7 Best MCP Gateways

TL;DR

• The best MCP gateways add the identity, tool access control, credential handling, and audit logging that the Model Context Protocol leaves optional to implementations.
• Bifrost governs MCP tool calls, LLM calls, and agent-to-agent traffic in one self-hosted gateway, with six upstream auth types, deny-by-default tool filtering, and Code Mode.
• Code Mode cut input tokens by 92.8% and estimated cost from $377 to $29 on a 508-tool, 16-server benchmark with a 100% pass rate.
• Amazon Bedrock AgentCore Gateway is fully managed on AWS and bills $0.005 per 1,000 invocations; Kong's MCP plugins require AI Gateway Enterprise.
• Docker MCP Gateway, IBM ContextForge, Obot, and Microsoft MCP Gateway are open source, with different deployment models and governance depth.

An MCP gateway is a single endpoint that sits between AI agents and the MCP servers they call, applying identity, tool access rules, credentials, and audit logging to every tool call. The best MCP gateways matter because the Model Context Protocol specification makes authorization optional for implementations, so access control usually has to be added at the gateway. Bifrost, the open source MCP gateway built by Maxim AI, is the best choice for enterprises running mission-critical AI workloads that require top-tier performance, scalability, and reliability. This guide ranks seven MCP gateways using each vendor's documentation, read on November 5, 2026.

What Is an MCP Gateway?

An MCP gateway is a proxy and control layer for Model Context Protocol traffic. Agents connect to one gateway endpoint instead of to each MCP server, and the gateway decides which tools each caller may use, supplies upstream credentials, inspects arguments and results, and records every call.

Figure 1: Every client connects once to the gateway, so tool access, credentials, and audit records live in one place instead of in each developer's config.

Without a gateway, each developer's coding agent or chat app holds its own MCP configuration and its own API tokens for GitHub, Slack, or internal systems, which turns ungoverned MCP servers into a shadow IT risk. A gateway replaces that sprawl with a few controls:

• Identity: every tool call is tied to a key, user, or team.
• Tool access: callers see only the tools they are allowed to run.
• Credentials: upstream tokens are stored once, or per user, at the gateway.
• Inspection: tool arguments and results can be screened before they reach the server or the model.
• Records: every call is logged for audit and cost review.

The guide to what an MCP gateway is covers the architecture in depth, and the comparison of MCP gateways, proxies, and servers separates the three roles.

How We Evaluated the Best MCP Gateways

The best MCP gateways were ranked on seven criteria: identity and access, upstream authentication, tool-level control, inspection of arguments and results, audit and observability, token cost at large tool counts, and deployment model. Coverage beyond MCP, such as LLM and agent-to-agent traffic, was scored as a bonus.

Figure 2: Each check runs before the tool executes, so a blocked tool or a flagged argument never reaches the upstream server.

Security-focused teams can go deeper with the MCP gateways for security and compliance roundup.

The Best MCP Gateways Compared at a Glance

The seven gateways split by deployment model: self-hosted gateways you run on your own infrastructure (Bifrost, ContextForge, Obot, Microsoft MCP Gateway), a fully managed AWS service (AgentCore Gateway), a hybrid platform with a vendor-hosted control plane (Kong), and a developer tool for Docker environments (Docker MCP Gateway).

Figure 3: Start from the scope of governance you need; the platform you already run narrows the rest.

Two cloud platforms also expose MCP without a dedicated gateway product. Cloudflare MCP server portals put up to 80 remote HTTP servers behind one endpoint with Cloudflare Access sign-in, and Azure API Management can expose a REST API as an MCP server with tools only, not MCP resources or prompts. The Cloudflare MCP gateway alternatives guide compares the first with self-hosted options.

1. Bifrost

Bifrost is an open source AI gateway that works as both an MCP client, connecting to upstream MCP servers, and an MCP server, exposing those tools to Claude Desktop, coding agents, and custom agents. Tool calls are suggestions by default; execution needs an explicit API call unless Agent Mode is turned on for specific tools.

Best for: Bifrost is built for enterprises running mission-critical AI workloads that require top-tier performance, scalability, and reliability. It serves as a centralized AI gateway to route, govern, and secure all AI traffic across models and environments with ultra low latency. Bifrost unifies LLM gateway, MCP gateway, and Agents gateway capabilities into a single platform. Designed for regulated industries and strict enterprise requirements, it supports air-gapped deployments, VPC isolation, and on-prem infrastructure. It provides full control over data, access, and execution, along with strong security, policy enforcement, and governance capabilities.

The Bifrost MCP gateway connects to servers over STDIO, HTTP, or SSE, and an OpenAPI connection type (in beta) turns a REST API into an MCP server without custom code. MCP in Bifrost is governed by the same virtual keys and request logs as model traffic.

Figure 4: On a 508-tool, 16-server benchmark, Code Mode cut input tokens by 92.8% and estimated cost from $377 to $29 with the same pass rate.

Top features for MCP traffic:

• Six upstream auth types: MCP authentication covers None, Headers, OAuth 2.0, Per-User OAuth, Per-User Headers, and Token Exchange (Enterprise); per-user credentials are stored against the caller's virtual key or signed-in user.
• Deny-by-default tool filtering: tool filters apply at the client, request, and virtual key levels, and a virtual key that calls a disallowed tool gets a 403 mcp_tool_blocked error.
• Virtual MCPs: Virtual MCPs bundle chosen tools from several servers behind one stable /mcp/<slug> endpoint, available in open source Bifrost.
• Code Mode: Code Mode replaces hundreds of tool schemas with four meta-tools (listToolFiles, readToolFile, getToolDocs, executeToolCode) and runs a Python script in a sandbox, as Figure 4 shows.
• Guardrails on tools: Bifrost Enterprise guardrails can inspect or redact MCP tool arguments and results before execution and after the tool returns.

The same gateway works as an LLM gateway for 10,000+ models across 25+ providers and governs agent-to-agent traffic through the Agent Gateway. Ready-made connection guides for common servers are in the MCP server directory.

The MCP gateway resource hub and the benchmark writeup on 92% lower token costs cover the cost results in detail.

2. Amazon Bedrock AgentCore Gateway

Amazon Bedrock AgentCore Gateway is AWS's fully managed AI gateway. It merges MCP targets into a single virtual MCP server and also routes LLM inference and A2A passthrough traffic, with no infrastructure for the customer to run.

AgentCore Gateway turns several kinds of targets into MCP tools: Lambda functions, API Gateway REST stages, OpenAPI and Smithy definitions, existing MCP servers, integration templates for services such as Salesforce, Slack, and Jira, and connectors such as Managed Knowledge Bases and Step Functions. MCP server targets support spec versions up to 2026-07-28.

• Auth: inbound callers use JWT or IAM; outbound calls to MCP servers use SigV4, OAuth (client credentials, authorization code, or token exchange), or an API key.
• Tool access: interceptors and resource-based policies control which users and agents can call specific tools.
• Tool search: a semantic search tool can be enabled when the gateway is created, in 18 Regions.
• Pricing: $0.005 per 1,000 invocations (ListTools, InvokeTool, Ping), $0.025 per 1,000 searches, and $0.02 per 100 tools indexed per month.
• Limits: dynamic tool listing does not work with semantic search or outbound three-legged OAuth.

AgentCore Gateway fits AWS-centric teams that want a serverless MCP endpoint governed by IAM. The AgentCore Gateway alternatives guide covers teams that need self-hosting or multi-cloud reach.

3. Kong AI Gateway

Kong AI Gateway supports MCP through two surfaces: the AI MCP Proxy plugin for Kong Gateway 3.12 and later, part of the AI Gateway Enterprise offering, and an AI MCP Server entity in AI Gateway 2.x, where Konnect manages the control plane and you run the data planes.

The plugin can pass MCP traffic through, convert REST APIs into MCP tools, or do both. From version 3.13, per-tool ACLs match Kong Consumers or Consumer Groups and write audit entries. A separate AI MCP OAuth2 plugin acts as an OAuth 2.1 resource server that checks token audience and, by default, does not forward tokens upstream.

• Protocol support: AI Gateway 2.x accepts MCP 2025-03-26, 2025-06-18, and 2025-11-25, plus 2026-07-28 from version 2.1.
• Observability: MCP logs record session IDs, JSON-RPC methods, payloads, latencies, and errors.
• Gaps: the plugin does not support guardrails on MCP traffic, and prompt-guard and routing policies do not apply to MCP traffic in 2.x.

Kong fits organizations already running Kong for REST APIs that want MCP on the same platform. Teams weighing self-hosted options without Kong AI Gateway Enterprise can compare the best open source MCP gateways.

4. Docker MCP Gateway

Docker MCP Gateway is an MIT-licensed open source gateway that runs each MCP server as an isolated container. It ships with Docker Desktop's MCP Toolkit and also runs standalone on Docker Engine, including inside Docker Compose.

On each tool call, the gateway starts the server's container with restricted privileges, network, and resources (1 CPU and 2 GB of memory, and no host filesystem access by default), injects credentials, and forwards the request. Requests containing secrets are blocked.

• Catalog: more than 300 verified servers as container images with provenance and SBOMs.
• Credentials: secrets come from Docker Desktop's secret store, and OAuth flows are built in.
• Control: tool allowlists per server or profile, plus call logging with --log-calls.
• Status: the governance tier, part of Docker AI Governance, is invite-only, and recent GitHub releases (v0.44.3 on October 26, 2026) are marked pre-release.

Docker MCP Gateway fits developer teams that want containerized MCP servers on their own machines. The Docker MCP Gateway alternatives guide covers what production teams add on top.

5. IBM ContextForge

IBM ContextForge is an open source registry and proxy that federates MCP, A2A, and REST or gRPC APIs. It is Apache 2.0, built by IBM teams and outside contributors, with optional paid IBM Elite Support; version 1.1.0 shipped on October 20, 2026.

ContextForge converts REST and gRPC services into MCP tools, groups tools into virtual MCP servers, and registers external A2A agents. It also includes an OpenAI-compatible LLM proxy (/v1/chat/completions) with 12 provider types, including OpenAI, Azure OpenAI, Anthropic, Bedrock, and Vertex.

• Access: JWT is the primary auth, with token scoping followed by RBAC roles such as platform_admin, team_admin, and developer.
• SSO: tutorials cover Entra ID, Okta, Keycloak, Google, GitHub, and ADFS.
• Deployment: PyPI, a container image, or a Helm chart from a local clone, with guides for AWS, Azure, Google Cloud, and OpenShift.
• Limits: arm64 is not supported in production.

ContextForge fits platform teams that want a free, self-hosted federation layer and can run it themselves. The open source MCP gateways for self-hosted infrastructure roundup compares it with other self-hosted options.

6. Obot MCP Gateway

Obot is an MIT-licensed MCP platform that combines a gateway, a catalog, and server hosting. Every edition runs the same open source code from the same container image; editions differ only by license key, and the free Community edition covers up to 100 users and 100 devices.

Obot hosts npx, uvx, and containerized MCP servers as Docker containers or Kubernetes workloads, turns OpenAPI schemas into servers, and applies domain egress rules. Virtual MCP servers combine hosted and remote servers behind one endpoint, with filters on requests and responses.

• Access: per-user or identity-provider-group access through profiles, with SCIM provisioning from Okta.
• Catalog: Git-backed catalogs exposed through the standard MCP Registry API.
• LLM gateway: routes OpenAI, Anthropic, Bedrock, and Azure models with scoped keys and access policies.
• Audit: logs correlate MCP, LLM, workload, and device activity, with scheduled export.

Kubernetes with Helm is the production path; the Docker install is for evaluation. The Obot MCP gateway alternatives guide compares it in detail.

7. Microsoft MCP Gateway

Microsoft MCP Gateway is an MIT-licensed reverse proxy and management layer for MCP servers on Kubernetes. A data plane routes requests and a control plane deploys and deletes MCP servers, which Microsoft calls adapters.

Routing is stateless: each request carries its protocol metadata and is authorized on its own. The gateway requires clients and adapters that speak MCP 2026-07-28, with no fallback to legacy initialization. Tools are registered through POST /tools with a container image and a tool definition.

• Auth: Entra ID bearer tokens, with app roles (requiredRoles) granting access per adapter and per tool; a development mode runs without authentication.
• Deployment: StatefulSets on Kubernetes, with a one-click Azure path that provisions AKS, Container Registry, Cosmos DB, and Application Insights.
• Maturity: the repository has one tag (v1.0.0) and no GitHub releases, and its agent sessions feature is limited to a single replica.

Microsoft MCP Gateway fits Azure teams standardized on Entra ID and Kubernetes. For the protocol background, see the MCP gateway explainer.

Frequently Asked Questions

Do I need an MCP gateway?

You need an MCP gateway once more than a few people or agents share MCP servers. Without one, every client stores its own server list and tokens, nobody can restrict individual tools, and there is no central record of tool calls. A gateway adds identity, tool-level access, credential storage, and audit logs in one place.

What is the difference between an MCP gateway and an MCP server?

An MCP server exposes tools, such as GitHub actions or database queries, to an MCP client. An MCP gateway sits in front of many MCP servers, presents them to clients as one endpoint, and adds access control, credential handling, inspection, and logging. A gateway acts as a server to agents and as a client to upstream servers.

Is there an open source MCP gateway?

Yes. Bifrost (Apache 2.0 core), Docker MCP Gateway (MIT), IBM ContextForge (Apache 2.0), Obot (MIT), and Microsoft MCP Gateway (MIT) are all open source. Bifrost, ContextForge, and Obot also handle LLM traffic, and Bifrost and ContextForge also register A2A agents, so the scope of governance differs more than the license.

How does an MCP gateway handle authentication?

An MCP gateway handles two kinds of authentication: callers authenticating to the gateway, and the gateway authenticating to upstream servers. Bifrost supports six upstream auth types, including per-user OAuth, which stores each user's token against their identity, and Token Exchange on Enterprise, which exchanges each caller's identity-provider token, caches it in memory until shortly before it expires, and never stores it. The MCP authentication solutions roundup compares approaches.

Does AWS have an MCP gateway?

Yes. Amazon Bedrock AgentCore Gateway is AWS's managed gateway; it turns Lambda functions, OpenAPI definitions, API Gateway stages, and MCP servers into one virtual MCP server, billed at $0.005 per 1,000 invocations. Teams that need self-hosting can run Bifrost on EKS or ECS instead.

How do MCP gateways reduce token costs?

Most MCP clients send every tool's schema to the model on each turn, so token cost grows with the tool count. Bifrost Code Mode exposes four meta-tools instead and lets the model load only the tool stubs it needs; on a 508-tool benchmark it cut input tokens by 92.8% and estimated cost from $377 to $29, as the Code Mode token cost analysis explains.

Get Started with Bifrost as Your MCP Gateway

Among the best MCP gateways, Bifrost governs MCP tool calls, LLM calls, and agent-to-agent traffic under one set of keys and logs, adds budgets on model traffic, and runs inside your own infrastructure. The MCP gateway resource page shows deployment options, and the Enterprise page covers SSO and compliance. To see Bifrost with your MCP servers, book a demo with the Bifrost team.