# Best enterprise Model Context Protocol (MCP) gateway providers compared

> Compare 10 enterprise MCP gateways on self-hosted and air-gapped deployment, per-tool access control and rate limits, MCP spec versions, REST-to-MCP and audit.

This guide compares ten enterprise MCP gateways: Tyk, Amazon Bedrock AgentCore Gateway, Composio, IBM ContextForge, Kong AI Gateway, Portkey, TrueFoundry, Docker MCP Gateway, MintMCP and Obot. For self-managed or air-gapped infrastructure, shortlist Tyk (an MCP gateway built into Tyk Gateway since 5.13, with a documented offline installation) and IBM ContextForge (Apache-2.0); on AWS, Amazon Bedrock AgentCore Gateway is the managed option. The table below compares deployment, licence, per-tool access, per-tool rate limits and REST-to-MCP support, checked on 30 October 2026. For how MCP clients get and use tokens, see [MCP OAuth: authorization, scopes and token exchange](https://tyk.io/learning-center/mcp-authorization-oauth/). [Tyk installation](https://tyk.io/docs/api-management/air-gapped-deployment), [ContextForge documentation](https://ibm.github.io/mcp-context-forge/latest/), [AgentCore overview](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html).

Last updated: 30 October 2026

This comparison covers ten providers and separates four decisions: where the system runs, who may invoke each tool, how usage is limited, and which MCP/API paths are supported. Start with the constraints that could disqualify a product, then test the remaining options against the same workload.

Disclosure and method: Tyk publishes this guide and is included in the comparison. Findings come from vendor documentation, release notes and source repositories checked on 30 October 2026. We did not run performance benchmarks or certify protocol conformance. “Best fit” is our interpretation of the cited capabilities. Not documented means we did not find a supporting primary source; it does not mean the capability is impossible or absent.

## How do the 10 enterprise MCP gateways compare?

Read the licence column as applying to the named component. An SDK licence does not establish the licence of its hosted platform. Likewise, selecting tools, authorizing their execution and assigning independent rate counters are separate capabilities.

| Provider | Deployment and air-gap boundary | Source/licence boundary | Tool access | Tool rate limits | Existing APIs as MCP tools |
|---|---|---|---|---|---|
| Tyk | Self-managed; offline installation documented. [Guide](https://tyk.io/docs/api-management/air-gapped-deployment) | Gateway MPL-2.0; commercial Enterprise additions. [Repository](https://tyk.io/docs/tyk-oss-gateway) | Tools, resources, prompts and JSON-RPC methods. [Policies](https://tyk.io/docs/ai-management/mcp-gateway/policies) | Per primitive and method. [Policies](https://tyk.io/docs/ai-management/mcp-gateway/policies) | Tyk Gateway: Enterprise, 5.15+, Tyk OAS APIs. [Requirements](https://tyk.io/docs/ai-management/mcps/api-to-mcp) |
| Amazon Bedrock AgentCore Gateway | Managed AWS service. [Overview](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html) | Managed service, not a distributed OSS gateway. [Overview](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html) | Interceptors and declarative tool policies. [Interceptors](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-fine-grained-access-control.html), [policies](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-core-concepts.html) | toolName dimensions. [Limits](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-rate-limits-dimensions.html) | OpenAPI, Smithy and Lambda targets. [Overview](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html) |
| Composio | Cloud; Enterprise VPC/self-hosting. Air gap: not documented. [Deployment](https://docs.composio.dev/docs/security/token-custody) | Platform OSS licence: not documented. [Self-hosting](https://docs.composio.dev/docs/self-hosting) | Session allowlists and denylists. [Configuration](https://docs.composio.dev/docs/configuring-sessions) | Not documented; organisation API limits are documented. [Limits](https://docs.composio.dev/reference/v3/rate-limits) | Automatic OpenAPI conversion: not documented. [Custom tools](https://docs.composio.dev/docs/extending-sessions/custom-tools-and-toolkits) |
| IBM ContextForge | Containers/Kubernetes; offline container/UI options. [Docs](https://ibm.github.io/mcp-context-forge/latest/), [README](https://github.com/IBM/mcp-context-forge#readme) | Apache-2.0. [Licence](https://ibm.github.io/mcp-context-forge/latest/) | Visibility, team scope and execution RBAC. [Authorization](https://ibm.github.io/mcp-context-forge/latest/howto/rbac-tool-authorization/) | by_tool policy mapping. [Plugin](https://ibm.github.io/mcp-context-forge/latest/api/plugin-bindings-api/) | REST adapter. [Overview](https://ibm.github.io/mcp-context-forge/latest/) |
| Kong AI Gateway | Self-hosted plugin path; hosted Konnect entity control plane. Complete MCP air gap: not documented. [On-premises](https://developer.konghq.com/ai-gateway/configure-on-prem/), [architecture](https://developer.konghq.com/ai-gateway/architecture/) | AI MCP Proxy requires AI Gateway Enterprise. [Plugin](https://developer.konghq.com/plugins/ai-mcp-proxy/) | Tool ACLs and filtered discovery. [Plugin](https://developer.konghq.com/plugins/ai-mcp-proxy/) | Server/client policies documented; native tool-name counters not documented. [Policy](https://developer.konghq.com/ai-gateway/policies/rate-limiting-advanced/) | REST conversion modes. [Plugin](https://developer.konghq.com/plugins/ai-mcp-proxy/) |
| Portkey | SaaS/hybrid; no new fully air-gapped deployments. [Options](https://portkey.ai/docs/product/product-feature-comparison) | AI Gateway repo: MIT; MCP platform OSS scope not documented. [Licence](https://github.com/Portkey-AI/gateway/blob/main/LICENSE), [README](https://github.com/Portkey-AI/gateway#readme) | Per-user tool provisioning. [MCP](https://portkey.ai/docs/product/mcp-gateway) | Tool-level throttling. [MCP](https://portkey.ai/docs/product/mcp-gateway) | Generic conversion: not documented. [MCP](https://portkey.ai/docs/product/mcp-gateway) |
| TrueFoundry | SaaS/self-hosted; offline installation guide, with external-service caveats. [Options](https://www.truefoundry.com/docs/ai-gateway/modes-of-deployment), [FAQ](https://www.truefoundry.com/docs/platform/deploy-control-plane-faq) | Self-hosted licensing documented; OSS gateway licence not documented. [Options](https://www.truefoundry.com/docs/ai-gateway/modes-of-deployment) | User/team/virtual-account tool permissions. [Security](https://www.truefoundry.com/docs/ai-gateway/mcp/mcp-gateway-auth-security) | Independent server:tool overrides. [Limits](https://www.truefoundry.com/docs/ai-gateway/ratelimiting-v2) | OpenAPI-generated tools. [Overview](https://www.truefoundry.com/docs/ai-gateway/mcp/mcp-overview) |
| Docker MCP Gateway | Local/independent Docker operation; complete air gap not documented. [Repository](https://github.com/docker/mcp-gateway) | Standalone gateway: MIT. [Licence](https://github.com/docker/mcp-gateway/blob/main/LICENSE) | Profile tool selection. [Repository](https://github.com/docker/mcp-gateway) | Not documented. [CLI](https://docs.docker.com/reference/cli/docker/mcp/gateway/run/) | Built-in conversion: not documented. [Gateway](https://docs.docker.com/ai/mcp-catalog-and-toolkit/mcp-gateway/) |
| MintMCP / Mintive | Managed cloud; self-hosting by discussion. Air gap: not documented. [Deployment](https://www.mintive.com/docs/intro) | OSS gateway licence: not documented. [Introduction](https://www.mintive.com/docs/intro) | Role-specific virtual MCP tool sets. [RBAC](https://www.mintive.com/docs/rbac) | Selected tools share counters; available on request. [Limits](https://www.mintive.com/docs/gateway-rate-limits) | Generic conversion: not documented. [Custom servers](https://www.mintive.com/docs/mcp-connectors-custom) |
| Obot | Self-hosted/cloud; new licence keys cannot validate offline. [Editions](https://docs.obot.ai/enterprise/overview/), [network](https://docs.obot.ai/installation/network-requirements/) | MIT source across editions; keys gate entitlements. [Editions](https://docs.obot.ai/enterprise/overview/) | Server/tool permissions by user or IdP group. [Overview](https://docs.obot.ai/) | Per-tool counters: not documented. [Configuration](https://docs.obot.ai/configuration/server-configuration/) | OpenAPI import and hosted wrapper. [Hosting](https://docs.obot.ai/concepts/mcp-hosting/) |

Protocol versions and observability are covered below because compatibility can differ between pass-through servers, generated tools and a gateway’s own internal client.

This table compares MCP gateways. If you are replacing Portkey, see our [Portkey self-hosted alternative](https://tyk.io/learning-center/portkey-self-hosted-alternative/) guide; for LLM traffic gateways, see [LiteLLM alternatives for self-hosted LLM gateways](https://tyk.io/learning-center/litellm-alternatives/).

## What does an MCP gateway do?

An MCP gateway provides a controlled entry point between MCP clients and tool servers. Products can authenticate callers, enforce permissions, handle upstream credentials and record tool requests. Some also convert existing APIs into MCP tools. The gateway function is demonstrated by both [AgentCore’s target model](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-core-concepts.html) and [Portkey’s proxy model](https://portkey.ai/docs/product/mcp-gateway).

An MCP server supplies tools, resources or prompts. A registry helps users discover available servers. A gateway governs traffic flowing through it. Products can combine these roles: ContextForge documents a gateway and registry, while Obot also hosts server workloads. [MCP architecture](https://modelcontextprotocol.io/docs/learn/architecture), [ContextForge](https://ibm.github.io/mcp-context-forge/latest/), [Obot hosting](https://docs.obot.ai/concepts/mcp-hosting/).

For evaluation, distinguish an API gateway’s handling of HTTP requests from MCP-aware decisions about a named tool inside a JSON-RPC message. An LLM or AI gateway may also govern model inference; that does not establish identical controls for tool calls. Kong explicitly documents MCP traffic as a separate request flow from LLM traffic. [AI MCP Proxy](https://developer.konghq.com/plugins/ai-mcp-proxy/).

Ask which component authenticates the caller, which authorizes the operation and which holds the upstream credential. Then draw the administration path separately from the request path. This reveals whether a locally deployed gateway still depends on a hosted service for configuration, identity or licence validation.

## Tyk

Best fit: self-managed MCP governance, especially around APIs already managed in Tyk. Pass-through MCP proxies are available across Gateway licences from 5.13. Gateway REST-to-MCP conversion is a separate Enterprise feature from 5.15 and requires a Tyk OAS source API. [MCP overview](https://tyk.io/docs/ai-management/mcp-gateway/overview), [conversion requirements](https://tyk.io/docs/ai-management/mcps/api-to-mcp).

Tyk’s policies control individual tools, resources, prompts and JSON-RPC methods. The documented four policy rate-limit levels are policy-global, proxy, method and primitive. These provide a specific enforcement surface to evaluate rather than treating every call to an MCP endpoint identically. [MCP policies](https://tyk.io/docs/ai-management/mcp-gateway/policies).

Gateway 5.14 adds remote-upstream Protected Resource Metadata/OAuth proxying, per-primitive OAuth2 scopes and filtered discovery. Gateway 5.16 adds Origin validation and an OAuth broker. These remote-proxy capabilities are available outside Enterprise; RFC 8693 token exchange remains Enterprise. [Gateway release notes](https://tyk.io/docs/developer-support/release-notes/gateway), [licensing boundary](https://tyk.io/docs/ai-management/mcp-gateway/overview).

Compatibility and operations: Gateway 5.16 supports MCP 2025-11-25 and 2026-07-28. Its upstream transport is Streamable HTTP, excluding stdio and legacy HTTP+SSE. MCP access logs and OpenTelemetry provide signals; the licensed Dashboard adds proxy management and analytics. Operator MCP support starts at v1.4.0. [Versions](https://tyk.io/docs/ai-management/mcp-gateway/protocol-versions), [transport](https://tyk.io/docs/ai-management/mcp-gateway/core-concepts), [observability](https://tyk.io/docs/ai-management/mcp-gateway/mcp-observability), [Dashboard](https://tyk.io/docs/ai-management/mcp-gateway/managing-proxies), [Operator](https://tyk.io/docs/product-stack/tyk-operator/mcp-proxy).

Licence distinction: AI Studio is a separate product. Its AGPL-3.0 Community edition can expose OpenAPI-defined tools over MCP, but its separate MCP servers administration section is Enterprise. New tools require MCP to be enabled from v2.2.0. [AI Studio repository](https://github.com/TykTechnologies/ai-studio), [tools](https://tyk.io/docs/ai-management/ai-studio/tools). AI Studio budgets, model routing and guardrail filters require Enterprise. [Budgets](https://tyk.io/docs/ai-management/ai-studio/budgeting), [routing](https://tyk.io/docs/ai-management/ai-studio/model-router), [filters](https://tyk.io/docs/ai-management/ai-studio/filters).

Tyk’s offline installation guide covers mirrored charts, images and packages. Use it as an installation plan, then validate the complete disconnected topology. [Air-gapped deployment](https://tyk.io/docs/api-management/air-gapped-deployment).

- **Strengths:** self-managed, with a documented offline installation; MPL-2.0 Gateway with MCP proxies on all licences from 5.13; access control and rate limits per tool, resource, prompt and JSON-RPC method. [Air-gapped guide](https://tyk.io/docs/api-management/air-gapped-deployment) · [MCP overview](https://tyk.io/docs/ai-management/mcp-gateway/overview) · [Policies](https://tyk.io/docs/ai-management/mcp-gateway/policies)
- **Limitations:** worth checking: MCP proxying targets Streamable HTTP, so stdio or legacy HTTP+SSE servers need a bridge; some features need an Enterprise or commercial licence (REST-to-MCP, token exchange, Dashboard, Operator). [Transport](https://tyk.io/docs/ai-management/mcp-gateway/core-concepts) · [REST-to-MCP](https://tyk.io/docs/ai-management/mcps/api-to-mcp) · [Release notes](https://tyk.io/docs/developer-support/release-notes/gateway) · [Operator](https://tyk.io/docs/product-stack/tyk-operator/mcp-proxy)

## Amazon Bedrock AgentCore Gateway

Best fit: teams that want AWS to operate the gateway. AgentCore Gateway is a managed service that exposes APIs and Lambda functions as MCP tools, including OpenAPI and Smithy targets. It also documents inbound and outbound authentication and semantic tool search. [Gateway overview](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html).

Tool authorization is broader than custom interceptor code alone. Interceptors can apply identity and parameter checks; Policy in AgentCore also supports declarative authorization evaluated for tool invocations, with default-deny and forbid-wins semantics. [Fine-grained access](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-fine-grained-access-control.html), [policy concepts](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-core-concepts.html).

Rate limits can use toolName, caller claims and other dimensions. One practical caveat deserves a test: AWS says a limit is skipped if its required dimension cannot be resolved from the request. Include missing-claim and non-tool requests in your evaluation. [Rate-limit dimensions](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-rate-limits-dimensions.html).

Compatibility and evidence: AWS lists MCP 2025-03-26, 2025-06-18, 2025-11-25 and 2026-07-28. Monitoring uses CloudWatch; CloudTrail records Gateway API activity. Check the event types you need rather than assuming management records capture every tool’s result. [Protocol support](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-using.html), [monitoring](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-building-debug.html).

Limit: the managed AWS operating model does not meet a requirement to install the gateway in an isolated on-premises environment. [Deployment model](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html). Choose it when managed operation is a requirement, then test policy behavior with your identities and targets.

- **Strengths:** AWS operates it; OpenAPI, Smithy and Lambda targets; declarative tool policies and toolName rate-limit dimensions; MCP 2026-07-28 listed. [Overview](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html) · [Policies](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-core-concepts.html) · [Protocol support](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-using.html)
- **Limitations:** managed AWS service only, so it cannot be installed in an isolated on-premises environment; a rate limit is skipped when its dimension cannot be resolved from the request. [Overview](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html) · [Rate-limit dimensions](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-rate-limits-dimensions.html)

## Composio

Best fit: connecting agents to application accounts and controlling their available actions. Composio exposes configured sessions through MCP and manages provider credentials for hosted execution. [MCP sessions](https://docs.composio.dev/docs/sessions-via-mcp), [token custody](https://docs.composio.dev/docs/security/token-custody).

Sessions support tool allowlists, denylists and action-tag restrictions. Their scope is more useful to review than a simple server-level access checkbox: confirm which actions the agent may discover and execute under the actual session configuration. [Configuring sessions](https://docs.composio.dev/docs/configuring-sessions).

Enterprise private-VPC and self-hosted arrangements include Helm support. However, the licence of an open-source full platform is not documented in those deployment sources; the separately published SDK repository is MIT. [Self-hosting](https://docs.composio.dev/docs/self-hosting), [SDK repository](https://github.com/ComposioHQ/composio).

Limits: fully disconnected operation, administrator-configurable per-tool rate limits, dated MCP compatibility and automatic OpenAPI-to-MCP conversion are not documented in the checked sources. The documented controls are organisation-wide API limits, upstream-provider quotas, MCP sessions and custom in-process tools. [Deployment](https://docs.composio.dev/docs/security/token-custody), [limits](https://docs.composio.dev/reference/v3/rate-limits), [sessions](https://docs.composio.dev/docs/sessions-via-mcp), [custom tools](https://docs.composio.dev/docs/extending-sessions/custom-tools-and-toolkits).

Tool arguments and responses are logged by default. Review payload retention separately from credential protection, and bind each authenticated user to the intended connected account. [Data handling](https://docs.composio.dev/docs/security/data-retention), [identity boundary](https://docs.composio.dev/docs/security/token-custody). Ask for the exact credential, administration and egress design before selecting a private deployment.

- **Strengths:** session tool allowlists, denylists and action-tag restrictions; hosted credential custody for connected app accounts; Enterprise VPC and self-hosting with Helm. [Sessions](https://docs.composio.dev/docs/configuring-sessions) · [Token custody](https://docs.composio.dev/docs/security/token-custody) · [Self-hosting](https://docs.composio.dev/docs/self-hosting)
- **Limitations:** air-gapped operation, per-tool rate limits and OpenAPI-to-MCP conversion are not documented; tool arguments and responses are logged by default; the platform's open-source licence is not documented. [Limits](https://docs.composio.dev/reference/v3/rate-limits) · [Data handling](https://docs.composio.dev/docs/security/data-retention)

## IBM ContextForge

Best fit: a permissively licensed, self-operated MCP gateway and registry. ContextForge uses Apache-2.0 and documents federation, REST adaptation, containers, Kubernetes, structured logs and OpenTelemetry tracing. [Project documentation](https://ibm.github.io/mcp-context-forge/latest/).

Its authorization model separates tool visibility/team scope from permission to execute. Both layers must permit a call. This is a useful distinction when building a shared catalogue that should not grant every reader execution rights. [Tool authorization](https://ibm.github.io/mcp-context-forge/latest/howto/rbac-tool-authorization/).

The rate-limiter plugin supports a by_tool map. Redis shares counters across replicas; memory counters remain local to each worker. Configure the failure policy deliberately, then test multiple workers against the same limit. [Plugin bindings](https://ibm.github.io/mcp-context-forge/latest/api/plugin-bindings-api/).

Compatibility: default auto mode accepts MCP 2024-11-05, 2025-03-26, 2025-06-18, 2025-11-25 and 2026-07-28. A legacy mode changes the accepted set, so record configuration as well as the software version. [Configuration reference](https://ibm.github.io/mcp-context-forge/latest/manage/configuration/).

Offline boundary: the project documents an air-gapped container deployment and bundled UI assets. That is stronger evidence than simply offering a container image, but it still leaves your identity provider, chosen tools and dependency supply chain to validate. [README](https://github.com/IBM/mcp-context-forge#readme), [offline UI](https://ibm.github.io/mcp-context-forge/latest/overview/ui/).

Choose this approach when your team wants to own the registry, policy configuration and operational lifecycle. Make counter storage, backup restoration and upgrade procedures part of the selection exercise rather than postponing them until production.

- **Strengths:** Apache-2.0; execution RBAC separate from visibility; by_tool rate limits; documented air-gapped container deployment; accepts MCP revisions up to 2026-07-28. [Docs](https://ibm.github.io/mcp-context-forge/latest/) · [Tool authorization](https://ibm.github.io/mcp-context-forge/latest/howto/rbac-tool-authorization/) · [Configuration](https://ibm.github.io/mcp-context-forge/latest/manage/configuration/)
- **Limitations:** your team operates the registry, policies and upgrades; rate counters are local to each worker unless you add Redis. [Plugin bindings](https://ibm.github.io/mcp-context-forge/latest/api/plugin-bindings-api/)

## Kong AI Gateway

Best fit: extending an established Kong operating model to MCP. AI MCP Proxy is an AI Gateway Enterprise capability, with REST conversion, upstream proxying, tool ACLs, filtered discovery and audit/logging integration. [Plugin documentation](https://developer.konghq.com/plugins/ai-mcp-proxy/).

Deployment needs careful scoping. The current AI entity model uses a Konnect-managed control plane; self-hosted configuration uses Gateway Services, Routes and plugins. Kong documents how to translate between these models, including capabilities without an on-premises equivalent. [Architecture](https://developer.konghq.com/ai-gateway/architecture/), [on-premises guide](https://developer.konghq.com/ai-gateway/configure-on-prem/).

Protocol correction: AI Gateway 2.1.0 adds MCP 2026-07-28 support for clients and upstream servers. The older plugin page’s 2025-only explanation should not be treated as the current product-wide compatibility ceiling. Pin the runtime and validate the configured revisions. [Runtime changelog](https://developer.konghq.com/ai-gateway/changelog/).

Kong documents rate policies for MCP servers and AI Consumers/Consumer Groups, including header-based counter keys. Native independent tool-name counters are not documented in the reviewed policy configuration. This does not establish that custom composition is impossible. [Rate Limiting Advanced](https://developer.konghq.com/ai-gateway/policies/rate-limiting-advanced/).

Limit: a complete disconnected MCP operating procedure is not documented in the cited deployment guides. [On-premises](https://developer.konghq.com/ai-gateway/configure-on-prem/), [architecture](https://developer.konghq.com/ai-gateway/architecture/). Ask for the actual configuration, licensing dependencies and control-plane topology. Existing Kong expertise is a reason to shortlist it, not a substitute for testing your MCP policy requirements.

- **Strengths:** fits an existing Kong operating model; tool ACLs, filtered discovery and REST conversion; AI Gateway 2.1.0 adds MCP 2026-07-28. [AI MCP Proxy](https://developer.konghq.com/plugins/ai-mcp-proxy/) · [Changelog](https://developer.konghq.com/ai-gateway/changelog/)
- **Limitations:** AI MCP Proxy requires AI Gateway Enterprise; the current AI entity model uses a Konnect-managed control plane; native per-tool counters and a complete disconnected procedure are not documented. [Architecture](https://developer.konghq.com/ai-gateway/architecture/) · [Rate Limiting Advanced](https://developer.konghq.com/ai-gateway/policies/rate-limiting-advanced/)

## Portkey

Best fit: managed MCP administration with optional customer-hosted gateway placement. Portkey’s documentation now identifies the product as Prisma AIRS AI Gateway. Its MCP gateway handles server access, upstream credentials, per-user tool provisioning and tool-call records. [MCP Gateway](https://portkey.ai/docs/product/mcp-gateway).

Tool-level throttling is documented. However, a dated MCP support matrix and generic REST-to-MCP conversion are not documented on the checked product path. [MCP capabilities](https://portkey.ai/docs/product/mcp-gateway).

Hybrid deployment places the data plane in the customer’s environment and keeps the administration control plane with Portkey. Cached configuration avoids a control-plane lookup on every request; the architecture still requires outbound HTTPS to control-plane endpoints. [Hybrid architecture](https://portkey.ai/docs/self-hosting/hybrid-deployments/architecture).

Decisive limit for new disconnected projects: Portkey no longer provisions fully air-gapped deployments. Existing installations remain supported. A local data plane or temporary service from cached configuration should not be presented as a permanently disconnected deployment. [Current deployment policy](https://portkey.ai/docs/product/product-feature-comparison).

The AI Gateway repository is MIT-licensed, but its README’s link to MCP platform documentation does not establish that the complete MCP administration platform is included in that repository. Keep that licence boundary explicit. [Licence](https://github.com/Portkey-AI/gateway/blob/main/LICENSE), [README](https://github.com/Portkey-AI/gateway#readme).

For a proof of concept, ask which configuration changes continue during a control-plane outage and which require reconnection. Evaluate the cached-request path and the administration lifecycle separately. This is particularly relevant when local processing is required but hosted administration is acceptable.

For a deeper look at self-hosted replacements for Portkey, see [Portkey self-hosted alternative: AI and MCP gateways on your infrastructure](https://tyk.io/learning-center/portkey-self-hosted-alternative/).

- **Strengths:** managed MCP administration with per-user tool provisioning, tool-level throttling and tool-call records; MIT-licensed AI Gateway repository; hybrid keeps the data plane in your environment. [MCP Gateway](https://portkey.ai/docs/product/mcp-gateway) · [Licence](https://github.com/Portkey-AI/gateway/blob/main/LICENSE)
- **Limitations:** no new fully air-gapped deployments; hybrid needs outbound HTTPS to Portkey's control plane; generic REST-to-MCP conversion and a dated MCP support matrix are not documented. [Deployment policy](https://portkey.ai/docs/product/product-feature-comparison) · [Hybrid architecture](https://portkey.ai/docs/self-hosting/hybrid-deployments/architecture)

## TrueFoundry

Best fit: a central MCP registry with tool permissions and API-generated servers. TrueFoundry documents virtual MCP servers, OpenAPI conversion, tool audit records and metrics. Tool permissions can target users, teams and virtual accounts. [MCP overview](https://www.truefoundry.com/docs/ai-gateway/mcp/mcp-overview), [authentication and security](https://www.truefoundry.com/docs/ai-gateway/mcp/mcp-gateway-auth-security).

Rate-limit overrides can give a specific server:tool pair its own counter. Only tools/call is counted; tool listing, resources and prompts are outside that counter. Check this distinction if your governance requirement includes more than tool invocation. [Rate limiting](https://www.truefoundry.com/docs/ai-gateway/ratelimiting-v2).

Compatibility depends on the path. Direct proxying forwards protocol traffic end to end; the internal client negotiates through 2026-07-28. Gateway-generated virtual and OpenAPI servers use 2025-06-18. A claim about proxy compatibility therefore should not be transferred to a generated endpoint. [Protocol support](https://www.truefoundry.com/docs/ai-gateway/mcp/mcp-protocol-support).

Deployment qualification: TrueFoundry offers managed and self-hosted arrangements and publishes image-mirroring guidance for offline installation. Its standard control-plane-plus-gateway option still documents external authentication and analytics services, including licensing-related communication. [Deployment options](https://www.truefoundry.com/docs/ai-gateway/modes-of-deployment), [installation FAQ](https://www.truefoundry.com/docs/platform/deploy-control-plane-faq).

An open-source gateway licence is not documented in those sources. [Deployment options](https://www.truefoundry.com/docs/ai-gateway/modes-of-deployment). Before approving an air-gapped design, obtain a component-level explanation of how external services are removed or replaced. Test that exact arrangement rather than extrapolating from the standard self-hosted installation.

- **Strengths:** virtual MCP servers, OpenAPI-generated tools, tool permissions for users, teams and virtual accounts, and independent server:tool rate counters. [MCP overview](https://www.truefoundry.com/docs/ai-gateway/mcp/mcp-overview) · [Rate limiting](https://www.truefoundry.com/docs/ai-gateway/ratelimiting-v2)
- **Limitations:** rate counters count only tools/call; generated servers use MCP 2025-06-18; the standard self-hosted option documents external authentication and analytics services; an open-source licence is not documented. [Protocol support](https://www.truefoundry.com/docs/ai-gateway/mcp/mcp-protocol-support) · [Deployment options](https://www.truefoundry.com/docs/ai-gateway/modes-of-deployment)

## Docker MCP Gateway

Best fit: running and curating MCP servers in local containers. Docker MCP Gateway manages server lifecycles, credentials and routing, with logging and call tracing. [Gateway documentation](https://docs.docker.com/ai/mcp-catalog-and-toolkit/mcp-gateway/).

The MIT-licensed standalone project can run independently of Docker Desktop. Profiles organise servers and enable or disable individual tools. [Licence](https://github.com/docker/mcp-gateway/blob/main/LICENSE), [project README](https://github.com/docker/mcp-gateway). This makes it worth evaluating when the immediate requirement is to operate local server processes.

The CLI documents stdio, sse and streaming transport options. Those options describe transport, not a list of supported dated MCP revisions. Per-tool rate limits and a dated compatibility matrix remain not documented in the checked CLI/project sources. [CLI reference](https://docs.docker.com/reference/cli/docker/mcp/gateway/run/), [repository](https://github.com/docker/mcp-gateway).

Limits: complete air-gapped operation and built-in generic REST conversion are not documented in the checked gateway sources. Local installation and access to local profile files alone do not demonstrate an offline lifecycle for every server and dependency. [Repository](https://github.com/docker/mcp-gateway), [gateway docs](https://docs.docker.com/ai/mcp-catalog-and-toolkit/mcp-gateway/).

Docker separately describes MCP Gateway within Docker AI Governance as invite-only. Do not assume the standalone MIT CLI includes that offering’s organisational controls. [Product boundary](https://docs.docker.com/ai/mcp-catalog-and-toolkit/mcp-gateway/).

For shared deployment, test how the caller’s identity reaches an authorization decision and how access is revoked. Profile curation is useful, but it should not be counted as evidence for an untested user-specific policy.

- **Strengths:** MIT standalone gateway that runs without Docker Desktop; stdio, sse and streaming transports; per-tool enable and disable through profiles. [Repository](https://github.com/docker/mcp-gateway) · [CLI](https://docs.docker.com/reference/cli/docker/mcp/gateway/run/)
- **Limitations:** per-tool rate limits, a dated MCP matrix, air-gapped operation and REST conversion are not documented; Docker AI Governance's MCP Gateway is invite-only. [Gateway docs](https://docs.docker.com/ai/mcp-catalog-and-toolkit/mcp-gateway/)

## MintMCP / Mintive

Best fit: role-specific collections of approved tools with managed administration. MintMCP is now named Mintive. Its role-based virtual MCPs curate connectors and tools for users or directory groups. [RBAC](https://www.mintive.com/docs/rbac).

Rate limits can apply to selected tools, either per caller or across callers. The selected tools share a counter; they do not automatically receive separate counters. The feature is available on request, and new limits begin in monitor mode until changed to enforcement. [Gateway rate limits](https://www.mintive.com/docs/gateway-rate-limits).

Tool events and access changes can be exported through OTLP/HTTP or Splunk HEC. Check which event types and payload fields your internal audit process actually needs. [SIEM export](https://www.mintive.com/docs/siem-export).

Deployment and compatibility limits: managed cloud is documented, while self-hosted and on-premises requirements are handled through discussion with the vendor. Fully air-gapped operation and an open-source gateway licence are not documented in the deployment material. [Introduction](https://www.mintive.com/docs/intro).

A dated MCP compatibility list and generic OpenAPI-to-MCP conversion are also not documented in the reviewed architecture and custom-server guides. Hosting your own MCP server establishes a runtime option, not an automatic importer for arbitrary API specifications. [Architecture](https://www.mintive.com/docs/architecture), [custom servers](https://www.mintive.com/docs/mcp-connectors-custom).

In a trial, put two tools under one limit and demonstrate which counter is shared. Then repeat in enforcement mode and with the limiter unavailable. Use those observations to decide whether the configured scope matches your requirement.

- **Strengths:** role-based virtual MCP tool sets for users or directory groups; tool events export over OTLP/HTTP or Splunk HEC. [RBAC](https://www.mintive.com/docs/rbac) · [SIEM export](https://www.mintive.com/docs/siem-export)
- **Limitations:** selected tools share one rate counter and the feature is available on request; self-hosting is by discussion; air-gapped operation, an open-source licence and OpenAPI conversion are not documented. [Rate limits](https://www.mintive.com/docs/gateway-rate-limits) · [Introduction](https://www.mintive.com/docs/intro)

## Obot

Best fit: an open-source gateway and registry that can also host MCP servers. Obot documents server/tool access by user or identity-provider group, request/response records and audit export. Its source is MIT across editions, with licence keys controlling entitlements. [Overview](https://docs.obot.ai/), [editions](https://docs.obot.ai/enterprise/overview/).

Obot can import an OpenAPI schema and host a wrapper for the API’s operations. Hosted workloads run on Docker or Kubernetes. [MCP hosting](https://docs.obot.ai/concepts/mcp-hosting/).

Protocol evidence: the released v0.27.0 dependency chain includes an explicit 2026-07-28 implementation and a separate legacy handler. That is stronger than a generic MCP claim, although a complete dated compatibility matrix remains not documented. [Released dependency](https://github.com/obot-platform/obot/blob/v0.27.0/go.mod), [pinned protocol implementation](https://github.com/obot-platform/mmmcp/blob/e619b4f7dc01/http_dispatch.go).

Per-tool rate counters are not documented in the reviewed server configuration. Generic request limiting should not be substituted for a requirement to isolate one tool’s usage. [Configuration](https://docs.obot.ai/configuration/server-configuration/).

Offline limit: a new air-gapped installation cannot validate a licence key. Previously validated entitlements remain until their known expiry; without successful validation, the installation uses unregistered Community behaviour. This is a restriction on licensed offline operation, not on whether the code can run locally. [Network requirements](https://docs.obot.ai/installation/network-requirements/), [licence behaviour](https://docs.obot.ai/enterprise/overview/).

Evaluate the required edition and authentication model together. Include installation, renewal, expiry and restoration from backup in the disconnected test plan so the operational decision is based on the full lifecycle.

- **Strengths:** MIT source across editions; OpenAPI import and MCP server hosting on Docker or Kubernetes; server and tool access by user or IdP group. [Editions](https://docs.obot.ai/enterprise/overview/) · [Hosting](https://docs.obot.ai/concepts/mcp-hosting/)
- **Limitations:** a new air-gapped installation cannot validate a licence key; per-tool rate counters are not documented. [Network requirements](https://docs.obot.ai/installation/network-requirements/) · [Configuration](https://docs.obot.ai/configuration/server-configuration/)

## What are the open-source and self-hosted MCP gateways?

Four gateways in this comparison publish open-source code you can run on your own infrastructure: Tyk Gateway (MPL-2.0), IBM ContextForge (Apache-2.0), Obot (MIT) and Docker MCP Gateway (MIT). They differ most in per-tool control. Checked on 30 October 2026.

| Gateway | Licence | Self-hosting | Per-tool control |
|---|---|---|---|
| Tyk Gateway | MPL-2.0 for non-Enterprise code; MCP proxies in all licences from 5.13. [Repository](https://tyk.io/docs/tyk-oss-gateway), [MCP overview](https://tyk.io/docs/ai-management/mcp-gateway/overview) | Self-managed; offline installation documented. [Guide](https://tyk.io/docs/api-management/air-gapped-deployment) | Access and rate limits per tool, resource, prompt and JSON-RPC method. [Policies](https://tyk.io/docs/ai-management/mcp-gateway/policies) |
| IBM ContextForge | Apache-2.0. [Documentation](https://ibm.github.io/mcp-context-forge/latest/) | Containers and Kubernetes. [Documentation](https://ibm.github.io/mcp-context-forge/latest/) | Visibility plus execution RBAC; by_tool rate limits. [Tool authorization](https://ibm.github.io/mcp-context-forge/latest/howto/rbac-tool-authorization/) |
| Obot | MIT across editions; licence keys control entitlements. [Editions](https://docs.obot.ai/enterprise/overview/) | Hosted workloads on Docker or Kubernetes. [MCP hosting](https://docs.obot.ai/concepts/mcp-hosting/) | Server and tool access by user or identity-provider group. [Overview](https://docs.obot.ai/) |
| Docker MCP Gateway | MIT. [Licence](https://github.com/docker/mcp-gateway/blob/main/LICENSE) | Local containers; runs without Docker Desktop. [Repository](https://github.com/docker/mcp-gateway) | Profiles enable or disable individual tools; per-tool rate limits not documented. [Repository](https://github.com/docker/mcp-gateway) |

Kong's AI MCP Proxy requires AI Gateway Enterprise, and Composio does not document an open-source licence for its platform, so neither is listed here. Self-hosted is not the same as air-gapped: confirm that no control plane, licence check or model call leaves your network.

## When is Tyk not the right choice?

Tyk should leave the shortlist when a documented boundary conflicts with a requirement you cannot change:

- You need direct stdio or legacy HTTP+SSE upstream support. Tyk Gateway supports Streamable HTTP. A local process manager such as Docker’s gateway may fit that workflow better. [Tyk transport](https://tyk.io/docs/ai-management/mcp-gateway/core-concepts), [Docker workflow](https://docs.docker.com/ai/mcp-catalog-and-toolkit/mcp-gateway/).
- You require open-source REST conversion inside Tyk Gateway. That feature needs Enterprise, Gateway 5.15+ and Tyk OAS APIs. AI Studio’s Community tools-over-MCP feature is a separate product path, not the same Gateway capability. [Gateway conversion](https://tyk.io/docs/ai-management/mcps/api-to-mcp), [AI Studio tools](https://tyk.io/docs/ai-management/ai-studio/tools).
- You specifically require AWS to operate the MCP gateway as an AWS service. AgentCore Gateway provides that operating model. [AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html).
- You need AI Studio budgets, routing and guardrail filters without Enterprise licensing. These capabilities are paid-edition features. [Budgets](https://tyk.io/docs/ai-management/ai-studio/budgeting), [model router](https://tyk.io/docs/ai-management/ai-studio/model-router), [filters](https://tyk.io/docs/ai-management/ai-studio/filters).

For offline procurement, apply the same acceptance standard to Tyk and every competitor. Installation documentation is a useful starting point; require a demonstrated deployment with your identity, secrets, licence arrangements, monitoring and upstream services before accepting an end-to-end air-gap claim.

## How do you choose an MCP gateway for air-gapped use?

Start with a written requirement and an observable pass condition. “Supports MCP security” is too broad to evaluate. “A support identity may read a ticket but cannot delete it, even by calling the tool directly” gives you a concrete test.

### Establish ownership and connectivity

Map the gateway, administration service, databases, identity provider, secrets store, registries and telemetry destinations. Mark who operates each component and which connections cross your boundary.

For a self-hosted MCP gateway, test installation on a fresh machine or cluster with public egress blocked. Pre-stage images, packages and charts. Then exercise startup, restart, policy changes, credential rotation, user revocation, backup restoration and upgrade. Include licence activation, renewal and expiry when the selected edition requires them.

Treat these as acceptance tests for your proposed architecture. A successful request from cached configuration answers a narrower question than a complete disconnected operational lifecycle.

### Test authorization beyond the catalogue

Use two identities and at least two tools with different permissions. Check tool discovery, then invoke a forbidden tool directly by name. Repeat after revocation and after reconnecting the client. Verify that a denied call produces no upstream effect.

Review token audiences, delegated authorization and upstream consent. The MCP security guidance identifies token passthrough, confused-deputy behaviour, SSRF and session hijacking as distinct risks; authentication at the gateway is not a complete assessment of those paths. [MCP security best practices](https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices).

### Test counters and failure behaviour

Exhaust one tool’s configured limit and check an unrelated tool. Repeat with another identity and across gateway replicas. Disconnect the counter store and record whether the system allows calls, blocks them or produces an error.

Do not equate a shared server counter, a per-user counter and a per-tool counter. Record the counted event, scope, window and failure rule. Also verify that the configured policy is enforcing rather than only reporting violations.

### Test compatibility and audit evidence

Record client, gateway and upstream versions, transport and endpoint type. Exercise the operations your application uses, including resources or prompts where relevant. Test API-generated tools separately from pass-through servers, including denied operations, upstream errors and streaming behaviour.

For an audit sample, trace a permitted call and a denied call from identity to policy decision to upstream result. Check redaction, retention, access to logs and internal export. Require a named owner and a recorded result for every unresolved item.

Select the product that passes the mandatory tests and has an operating model your team can sustain. Keep optional features separate from requirements that would prevent deployment.

## FAQ

### What is an MCP gateway?

An MCP gateway mediates traffic between MCP clients and servers and can apply authentication, tool permissions, credential handling and activity logging. Some gateways also expose APIs as MCP tools. The exact feature set depends on the product. [AgentCore concepts](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-core-concepts.html), [Portkey MCP Gateway](https://portkey.ai/docs/product/mcp-gateway).

### What is the difference between an MCP gateway and an MCP server?

An MCP server exposes tools, resources or prompts. A gateway provides an access and policy layer in front of servers or API-backed tools. A product can combine these roles, so evaluate the endpoint’s actual behaviour rather than its label. [MCP architecture](https://modelcontextprotocol.io/docs/learn/architecture), [ContextForge documentation](https://ibm.github.io/mcp-context-forge/latest/).

### What is the best enterprise MCP gateway?

The best choice is the gateway that meets your deployment, authorization, compatibility and operational requirements. Use this comparison to shortlist candidates, then run the same permitted-call, denied-call, rate-limit and recovery tests against each. There is no evidence here for a universal performance winner.

### Does self-hosted mean air-gapped?

No. Self-hosted describes where a component runs. Air-gapped operation requires the complete selected system to work without external connectivity. For example, Portkey’s hybrid gateway still uses a hosted control plane, and Obot documents online licence-validation requirements. [Portkey architecture](https://portkey.ai/docs/self-hosting/hybrid-deployments/architecture), [Obot network requirements](https://docs.obot.ai/installation/network-requirements/).

### Is Tyk’s MCP gateway open source?

Tyk Gateway’s non-Enterprise code is MPL-2.0, and remote MCP proxies are available across licences from 5.13. Gateway REST-to-MCP requires Enterprise from 5.15; the Dashboard and RFC 8693 token exchange also require commercial licensing. [Repository](https://tyk.io/docs/tyk-oss-gateway), [MCP overview](https://tyk.io/docs/ai-management/mcp-gateway/overview), [conversion](https://tyk.io/docs/ai-management/mcps/api-to-mcp), [release notes](https://tyk.io/docs/developer-support/release-notes/gateway).

### What is the best open-source MCP gateway?

For a permissively licensed gateway and registry, IBM ContextForge (Apache-2.0) combines federation, a REST adapter and execution RBAC. Tyk Gateway's MCP proxies are open source under MPL-2.0 from 5.13 and add access policies and rate limits per tool, resource, prompt and method; REST-to-MCP conversion in Tyk Gateway requires Enterprise from 5.15. Obot (MIT) adds MCP server hosting, and Docker MCP Gateway (MIT) suits running local server containers. [ContextForge](https://ibm.github.io/mcp-context-forge/latest/), [Tyk MCP overview](https://tyk.io/docs/ai-management/mcp-gateway/overview), [Obot](https://docs.obot.ai/), [Docker MCP Gateway](https://github.com/docker/mcp-gateway).

### Is there a self-hosted MCP gateway?

Yes. Tyk Gateway (with a documented offline installation), IBM ContextForge (containers and Kubernetes), Obot (Docker or Kubernetes) and Docker MCP Gateway (local containers) all run on your own infrastructure, and Kong AI Gateway has a self-hosted plugin path whose AI MCP Proxy requires AI Gateway Enterprise. Amazon Bedrock AgentCore Gateway is a managed AWS service only. [Tyk installation](https://tyk.io/docs/api-management/air-gapped-deployment), [ContextForge](https://ibm.github.io/mcp-context-forge/latest/), [Kong AI MCP Proxy](https://developer.konghq.com/plugins/ai-mcp-proxy/), [AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html).

### MCP gateway vs API gateway: what is the difference?

An API gateway routes and secures HTTP requests by path, method and consumer. An MCP gateway reads MCP's JSON-RPC messages, so it can authorize and rate-limit individual tools, resources and prompts and filter what tools/list returns. Tyk Gateway does both: its MCP proxies (5.13+) run in the same gateway as its REST and GraphQL APIs. [Tyk MCP policies](https://tyk.io/docs/ai-management/mcp-gateway/policies), [MCP architecture](https://modelcontextprotocol.io/docs/learn/architecture).

### Is hiding a tool enough to prevent its use?

No. Discovery determines which tools are visible; invocation authorization determines whether a call may execute. Test a forbidden call directly, including after revoking access. ContextForge explicitly separates visibility from execution permission. [Tool authorization](https://ibm.github.io/mcp-context-forge/latest/howto/rbac-tool-authorization/).