its agent card URL, serves a rewritten card that points at Bifrost, and supports JSON-RPC, REST, and gRPC, with different transports allowed on each side.
• Separate grants. Agent access is granted per virtual key, and an agent grant does not authorize the agent's own model or tool calls; Enterprise adds access profiles and projects.
• MCP gateway. Bifrost serves connected tools at a single MCP endpoint filtered per virtual key, supports six upstream auth types including per-user OAuth and token exchange (Enterprise), and bundles tools into Virtual MCPs.
• Code Mode. For agents with large tool sets, Code Mode cuts input tokens by up to 92.8%; the post on 92% lower MCP token costs walks through a 508-tool run.
• Correlated logs. When an agent forwards the caller's key and session headers, Agent Logs group the A2A task with its LLM logs and MCP logs in one session.

Bifrost also routes model calls to 10,000+ models across 25+ providers with budgets, rate limits, and fallbacks, and adds about 11 microseconds of overhead per request at 5,000 RPS on the published benchmarks.

Bifrost runs as a single binary inside the customer's network, in-VPC or air-gapped. The Agent Gateway launch post explains the design.

2. Kong AI Gateway

Kong AI Gateway extends Kong's API gateway to LLM, MCP, and A2A traffic. Version 2.0, released July 10, 2026, replaced plugins with AI entities: AI Models, AI MCP Servers, and AI Agents, managed from a Konnect control plane.

Best for: Organizations already running Kong for API management that want agent traffic under the same platform team.

• A2A: the AI Agent entity handles JSON-RPC and REST bindings, rewrites agent card URLs to the gateway, and added A2A v1.0 alongside v0.3 in 2.0.0.
• MCP: AI MCP Servers aggregate REST and MCP sources with per-tool ACLs, and Token Vault gives each caller its own short-lived upstream credential.
• Identity: AI Auth Strategies use key auth or OIDC, and Kong Identity can issue bearer tokens for A2A traffic.
• Models and limits: load balancing with retry and fallback, token- and cost-based rate limits per consumer, and per-agent limits on A2A.

Kong's guardrails do not apply to MCP traffic. The 2.x entity model runs in hybrid mode with a Konnect control plane, on Dedicated Cloud Gateways, or on-prem from version 2.2 with an Enterprise license, and the A2A and MCP OAuth2 plugins are Enterprise-tier. Teams comparing licensing models can start from Kong AI Gateway alternatives.

3. Amazon Bedrock AgentCore Gateway

Amazon Bedrock AgentCore Gateway is a fully managed AWS service that gives agents one endpoint for tools, other agents, and LLMs. It aggregates MCP targets into a single virtual MCP server and routes model traffic through inference targets.

Best for: Teams building agents on AWS that want a managed entry point integrated with IAM, Bedrock Guardrails, and CloudWatch.

• MCP: tools from OpenAPI, Smithy, Lambda, API Gateway, and existing MCP servers, with semantic tool search and MCP revisions up to 2026-07-28.
• A2A: HTTP passthrough targets with an A2A protocol type forward requests without protocol translation.
• Models: inference targets for Bedrock, OpenAI, and Anthropic, with fallback chains and weighted routes.
• Identity: inbound IAM or JWT; outbound OAuth includes an on-behalf-of token exchange that carries both the user's and the agent's identity.

Rate limits cover tools, models, and tokens per minute, and Cedar policies and Bedrock Guardrails apply across traffic. AgentCore Gateway runs only on AWS (in 22 listed regions, including GovCloud) and is billed per invocation, starting at $0.005 per 1,000 calls.

4. Google Cloud Agent Gateway

Google Cloud Agent Gateway is the policy enforcement point for agents on Gemini Enterprise Agent Platform, governing MCP and A2A interactions with IAM policies and Model Armor. It became generally available on June 18, 2026.

Best for: Teams standardized on Gemini Enterprise Agent Platform and Google Cloud identity.

• Identity: SPIFFE-based agent identities with mTLS and DPoP-bound tokens; IAM policies block all connections unless explicitly granted.
• Registry: Agent Registry is the directory the gateway checks before allowing a connection, with up to 5,000 governed resources per gateway.
• Security: Model Armor screens prompts and tool responses for prompt injection and data leaks.
• Traffic: MCP tool calls over SSE or HTTP and A2A delegation; Gemini Enterprise traffic, including LLM calls, routes through it.

Support for GKE, Cloud Run, and cross-cloud agents is listed as coming soon, as are token budget policies, and semantic governance is in preview. Model routing and fallback are not documented, and usage is billed on Agent Compute.

5. Azure API Management

Azure API Management adds AI gateway capabilities to Microsoft's API platform: token limits, semantic caching, and content safety for model APIs, MCP servers built from REST APIs or proxied from existing servers, and imported A2A agent APIs.

Best for: Microsoft-centric enterprises that already publish APIs through API Management and authenticate with Entra ID.

• Models: load-balanced backend pools with circuit breakers, llm-token-limit for tokens per minute and quotas, semantic caching, and Azure AI Content Safety.
• MCP: REST-to-MCP conversion and passthrough to servers on MCP 2025-06-18 or later, secured with Entra ID OAuth; policies apply to all of a server's tools at once.
• A2A: JSON-RPC A2A APIs only; the agent card is rewritten and other interfaces are removed.

Microsoft has also launched a separate Azure AI Gateway product in public preview (East US 2 and Sweden Central) for models and MCP, which it calls the primary path for its newest AI gateway features; its documentation does not mention A2A. Self-hosted gateways are available on Developer and Premium tiers.

6. Gravitee

Gravitee's Gamma platform, first released June 26, 2026, runs LLM, MCP, and A2A proxies on one AI Gateway runtime with a shared authentication chain, policy chain, and OpenTelemetry tracing across agent, tool, and model hops.

Best for: API platform teams that want agent identity and authorization policy modeled alongside their existing APIs.

• Agent identity: agents are OAuth clients in Gravitee Access Management with JWKS or SPIFFE credentials; RFC 8693 token exchange is an Enterprise feature in APIM 4.13.
• MCP: MCP Studio composes tools from several sources into one server, with tool-level policies and human approval for sensitive calls.
• A2A: the A2A Proxy serves and rewrites the agent card and accepts API key or mTLS plans.
• Models: an LLM Proxy for OpenAI, Anthropic, Gemini, Bedrock, and Vertex AI, with token rate limits and PII filtering.

Gravitee runs self-hosted, hybrid, or as SaaS. In API Management, the A2A Proxy requires the Enterprise Edition with the AI Agent Management pack, and Gravitee's pricing page lists Agent Management from the Planet tier at $2,500 per month.

7. IBM ContextForge

IBM ContextForge is an open-source (Apache 2.0) registry and proxy that federates MCP servers, REST and gRPC APIs, and A2A agents behind one endpoint. Version 1.1.0 shipped on October 20, 2026.

Best for: Teams that want a self-hosted, MCP-first gateway and are comfortable operating an open-source project without published commercial support.

• MCP: virtual servers combine tools, prompts, and resources from several sources, and version 1.1.0 negotiates the 2026-07-28 MCP revision by default.
• A2A: registered agents are exposed to clients as MCP tools, with a JSON-RPC passthrough route added in 1.0.5.
• Models: an OpenAI-compatible chat completions proxy across seven provider types.
• Identity: JWT and SSO sign-in, RBAC by team, and RFC 8693 on-behalf-of token exchange since 1.0.6.

ContextForge ships PII and moderation plugins and per-user rate limits, but documents no token budgets, and OPA policy-as-code is still planned. It deploys through a Helm chart on any Kubernetes cluster.

8. Agent Router

Agent Router, formerly Envoy AI Gateway, is an open-source (Apache 2.0) AI gateway and MCP gateway built on Envoy Gateway. It left the CNCF Envoy project and joined the Agentic AI Foundation on September 10, 2026.

Best for: Kubernetes platform teams already running Envoy Gateway who want open-source model and MCP routing.

• Models: OpenAI- and Anthropic-compatible endpoints across 26 providers, with prioritized fallback.
• MCP: MCPRoute aggregates MCP servers with tool filtering, OAuth with PKCE, and CEL rules on token claims.
• Quotas: QuotaPolicy sets per-model token quotas with cost weights, and usage-based rate limits work per client.
• A2A: a preview that relies on an alpha Envoy filter, supports JSON-RPC only, and does not rewrite agent cards.

Agent Router publishes no built-in guardrails and runs only self-hosted, locally with aigw run or on Kubernetes. The 2026-07-28 MCP revision, token exchange for MCP backends, and a dedicated A2A route type are in progress.

How to Choose an Agent Gateway

Choose by where your agents run and how much of their traffic needs one policy. Teams whose agents all live on one cloud's agent platform can use that cloud's gateway; teams with agents across clouds, frameworks, and data centers need a self-hosted gateway that covers models, MCP, and A2A together.

Figure 4: Where the agents run and how much of their traffic needs one policy decide the shortlist before any feature comparison.

• Agents across clouds and frameworks: a self-hosted gateway with all three paths keeps one key, one budget, and one log trail per task. Bifrost covers this with the AI governance controls teams already use for model traffic.
• Tool-heavy agents: an MCP gateway that filters tools per caller and trims tool definitions matters most; the MCP gateway guide covers the setup.
• Multi-agent systems: A2A agent card handling and per-agent grants decide whether calls between agents are governed at all; our explainer on the A2A agent card shows what a gateway rewrites.
• Single-cloud agent platforms: AgentCore Gateway on AWS or Google Cloud Agent Gateway on Gemini Enterprise Agent Platform keep governance inside that cloud.

For a step-by-step evaluation, see how to choose an agent gateway, and for identity and rollout patterns, revisit the enterprise agent gateway architecture.

Frequently Asked Questions

What is an agent gateway?

An agent gateway is a control point between AI agents and the models, MCP tools, and other agents they call. It authenticates callers and agents, applies access, spend, and rate policies, and logs each call so a task can be traced end to end. An LLM gateway governs model calls only; an agent gateway applies the same policy to tool calls and agent-to-agent calls.

What is the difference between an agent gateway and an MCP gateway?

An MCP gateway governs tool calls made over the Model Context Protocol: which tools a caller sees, how upstream credentials are handled, and how calls are logged. The broader category adds model calls and A2A calls between agents. Bifrost, Kong, Gravitee, IBM ContextForge, and AgentCore Gateway cover both in one product.

Do agent gateways support the A2A protocol?

Most do, at different depths. Bifrost supports JSON-RPC, REST, and gRPC bindings with agent card rewriting; Kong supports JSON-RPC and REST; Azure API Management supports JSON-RPC only. AgentCore Gateway forwards A2A requests without protocol translation, IBM ContextForge exposes agents as MCP tools, and Agent Router's A2A support is a preview.

Is there an open-source agent gateway?

Yes. Bifrost is open source under Apache 2.0 and covers models, MCP tools, and A2A agents in one self-hosted gateway. IBM ContextForge and Agent Router are also Apache 2.0 projects, with MCP-first designs and less complete A2A support. Kong and Gravitee offer self-hosted options, but their agent features require commercial licenses.

How do agent gateways handle agent identity?

They identify the caller, the agent, or both, then pass identity through to tools. Approaches include per-caller virtual keys (Bifrost), OIDC and Kong Identity tokens (Kong), SPIFFE agent identities (Google Cloud, Gravitee), and token exchange that swaps the caller's token for one a downstream tool accepts (AgentCore, Gravitee, IBM ContextForge, Kong Enterprise, and Bifrost Enterprise for MCP).

Can one gateway trace an agent task across models, tools, and agents?

Yes, when the gateway handles all three paths and the agent forwards a shared identifier. Bifrost groups an A2A task with its model and MCP calls through session and correlation headers, and Gravitee traces agent, tool, and model hops with OpenTelemetry. The governance resource page shows how Bifrost ties these logs to access policy.

Govern Agent Traffic with Bifrost

An agent gateway earns its place when one policy covers the model call, the tool call, and the next agent call, and the logs show all three for one task. Bifrost does this in one open-source, self-hosted deployment, with separate grants for agents, models, and tools and session-linked logs across them. To see Bifrost govern your agents, book a demo with the Bifrost team.