MCP Gateway

A comparison of five MCP governance tools by the layer each one governs and whether it enforces policy on every device in the fleet.

TL;DR * To add an MCP server to Claude Code, register it with the claude mcp add command or a project .mcp.json file, choosing a local, project, or user scope for where it applies. * Native Claude Code configuration handles connecting a server; it does not enforce which teammates can

TL;DR * MCP server authentication requires every remote MCP server to act as an OAuth 2.1 resource server and to reject any access token that was not issued specifically for it. * Token passthrough is explicitly forbidden by the MCP specification, so an agent cannot forward its own provider token

TL;DR * Codex reads MCP server definitions from a local config.toml file, so Codex MCP access is configured per machine rather than per organization. * An MCP gateway gives Codex one endpoint that aggregates every approved MCP server and applies authentication, tool filtering, and audit logging in one place instead

Figma MCP access gives Claude Code read and write reach into design files. Bifrost governs which developers get which tools. The Figma MCP server no longer only reads design files: since the Code to Canvas release, agents connected to it can create and modify native Figma content, including frames, components,

MCP governance is the policy layer deciding which identity may see, run, and pay for which MCP tool. Bifrost enforces all of it at one control point. MCP governance is the set of controls that determine which identity may discover, invoke, and pay for which Model Context Protocol tool, and