Open-Source vs Managed MCP Gateway

TL;DR

• An open-source MCP gateway runs on infrastructure you control, so tool payloads, OAuth tokens, and logs stay inside your network; you also own uptime, upgrades, and scaling.
• A managed MCP gateway moves operations to a vendor, but tool calls and credentials pass through the vendor's cloud, and pricing is usually per call, per gateway, or per user.
• A third model, a vendor-supported deployment inside your own VPC, keeps the data boundary of self-hosting while adding an SLA and vendor support.
• Most managed MCP gateways are tied to one cloud or one network vendor, while open-source gateways such as Bifrost, IBM ContextForge, and ToolHive run on any Kubernetes cluster or VM.
• Bifrost is free and open source under Apache 2.0 and offers an Enterprise tier with clustering, SSO, and in-VPC deployments, so teams can change operating models without changing gateways.

An MCP gateway is the control point between AI agents and the Model Context Protocol servers they call, and the first decision a platform team makes about one is where it runs. Bifrost, the open-source MCP and AI gateway on GitHub built by Maxim AI, is the best choice for enterprises running mission-critical AI workloads that require top-tier performance, scalability, and reliability, and it can be run either way: self-hosted from the free open-source build, or as Bifrost Enterprise inside your own VPC with an uptime SLA. This guide compares the two MCP gateway models on data residency, credentials, cost, and operations.

What Is an MCP Gateway?

An MCP gateway is a single endpoint that sits between MCP clients (coding agents, IDEs, and custom agents) and many MCP servers. It authenticates each caller, decides which tools that caller can see, attaches upstream credentials, and logs every tool call. Because every request crosses it, its location decides where that data lives.

The Model Context Protocol defines how clients and servers exchange tool definitions and calls, including an OAuth-based authorization model for remote servers. It does not define how an organization governs dozens of servers across hundreds of users. That gap is what an MCP gateway fills, and our guide to what an MCP gateway does for production AI agents covers the request path in depth.

Figure 1: Every tool call, credential, and log line passes through the gateway, so where the gateway runs decides where that data lives.

Three operating models exist today:

• Self-hosted open source: you deploy the gateway from public source or images and your team runs it.
• Vendor-hosted (managed): the vendor runs the gateway in its cloud and you configure it through a console or API.
• Managed in your VPC: the gateway runs in your network, and the vendor provides support, maintenance windows, and an SLA.

The OWASP MCP Top 10 lists token mismanagement, privilege escalation through scope creep, and lack of audit logging among the main MCP risks. All three sit at the gateway, which is why the deployment model matters as much as the feature list. The MCP gateway resource page covers how Bifrost addresses each one.

Open-Source vs Managed MCP Gateway at a Glance

The core difference is who holds the data and who holds the pager. An open-source MCP gateway keeps tool traffic, tokens, and logs inside your infrastructure and makes your team responsible for running it. A managed gateway takes over operations but routes that traffic through the vendor's platform.

"Managed" does not always mean SaaS: Kong's hybrid mode and Azure API Management's self-hosted gateway keep the data plane in your network while the control plane stays in the vendor's cloud. And "open source" does not always mean fully free: ToolHive reserves its LLM gateway for a paid edition, and Obot's free Community edition is capped at 100 users and 100 devices. Our list of open-source MCP gateways compared goes project by project.

When a Self-Hosted, Open-Source MCP Gateway Fits

A self-hosted, open-source MCP gateway fits when tool data cannot leave your network, when you need to read or extend the gateway's code, or when you run agents across several clouds and on-prem. It suits teams that already run Kubernetes or VM fleets and can staff upgrades and incident response.

Specific signals that point to self-hosting:

• Regulated data in tool payloads. MCP tools read tickets, databases, and file stores. If those payloads contain PHI, financial records, or source code, a vendor-hosted gateway adds a processor to your compliance scope.
• Private MCP servers. Internal servers that should never be internet-reachable are simpler to govern from inside the same network than through tunnels.
• STDIO servers. Many MCP servers ship as local processes. Cloudflare's MCP server portals state that only remote HTTP MCP servers are supported, so STDIO-only servers have to be wrapped and hosted behind an HTTP endpoint first.
• Multi-cloud or air-gapped estates. A gateway tied to one cloud cannot follow agents into another cloud or a disconnected network.

The cost is operational: your team owns high availability, backups, secret rotation, upgrades, and on-call. Teams evaluating this path for model traffic as well can compare notes with our guide to the best open-source AI gateway for self-hosted deployment.

When a Managed MCP Gateway Fits

A managed MCP gateway fits when agents and tools already live on one cloud or network platform, when speed of rollout matters more than data location, and when no team is available to operate another stateful service. The vendor handles scaling, patching, and availability, and you pay for that in usage fees and reduced control.

Typical managed fits:

• All-in on one cloud. Amazon Bedrock AgentCore Gateway is a fully managed regional AWS service with IAM and JWT inbound auth, and Google Cloud offers Google-hosted remote MCP servers for its own products, with access governed by Google Cloud IAM.
• An existing API platform. Azure API Management adds MCP to its existing API gateway rather than shipping a separate product, so teams already on API Management can expose REST APIs as MCP tools under policies they already run.
• Zero Trust networks. Cloudflare's MCP server portals put many MCP servers behind one endpoint inside Cloudflare Zero Trust, authenticated through Cloudflare Access.

Managed services also come with limits that self-hosted gateways set for themselves. AgentCore Gateway documents default, adjustable limits of 100 targets per gateway, 1,000 tools per target, and 200 tool calls per second at the gateway level. Cloudflare portals accept up to 120 MCP servers per portal and time out upstream tool calls after 60 seconds. When Azure API Management exposes a REST API as an MCP server, its policies apply to all tools in that server rather than per tool, and existing MCP servers it fronts cannot use MCP prompts. For servers that must stay remote either way, our guide to remote MCP server gateways covers connection patterns.

What Each Model Really Costs

An open-source MCP gateway costs infrastructure and engineering time; a managed MCP gateway costs usage fees that grow with traffic, gateways, or users. Neither is free at scale, so compare the total of compute, storage, staff hours, and per-call charges against your expected tool-call volume.

Published managed pricing shows how the units differ:

• AgentCore Gateway: $0.005 per 1,000 tool invocations, $0.025 per 1,000 search calls, and $0.02 per 100 tools indexed per month. AWS's own worked example (50 million searches, 200 million tool calls, and 200 indexed tools) comes to $2,250.04 per month.
• Kong Konnect: $500 per month per Dedicated Cloud Gateway control plane plus $0.15 per GB, or $200 per month per hybrid control plane, with 1 million requests included and $200 per additional million on the Plus plan.
• Azure API Management: hourly units at list price in East US, for example $0.20548 per hour for Basic v2, $0.9589 for Standard v2, and $3.83562 for Premium v2.
• Cloudflare, Google Cloud MCP servers, and Mintive (formerly MintMCP): no MCP-specific prices are published; Mintive quotes per active user.

Self-hosted costs are easier to forget: at least two replicas, a PostgreSQL database, secret management, monitoring, and someone on call. On Bifrost, the open-source build is free under Apache 2.0, and Enterprise is custom-priced with a 14-day trial; see Bifrost pricing for current terms.

Token cost does not depend on the hosting model: agents that load every tool definition into context pay for it on each turn. Bifrost's Code Mode replaces the full tool list with four meta-tools and runs orchestration in a sandbox, which cut input tokens by up to 92.8% and brought a 508-tool run from $377 to $29. The Bifrost MCP gateway post on 92% lower token costs walks through that benchmark.

Open-Source and Managed MCP Gateway Options Compared

Open-source MCP gateways include Bifrost, IBM ContextForge, Microsoft MCP Gateway, Docker MCP Gateway, ToolHive, and Obot. Managed options include AgentCore Gateway, Cloudflare MCP server portals, Azure API Management, Kong Konnect, Google Cloud's managed MCP servers and Apigee, and Mintive. They differ most on license terms, transports, and whether model traffic is covered too.

Microsoft MCP Gateway's latest version requires MCP 2026-07-28 clients and provides no legacy initialization or downgrade, and it authorizes through Entra ID app roles. Obot's free Community edition is capped at 100 users and 100 devices, and its documentation states that air-gapped installations cannot validate a license key yet. All 74 Docker MCP Gateway releases on GitHub are flagged as prereleases. ToolHive offers Cedar policies and RFC 8693 token exchange in open source but reserves its LLM gateway for Stacklok Enterprise. IBM ContextForge shipped v1.1.1 on November 10, 2026, with token-exchange delegation, and has announced that support for its current Admin UI ends on January 27, 2027, in favor of a new UI repository.

On the managed side, Kong's fully self-hosted option is available only through its separate Gateway Enterprise offering, and Google Cloud's Agent Gateway currently works only for agents on Gemini Enterprise Agent Platform. For a ranked view of these tools, see our roundup of the best MCP gateways, and for Docker users, the comparison of Docker MCP Gateway alternatives.

Bifrost as an Open-Source MCP Gateway

Bifrost runs as a self-hosted MCP gateway in your own network, exposing every connected tool through one /mcp endpoint with per-key tool filtering, five upstream authentication types in open source plus token exchange in Enterprise, and Code Mode. The same binary also routes model traffic to 10,000+ models across 25+ providers, so tool calls and model calls share one policy layer.

Figure 2: Identity, tool filtering, upstream credentials, and logs stay on infrastructure you control, whether you run the open-source build or Enterprise.

What the open-source build includes for MCP traffic:

• One endpoint for every client. The MCP gateway endpoint accepts JSON-RPC over POST and SSE over GET at /mcp, and Virtual MCPs serve curated tool bundles at /mcp/<slug>.
• STDIO, HTTP, and SSE. Bifrost connects to MCP servers over all three, and supports MCP protocol versions 2025-06-18, 2025-11-25, and 2026-07-28 (SSE servers use the two 2025 versions), negotiated per connection so clients and servers on different versions still interoperate.
• Deny-by-default tool access. Tool filtering works at the client, request, and virtual key level; a virtual key with no MCP configuration sees no tools except from clients marked Allow by Default.
• Upstream credentials kept in your infrastructure. MCP authentication supports none, static headers, per-user headers, OAuth, per-user OAuth, and token exchange (Enterprise), so each person can reach a server under their own account.
• Explicit execution. Bifrost does not execute tool calls automatically by default; Agent Mode enables auto-execution only for tools you list.

As a single binary, Bifrost starts small: npx, Docker, Kubernetes through the Helm chart, or ECS, Cloud Run, and other platforms listed in the deployment guides. Gateway overhead is about 11 microseconds per request at 5,000 RPS.

Our post on MCP: the protocol, the plumbing, and the gateway explains the design choices behind it.

Moving from Open Source to Managed Without Changing Gateways

Switching operating models usually means switching products. With the Bifrost gateway, teams start on the open-source build, then add Enterprise clustering, identity, and an in-VPC deployment with an SLA, keeping the same /mcp endpoint, virtual keys, and server configuration throughout.

Figure 3: Teams can start on the open-source build and add managed operations later without moving agents to a different gateway.

What Bifrost Enterprise adds on top of the open-source MCP gateway:

• High availability. Clustering forms a leaderless peer-to-peer cluster with gossip-based state sync and zero-downtime rolling deployments.
• Managed operations in your network. In-VPC deployments on AWS, Google Cloud, Azure, and other platforms carry a 99.95% monthly uptime SLA for the gateway and log ingestion pipeline, 24/7 critical support, and 14-day notice for scheduled maintenance.
• Identity-based access. SSO with Okta, Microsoft Entra, Keycloak, or Google Workspace, plus RBAC and access profiles that grant Virtual MCPs to roles and teams through AI governance controls.
• Compliance evidence. HMAC-signable audit logs of administrative activity sit alongside request logs of every tool call, and guardrails apply to both LLM and MCP traffic.

This is the third model from Figure 1: the data boundary of self-hosting, with vendor support and an SLA. Bifrost runs inside your infrastructure in every case, is air-gapped by default, is SOC 2 Type II and ISO 27001 certified, and is HIPAA and GDPR compliant; the Bifrost Enterprise page and the enterprise deployment resource page cover the deployment options.

How to Choose Between Open-Source and Managed MCP Gateways

Two questions settle most MCP gateway decisions: must tool data stay inside your network, and do you have a team to run the gateway around the clock? Data residency decides the network; operating capacity decides who runs the gateway inside it.

Figure 4: Data residency decides the network, and operating capacity decides who runs the gateway inside it.

Before choosing, check:

1. Where upstream tokens are stored, and whether per-user OAuth or token exchange keeps each user's identity intact through the gateway. Our explainer on MCP authentication with OAuth, API keys, and token management covers the patterns.
2. Whether tool access is per tool or per server, and whether it defaults to deny.
3. Which transports and MCP versions are supported, especially STDIO servers and 2026-07-28 clients.
4. Whether the same gateway governs model traffic, so one virtual key carries budgets for both model and tool calls.
5. What happens when you outgrow the plan, including request caps, server limits, and whether moving off the product means re-pointing every agent.

For a deeper look at the request path these checks touch, see our guide to MCP gateway architecture, and for how the hub topic fits together, return to what an MCP gateway is and how production teams use one.

Frequently Asked Questions

What is the difference between an open-source and a managed MCP gateway?

An open-source MCP gateway is software you deploy and operate on your own infrastructure, so tool payloads, upstream tokens, and logs stay inside your network. A managed MCP gateway is run by a vendor in its cloud, which removes operational work but sends tool traffic and credentials through the vendor's platform and usually adds per-call, per-gateway, or per-user fees.

Is a self-hosted MCP gateway more secure than a managed one?

Self-hosting is not secure by default; it is more controllable. A self-hosted gateway keeps data and credentials inside your boundary and can run air-gapped, but your team must patch it, rotate secrets, and monitor it. A managed gateway shifts patching to the vendor while adding a third party to the data path. The right choice depends on your compliance scope and on whether you can staff operations. See MCP gateway security controls for the controls to require either way.

Can I run an MCP gateway in an air-gapped environment?

Yes, with a self-hosted gateway that does not phone home. Bifrost runs as a single binary in fully disconnected environments and sends no telemetry to Maxim AI. Vendor-hosted gateways cannot run air-gapped by definition, and some self-hosted options have limits: Obot's documentation states that air-gapped installations cannot validate a license key yet, and Azure API Management's hybrid self-hosted gateway requires outbound connectivity to Azure.

How much does a managed MCP gateway cost?

Pricing units vary. AgentCore Gateway charges $0.005 per 1,000 tool invocations plus search and indexing fees. Kong Konnect charges per control plane, from $25 per month for serverless to $500 per month for Dedicated Cloud Gateways, plus request and bandwidth charges. Azure API Management bills hourly units. Cloudflare, Google Cloud, and Mintive publish no MCP-specific prices. Compare these against the infrastructure and staff cost of running a gateway yourself.

Do MCP gateways also handle LLM traffic?

Some do. Bifrost, AgentCore Gateway, Azure API Management, Kong AI Gateway, and Obot route model calls as well as MCP tool calls. Docker MCP Gateway and Microsoft MCP Gateway focus on MCP only, and ToolHive keeps its LLM gateway in the paid Stacklok Enterprise edition. One gateway for both lets a single virtual key carry budgets and access rules for model and tool calls together.

Can I start with an open-source MCP gateway and move to a managed one later?

Yes, and the cheapest path is a gateway that offers both, since switching products means reconfiguring servers, re-issuing credentials, and re-pointing every agent. With Bifrost, teams start on the free open-source build and later move to Bifrost Enterprise with clustering, SSO, and in-VPC deployments under an SLA, keeping the same endpoint and configuration model.

Get Started with Bifrost

The open-source vs managed MCP gateway decision comes down to where tool data must live and who will operate the gateway. The Bifrost AI gateway gives teams both answers on one gateway: a free, self-hosted, open-source MCP gateway under Apache 2.0, and Bifrost Enterprise for clustering, identity, and in-VPC deployments with an SLA. To see how Bifrost governs MCP tool calls, model calls, and agent traffic inside your own infrastructure, book a demo with the Bifrost team.