TL;DR
- The best MCP gateways for routing and access control in 2026 are Bifrost, Kong AI Gateway, Docker MCP Gateway, Microsoft MCP Gateway, and AWS AgentCore Gateway.
- An MCP gateway is the control layer between AI agents and MCP servers that decides which tools an agent sees, which server handles each call, and which credentials that call uses.
- Bifrost is the only gateway on this list that is open source, self-hostable, and routes both LLM traffic and MCP tool traffic through one set of virtual keys, budgets, and rate limits.
- Tool-level access control varies widely: some gateways filter per tool and per key, while others authorize at the server or route level and leave tool scoping to separate policy work.
- Code Mode in Bifrost cut input tokens by up to 92.8% in a benchmark with 508 tools across 16 MCP servers, which matters once an agent connects to more than a few servers.
MCP gateways route agent tool calls to the right MCP server and enforce who is allowed to call which tool, and choosing among the best MCP gateways now depends on how much of that routing and control is built in rather than assembled from plugins. Bifrost, the open-source MCP and LLM gateway written in Go and built by Maxim AI, is the best choice for enterprises running mission-critical AI workloads that require best-in-class performance, scalability, and reliability. This comparison covers five gateways, how each one routes tool traffic, and where each one places access control.
What Is an MCP Gateway?
An MCP gateway is a single entry point between AI agents and Model Context Protocol servers that centralizes tool discovery, request routing, authentication, and policy enforcement. Instead of configuring each agent against each server, teams point agents at the gateway, and the gateway decides which tools are exposed and where each call goes.
The Model Context Protocol defines how clients and servers exchange tools, resources, and prompts. It does not define an organization-wide layer for deciding which agent may call which tool, how credentials are shared, or how usage is capped. That gap is what an MCP gateway fills. For a longer treatment of the architecture, see this guide to MCP gateways for production AI agents.
Routing and control are the two functions that separate a gateway from a simple forwarder:
- Routing decides which upstream server, container, or tool target receives a call, and whether the session sticks to one instance.
- Control decides whether the call is allowed at all: which tools are visible, which identity executes them, and what budget or rate limit applies.
A component that only forwards traffic without these decisions is closer to a proxy. The distinction is covered in detail in MCP gateway vs MCP proxy vs MCP server.
How We Evaluated the Best MCP Gateways
The five gateways in this list were assessed on the routing and control capabilities that platform teams report needing once agents move into production. Each criterion below maps to a specific failure mode: agents seeing tools they should not, credentials shared across users, or runaway tool loops with no budget ceiling.
| Criterion | What it covers | Why it matters for routing and control |
|---|---|---|
| Tool-level filtering | Allow-lists per tool, per client, per key, or per request | Limits the tool catalog each agent can see and execute |
| Identity-aware authentication | Server-level credentials, per-user OAuth, token exchange | Ensures calls run under the right identity, not a shared service account |
| Routing model | Server routing, session affinity, tool routers, LLM provider routing | Determines how calls reach upstream servers and how failures are handled |
| Budgets and rate limits | Spend caps and request limits at key, team, or customer level | Caps cost and prevents agent loops from exhausting quotas |
| Deployment model | Open source, self-hosted, managed, in-VPC | Decides where tool traffic and credentials live |
| LLM and MCP in one layer | Whether model calls and tool calls share one policy plane | Avoids running two gateways with two sets of keys and policies |
This framework follows the same logic as the broader MCP governance model: visibility, access, identity, and cost controls enforced at one layer.
Best MCP Gateways Compared at a Glance
The table below summarizes how the best MCP gateways handle routing and control. Cells marked "Not published" indicate that the vendor's public documentation did not describe the capability at the time of writing. Bifrost is the only entry that combines tool-level filtering per key, per-user authentication, and LLM provider routing in one open-source gateway.
| Gateway | Deployment | Tool-level access control | Authentication model | Routing approach | LLM routing in same layer |
|---|---|---|---|---|---|
| Bifrost | Open source, self-hosted, in-VPC, clustered (enterprise) | Client, request, and virtual key filtering; Virtual MCPs | None, Headers, OAuth 2.0, Per-User OAuth, Per-User Headers, Token Exchange | Tool discovery and injection across STDIO, HTTP, SSE servers | Yes, 25+ providers |
| Kong AI Gateway | Self-hosted or Konnect | ACLs on consumers and consumer groups | Kong authentication plugins such as OpenID Connect and Key Auth | MCP Proxy plugin on Kong routes and services | Separate AI plugins |
| Docker MCP Gateway | Local or self-hosted via Docker CLI plugin | Server selection through profiles | Docker Desktop secrets and built-in OAuth flows | One gateway endpoint in front of containerized servers | Not published |
| Microsoft MCP Gateway | Self-hosted on Kubernetes, Azure deploy option | Entra ID app roles on adapters and tools | Entra ID bearer tokens | Session-aware routing and a tool gateway router | Not published |
| AWS AgentCore Gateway | Fully managed on AWS | Fine-grained access control and gateway rules | Managed ingress and egress authentication | Targets from APIs, Lambda, OpenAPI, Smithy; semantic tool search | Model-based routing across providers |
1. Bifrost
Bifrost is an open-source AI gateway that acts as both an MCP client and an MCP server, so it connects to upstream tool servers and exposes a governed tool catalog to agents from the same process. Bifrost routes LLM requests and MCP tool calls through one policy layer built on virtual keys, with 11 microseconds of overhead at 5,000 RPS in sustained benchmarks.
The Bifrost AI gateway connects to MCP servers over STDIO, HTTP, or SSE with automatic retry and exponential backoff for transient failures. Discovered tools are injected into model requests without application code changes, and the full MCP feature set is documented in the MCP overview.
How Bifrost routes and filters tools
Tool access in Bifrost is controlled at three stacked filtering levels. A tool must pass all applicable levels before an agent can see it:
-
Client configuration: the
tools_to_executefield on each MCP client sets the baseline, and an empty list means no tools are available (deny-by-default). -
Request headers:
x-bf-mcp-include-clientsandx-bf-mcp-include-toolsnarrow the catalog for a single request. - Virtual key configuration: each virtual key carries a strict allow-list of MCP clients and tools, and the key can only narrow a request's tool list, never widen it.
Virtual MCPs bundle selected tools from one or more servers into a single endpoint at /mcp/<slug>, reachable only through the virtual keys attached to it. A customer-facing agent can receive a read-only Virtual MCP while an internal operations agent receives a broader one, with both enforced by the gateway rather than by agent code. Per-key MCP tool filtering is also re-checked at execution time, and inactive or expired keys are rejected with a 403.
Identity, execution, and cost control
Bifrost supports six MCP authentication types: None, Headers, OAuth 2.0, Per-User OAuth, Per-User Headers, and Token Exchange. Per-user modes store each end user's credential against their identity, so a GitHub or Notion tool call runs with that user's permissions. Token Exchange exchanges the caller's identity-provider token on each call without persisting it, and is an enterprise capability.
Tool calls returned by a model are not executed automatically by default. Execution requires an explicit API call, and Agent Mode enables auto-execution only for tools listed in tools_to_auto_execute. Budgets and rate limits apply hierarchically across customers, teams, virtual keys, and provider configs, so a misbehaving agent hits a ceiling instead of an open quota.
LLM routing in the same control plane
The same virtual keys that scope MCP tools also scope model access. Governance routing sets allowed providers, models, and weights per key, while CEL-based routing rules make runtime decisions scoped from virtual key to team, customer, and global levels.
Retries and fallbacks move a request to the next provider when the primary fails, across 25+ providers and 10,000+ models.
For agents connected to many servers, Code Mode exposes four meta-tools and lets the model write Python (Starlark) to orchestrate tools in a sandbox. In a benchmark across 508 tools on 16 servers, Code Mode reduced input tokens by 92.8% and estimated cost by 92.2% with a 100% pass rate. The MCP gateway benchmark writeup covers the method, and how Code Mode works in Bifrost walks through the meta-tools.
Best for: Bifrost is built for enterprises running mission-critical AI workloads that require best-in-class performance, scalability, and reliability. It serves as a centralized AI gateway to route, govern, and secure all AI traffic across models and environments with ultra low latency. Bifrost unifies LLM gateway, MCP gateway, and Agents gateway capabilities into a single platform. Designed for regulated industries and strict enterprise requirements, it supports air-gapped deployments, VPC isolation, and on-prem infrastructure. It provides full control over data, access, and execution, along with robust security, policy enforcement, and governance capabilities.
2. Kong AI Gateway
Kong AI Gateway extends the Kong API gateway to MCP through the AI MCP Proxy plugin, which translates between MCP and HTTP so MCP clients can reach upstream MCP servers or existing REST APIs through Kong. Routing and control come from Kong's existing plugin model applied to MCP traffic.
The AI MCP Proxy plugin requires Kong Gateway 3.12 or later and is part of Kong's AI Gateway Enterprise offering. Its mode setting determines whether it proxies MCP requests to an upstream server, converts RESTful APIs into MCP tools, or exposes grouped tools as an MCP server.
Control is applied through standard Kong plugins:
- Authentication: OpenID Connect or Key Auth attached to MCP routes
- Rate limiting: Rate Limiting or Rate Limiting Advanced for MCP request volume
- Access control: ACLs on consumers and consumer groups, including on aggregated MCP servers
- Observability: logging and tracing plugins on MCP request and response traffic
Kong documents that the AI MCP Proxy plugin runs in the MCP request flow rather than the LLM request flow, and should not be configured alongside other AI plugins on the same service or route. Teams that want model routing and tool routing governed by one key model will be configuring two separate plugin chains. The comparison of how MCP tools are discovered, invoked, and access-controlled explains why that separation matters for audit and budgeting.
Best for: Organizations already running Kong Gateway for API management that want to place MCP traffic behind the same authentication, rate limiting, and ACL plugins.
3. Docker MCP Gateway
Docker MCP Gateway runs MCP servers as isolated Docker containers and presents them to clients through one gateway endpoint. It ships as the docker mcp CLI plugin that powers the MCP Toolkit in Docker Desktop, and it can also run independently of Desktop.
Routing in Docker MCP Gateway is organized around profiles. A profile groups MCP servers from the Docker MCP Catalog, OCI images, the MCP Registry, or local files, and can be connected to clients such as Cursor or VS Code. Multiple clients connect to the same gateway configuration, and the gateway supports sse and streaming transports for serving more than one client.
Control features documented in the project include:
- Container isolation: each local server runs in its own container with minimal host privileges
- Secrets management: API keys and credentials handled through Docker Desktop instead of environment variables
- OAuth flows: built-in flows for servers that need OAuth access tokens
- Monitoring: logging and call tracing for tool calls
Docker's model focuses on server lifecycle and isolation. Per-user identity, per-key tool allow-lists, and spend budgets are not described in its public documentation, so teams that need those controls typically place another governance layer in front. Patterns for adding per-user identity are covered in OAuth 2.1 patterns for agent tool access.
Best for: Developer teams already standardized on Docker that want containerized MCP servers with a curated catalog and consistent client configuration.
4. Microsoft MCP Gateway
Microsoft MCP Gateway is an open-source reverse proxy and management layer for MCP servers running on Kubernetes. It provides session-aware routing, authorization, and lifecycle management, with a control plane for deploying MCP servers and a data plane for routing traffic to them.
Routing is the project's central feature. MCP servers are registered as adapters and reached at /adapters/{name}/mcp, and session-aware stateful routing sends every request with a given session ID to the same server instance. A separate tool gateway router, served at /mcp, routes tool execution requests to registered tool servers based on each tool's definition, with multiple router instances behind the gateway for availability.
Access control uses Microsoft Entra ID:
- Read access goes to the resource creator, principals holding configured roles, and the
mcp.adminrole. - Write access is limited to the resource creator and
mcp.admin. - A management portal lists adapters and tools filtered to what the signed-in user may see.
The authorization model applies at the adapter and tool resource level through Entra app roles. Budgets, rate limits, and LLM provider routing are not part of the published feature set, and an opt-in agents subsystem is labeled preview and single-replica. The trade-offs between server-level and tool-level scoping are examined in governing LLM and MCP traffic with virtual keys.
Best for: Kubernetes-first teams on Azure that need session-affinity routing to stateful MCP servers and already manage identity in Entra ID.
5. AWS AgentCore Gateway
Amazon Bedrock AgentCore Gateway is a fully managed gateway that converts APIs, Lambda functions, and existing services into MCP-compatible tools and exposes them through one endpoint. It also fronts other agents through passthrough targets and routes inference requests across model providers.
AgentCore Gateway accepts OpenAPI, Smithy, and Lambda as tool input types and offers one-click integrations for common SaaS tools. For routing at scale, it provides semantic tool selection so agents can search a large tool collection for the most relevant tools instead of loading every definition.
Control in AgentCore Gateway is centered on managed authentication:
- Ingress authentication verifies agent identity through OAuth.
- Egress authentication injects the right credential for each target tool.
- Fine-grained access control and gateway rules are configurable per gateway.
- Observability and auditing are built into the managed service.
The service runs only on AWS, so tool traffic and credentials stay inside AWS infrastructure rather than in a self-hosted or on-prem environment. For teams comparing managed and self-hosted options, the MCP gateway resource page outlines what self-hosting a gateway changes for data residency.
Best for: Teams building agents on AWS that want a serverless gateway to turn Lambda functions and existing APIs into MCP tools without running gateway infrastructure.
Open Source MCP Gateway vs Managed Service
An open source MCP gateway runs inside infrastructure the team controls, while a managed service trades that control for zero operations. The choice decides where tool credentials, call logs, and policy state live, which is often the deciding factor in regulated environments.
| Factor | Open source, self-hosted (Bifrost, Docker, Microsoft) | Managed (AWS AgentCore Gateway) | Plugin on existing API gateway (Kong) |
|---|---|---|---|
| Where credentials and logs live | Team's own network, including in-VPC or air-gapped | Provider's cloud | Wherever the Kong deployment runs |
| Operational effort | Team runs and scales the gateway | Provider runs it | Added to an existing Kong estate |
| Policy portability | Configuration owned by the team | Tied to the provider's service | Tied to Kong's plugin model |
| Licensing | Open source core | Usage-based service | Enterprise license for the MCP plugin |
Bifrost reduces the operational side of self-hosting with clustering for high availability and in-VPC deployments with no public network egress. The Bifrost Enterprise tier adds these on top of the open-source gateway without changing its APIs.
Routing and Control Gaps to Watch in MCP Governance
Most MCP governance gaps appear when routing and control are split across layers. A gateway may route tool calls correctly while authorization happens at the server level, budgets live in a separate LLM gateway, and audit records sit in a third system. These gaps show up during production incidents rather than during evaluation.
Common gaps to test before committing to one of the best MCP gateways:
- Server-level instead of tool-level scoping: granting access to an MCP server usually grants every tool on it, including write and delete operations.
- Shared service credentials: a single OAuth token for a tool means every agent call runs with the same permissions, which breaks per-user audit trails. The MCP authorization specification defines OAuth-based flows for HTTP transports that gateways can build on.
- Split policy planes: separate keys for model calls and tool calls mean two budgets, two sets of rate limits, and two audit trails for one agent.
- Context bloat from large catalogs: loading every tool definition into each request increases tokens and cost as server count grows.
- Auto-execution by default: gateways that execute any tool call a model returns remove the approval step for destructive operations.
Bifrost addresses each of these at one layer, with governance controls documented on the Bifrost governance resource page. The broader cluster article on production MCP gateway architecture shows where each control sits in the request path.
Frequently Asked Questions
What is a MCP gateway?
An MCP gateway is a central layer between AI agents and Model Context Protocol servers. It handles tool discovery, routes each tool call to the correct server, applies authentication, and enforces policies such as tool allow-lists, rate limits, and budgets. Agents connect to one endpoint instead of configuring every MCP server individually.
What is the difference between an MCP proxy and an MCP gateway?
An MCP proxy forwards MCP traffic between a client and a server, usually for transport bridging or network reachability. An MCP gateway adds decisions on top of forwarding: which tools each caller can see, which identity executes a call, where the call is routed, and what usage limits apply. Bifrost operates as a gateway, filtering tools per virtual key.
What are the key differences between an MCP gateway and an API gateway?
An API gateway manages HTTP or gRPC requests to services using routes, methods, and consumers. An MCP gateway understands MCP semantics: tools, tool schemas, sessions, and tool calls returned by a model. That allows an MCP gateway to filter individual tools, inject tool definitions into model requests, and control whether a model-requested tool call executes.
How to create a MCP gateway?
The fastest route is deploying an existing open-source gateway rather than building one. With Bifrost, teams start the gateway, register MCP servers over STDIO, HTTP, or SSE, set tools_to_execute on each client, and attach tool allow-lists to virtual keys. Agents then point at Bifrost, and tool discovery, filtering, and authentication happen at the gateway.
Is there an open source MCP gateway with tool-level access control?
Yes. Bifrost is an open-source MCP gateway with tool-level access control across client configuration, request headers, and virtual keys, plus Virtual MCPs that bundle selected tools behind a single endpoint. Docker MCP Gateway and Microsoft MCP Gateway are also open source, with access control applied at the profile level and the Entra ID resource level respectively.
How do MCP gateways reduce token costs for large tool catalogs?
Large tool catalogs inflate every request because each tool definition is sent to the model. Gateways reduce this by narrowing the catalog per request, searching tools semantically, or changing how tools are invoked. Bifrost Code Mode exposes four meta-tools and loads definitions on demand, cutting input tokens by up to 92.8% at 508 tools.
Try Bifrost for MCP Routing and Access Control
Among the best MCP gateways for routing and access control, Bifrost is the one that puts tool filtering, per-user authentication, budgets, and LLM provider routing behind a single set of virtual keys in an open-source gateway teams can run in their own environment. To see how Bifrost governs agent tool access and model traffic together at production scale, book a demo with the Bifrost team.
