Teams across the enterprise, from engineering to finance and HR, now run dozens of Model Context Protocol servers in development. But connecting those servers safely to real business systems is what's blocking production rollouts.
The ecosystem went from architectural experiment to enterprise governance requirement in under eighteen months. Platform engineers are drowning in tool server sprawl, unmanaged access tokens, and configuration hell.
The best MCP gateway depends entirely on your deployment stage. Local prototyping favors lightweight open-source, standalone gateways like Docker MCP Gateway, but when agents are limited to fetching data instead of taking action, the ROI stays incremental. Enterprise production requires more than federation. Arcade.dev delivers its MCP Gateway inside a full action runtime with delegated multi-user authorization, vaulted credentials, hosted tool execution, tool optimization, and audit logs.
TL;DR
- A gateway is table stakes. Federating your MCP servers behind one identity-scoped endpoint is something most serious platforms offer. The real question is what sits behind it.
- A lightweight standalone gateway, such as Docker MCP Gateway, is best for local prototyping. Enterprise production requires a runtime, not just gateway federation.
- An action runtime delivers that same gateway plus delegated, per-user authorization (intersection of user + agent permissions), vaulted credentials, hosted tool execution, and immutable audit logs. In short, the best MCP gateway is an action runtime.
- Evaluate gateways on (1) multi-user OAuth/OBO, (2) tool abstraction (intent-level vs raw OpenAPI), (3) OpenTelemetry + auditability, (4) deployment options (SaaS/VPC/air-gapped), and (5) transparent, usage-based pricing.
- If you're AWS-only or Azure-only, native options (Bedrock/Microsoft) can work but increase lock-in.
- For regulated, multi-tenant deployments, choose a runtime that supports OBO tokens, vaulting secrets, and tamper-proof logs.
Why enterprise MCP gateways need an action runtime
Without a standardized protocol, every new agent-tool pairing requires custom integration work. The Model Context Protocol, developed by Anthropic alongside other collaborators, reduces the custom integration problem by standardizing the interface. However, connecting five agents to ten downstream tools without a central gateway still creates fifty (N×M) unmanageable configuration points.
Even when an organization has existing security policies, there is no consistent way to enforce them across all agents as they scale to more users and systems. That's agent sprawl: uncontrolled proliferation of AI agents across your organization without centralized visibility.
The security implications are severe. In naive MCP implementations, organizations rely on agents to enforce their own security policies, and agents typically inherit full service-account access. This creates a huge blast radius for prompt injection attacks and introduces the confused deputy problem.
The root cause is privilege escalation through static service-account binding. A low-trust user authenticates to a high-privilege agent. The agent then executes actions against downstream systems using its own wide-open service account rather than the user's specific identity. Conversely, overly limiting agent permissions to avoid this risk removes their practical value entirely.
Traditional API gateways can't secure this traffic because they route stateless HTTP REST requests based on static route paths. Agentic traffic works differently. Agents need natural language intent translation, dynamic tool-call retries based on schema failures, and contextual authorization boundaries that shift per invocation. An API gateway can't evaluate whether an LLM's dynamic parameter generation violates a specific user's downstream access policies.
So the market has split into two distinct approaches. A standalone gateway acts as a multiplexer, bundling multiple tool servers behind a single endpoint and relying entirely on the underlying tools for authentication, authorization, and reliability. A standalone gateway works fine for local development.
The runtime approach provides a complete execution environment. Runtimes natively execute tool calls, enforce delegated multi-user authorization after prompt evaluation, handle intelligent retries, and generate a single, attribution-rich audit trail.
How to evaluate an enterprise MCP gateway in 2026
You need to look past marketing claims of basic protocol compatibility. What matters is the underlying execution and authorization architecture. The ecosystem has established clear baseline requirements for moving agents out of isolated sandboxes and into production environments that touch sensitive business data.
These five criteria share one pattern. Each is a job that a standalone gateway pushes down to the individual tool servers, and a runtime absorbs into the platform itself. Score each product by how much it does natively versus how much it forces you to build. The five pillars are authorization primitive maturity, tool execution efficiency, observability standards compliance, deployment flexibility, and transparent, usage-based pricing.
The closer a product sits to a full runtime, the more of these it handles natively, and the higher it ranks on its ability to manage complex multi-tenant identity flows and mitigate OWASP-defined vulnerabilities like excessive agency and prompt injection.
MCP gateway authorization: OAuth OBO, RBAC, and permission intersection
The gold standard for enterprise agent security is the intersection of permissions rule. A gateway must calculate effective access by evaluating the intersection of agent permissions and user permissions per action. Not the union. The intersection.
Enterprise gateways can support native per-user OAuth On-Behalf-Of token delegation, SSO, RBAC, and auditable identity. The runtime standard is stricter: evaluate both the authenticated user and the agent's allowed actions on each call. This directly binds the executing agent to the authenticated human user rather than relying on wide-open service accounts. Arcade enforces this intersection per action, so you can safely deploy multi-user agents to production.
Intent-level tools vs raw OpenAPI: reliability and token efficiency
Exposing raw OpenAPI schemas to large language models forces the models to bind complex parameters. This increases token usage and generates high rates of parameter hallucination, as demonstrated by MCP server reliability data. Production benchmarks bear this out. In one head-to-head test, an intent-level toolkit returned roughly 100x fewer response tokens than raw API passthrough across identical CRM queries. At enterprise scale, that's a massive economic advantage. A standalone gateway just forwards whatever schema each tool exposes, so it inherits the token bloat and hallucination rate of the raw APIs behind it. A runtime owns the tool layer, so it can ship intent-level tools tuned for how agents actually call them. Arcade's catalog of 8,000+ intent-level tools does exactly this, cutting token usage and parameter hallucination.
MCP observability: OpenTelemetry, audit logs, and SOC 2 evidence
Enterprise security reviews require immutable, tamper-proof audit trails. A production gateway must emit OpenTelemetry-compatible logs using the standardized GenAI semantic conventions.
These spans must track the specific user identity, agent identifier, targeted tool or action, target system, and timestamp. Without this, you won't pass the SOC 2 Type II audit-control requirements. A standalone gateway sees only the request it routes, not the full chain of user, agent, policy decision, and outcome, so the audit trail has to be reassembled from each tool's own logs. A runtime executes the action itself, so it emits one attribution-rich record per call. Arcade generates immutable, OpenTelemetry-compatible audit logs natively, so you gain centralized governance and pass enterprise security reviews.
MCP deployment models: SaaS, VPC, on-prem, and air-gapped
Gateways must support diverse network topologies: managed cloud, virtual private cloud, on-premises, and fully air-gapped deployments. They also need protocol-specific defenses that prevent cross-server credential shadowing and detect prompt injection and tool poisoning payloads before they reach the tool execution layer. A standalone gateway typically terminates at the network edge and leaves credential handling to each tool, so a leaked token or a poisoned tool response has nowhere central to be caught. A runtime holds credentials and enforces policy at execution time, so it can stop the attack before it acts. Arcade vaults credentials out-of-band and enforces contextual access policies, so prompt injections cannot leak tokens or escalate privileges.
MCP gateway pricing: usage-based vs seat-based models
Enterprise buyers should scrutinize the pricing model, not just the feature list. Flat monthly minimums and per-seat licenses punish teams at low scale and make costs unpredictable as agent fleets grow. The right model is free to start and usage-based, so spend tracks actual agent activity rather than a fixed floor. Products sold as an add-on to a broader platform often bury agent usage inside enterprise seat licenses, while a purpose-built runtime can meter the actual units of agent work. Arcade meters per tool execution, user challenge, and hosted MCP-server hour alongside a low base fee, so a pilot stays cheap and production scales predictably.
Delegated OAuth, OpenTelemetry logging, SOC 2, and flexible deployment are increasingly common across the field. The line that still separates a runtime from a gateway is the tool layer: whether a product ships genuinely intent-level tools or wraps raw APIs and leaves the optimization to you. In the matrix below, delegated auth and OTel logging are now widespread, but intent-level tools are not, and that column is the real dividing line.
MCP gateway comparison matrix: OAuth, OTel, compliance, and deployment
How each column is rated
-
Multi-user auth.
- Native: the gateway computes the agent and user permission intersection per action (two-identity model).
- Partial: delegated per-user OAuth OBO plus RBAC, but no gateway-computed intersection.
- None: shared or single credential, no per-user delegation.
-
Multi-tenancy.
- Native: one deployment serves many organizations with documented per-tenant isolation of servers, credentials, and configs.
- Partial: workspace or per-user separation, or multi-tenant only via separate instances. DIY: isolation only by self-hosting a separate instance per tenant.
- None: single-tenant or local.
-
Intent-level tools.
- Native: a catalog of agent-optimized, token-optimized tools built for natural-language intent, not raw API wrappers.
- Partial: a curated or filtered catalog over raw API or OpenAPI passthrough.
- None: routing only, no tool catalog.
-
OTel audit logs.
- Native: tool-call audit logs emitted in OpenTelemetry (OTLP).
- Partial: audit logging via a separate service, a non-OTel format, or OpenTelemetry for observability only.
- None: no audit logging.
- SOC 2 / compliance. The certification the vendor documents.
- Deployment models. The environments the vendor's documentation supports.
Best MCP gateways and runtimes for enterprise teams
1. Arcade: enterprise action runtime
Best for
Enterprise platform teams requiring a complete action runtime with strict multi-user authorization and pre-built integrations.
Overview
Arcade operates as a comprehensive action runtime that delivers its MCP Gateway as one product, so you get the gateway you came for plus the authorization, execution, and governance around it. What sets it apart is a catalog of over 8,000 agent-optimized tools that translate natural language intent into precise API calls.
This intent-level abstraction reduces parameter hallucination and, in Arcade's published Attio benchmark, returns roughly 100x fewer response tokens than raw OpenAPI passthrough.
Pricing
Arcade's pricing is free to start and then combines a platform fee with usage-based metering: per user challenge and per tool call, so costs scale with actual agent activity rather than flat seat minimums even at low scale.
Enterprise fit
Arcade is the first true runtime to natively solve the intersection of permissions rule by enforcing delegated multi-user authorization dynamically post-prompt. It hooks directly into existing enterprise identity stacks (Okta, Microsoft Entra, SailPoint, and other identity providers) to enforce existing user identities and permissions, acquiring OAuth On-Behalf-Of tokens so agents only take actions the authenticated user is already permitted to take, scoped further by the agent's own permissions.
Arcade is agnostic to models, frameworks, and clients, helping teams avoid ecosystem lock-in. Combined with SOC 2 Type II certification, an OpenTelemetry-compatible audit trail, and complete tool- and agent-level governance, Arcade represents the most mature choice for regulated, multi-tenant agent deployments.
Verdict: a complete action runtime. The gateway is included, not the ceiling.
2. TrueFoundry: Kubernetes-first MCP gateway
Best for
Low-latency infrastructure operations and Kubernetes-native platform engineering teams.
Overview
TrueFoundry combines an enterprise AI gateway with an MCP gateway layered on top of a highly optimized Kubernetes orchestration foundation. The platform targets speed specifically, using advanced traffic routing and weighted load balancing to direct agent requests to the fastest healthy backends dynamically.
Pricing
Custom enterprise SaaS and on-premise licensing tiers based on compute clusters and architectural scale.
Enterprise fit
TrueFoundry documents inbound authentication, IdP tokens, per-user OAuth2 authorization code, token storage and refresh, RBAC, and OTEL trace and metric export. It provides gateway and tool RBAC, virtual MCP servers, and Kubernetes-native deployment. It does not provide a hosted intent-level action runtime.
Verdict: a Kubernetes-first gateway for teams already standardized on TrueFoundry infrastructure.
3. MintMCP: managed connector MCP gateway
Best for
Teams centralizing connector credentials and MCP server configuration behind managed infrastructure.
Overview
MintMCP provides OAuth client auth, enterprise SSO/SCIM, virtual MCP servers, per-user and shared connector credentials, hosted connectors, tool customization, audit logs, and OTLP log export. Its strength is governed connector curation and policy.
Pricing
Custom enterprise pricing is heavily weighted toward seat-based compliance and governance packaging.
Enterprise fit
Core identity and policy features, including SSO, RBAC, and related controls, require the Enterprise plan, so teams cannot validate the compliance capabilities during initial evaluation. It does not provide a hosted intent-level action runtime.
Verdict: a managed connector gateway for teams prioritizing credential lifecycle management, connector curation, and audit export.
4. Composio: SaaS integration gateway
Best for
Broad SaaS integration coverage and managed auth for teams prioritizing embedded integrations and prototyping.
Overview
Composio functions as an MCP gateway and integration wrapper, exposing thousands of applications to AI agents via just-in-time tool calls and sandboxed parallel execution environments. Developers get immediate access to an ecosystem of inbound and managed integrations, connecting agents to nearly any mainstream software platform instantly.
Pricing
Usage-based tiers start with a free plan that includes 20,000 tool calls per month. The $29 monthly plan includes 200,000 tool calls and charges $0.299 per 1,000 additional calls; the $229 monthly plan includes 2 million tool calls and charges $0.249 per 1,000 additional calls (Composio pricing).
Enterprise fit
Composio documents projects, connected accounts, credential masking, and tool-execution logs. It does not provide a hosted intent-level action runtime or runtime-level permission intersection.
Verdict: an integration-rich gateway for teams prioritizing SaaS connector breadth and fast prototyping.
5. Obot: open-source MCP gateway for Kubernetes
Best for
Kubernetes-native open-source implementations and DIY platform engineering teams.
Overview
Obot is an open-source enterprise MCP gateway that manages servers, reusable agent capabilities called skills, access policies, and integrations. It provides a hosting, registry, and gateway architecture designed specifically for deployment within existing Kubernetes clusters, letting infrastructure teams use their current orchestration investments.
Pricing
Open-source core with self-hosted costs, supplemented by custom commercial support tiers for enterprise buyers.
Enterprise fit
The open-source transparency allows enterprise security teams to conduct full code reviews of the authorization hooks and audit handling mechanisms. The skills abstraction layer lets teams package and distribute best-practice tool chains internally.
While excellent for engineering-heavy teams, Obot requires real engineering effort to reach the out-of-the-box maturity of managed runtimes regarding enterprise single sign-on and automated compliance reporting.
Verdict: an open-source standalone gateway. Powerful for DIY teams, but reaching runtime maturity is your engineering project, not the vendor's.
6. Lunar.dev MCPX: open-source gateway with enterprise control plane
Best for
Open-source traffic control, zero-code aggregation, and local-to-production prototyping.
Overview
Open-source MCPX is a lightweight aggregator designed to orchestrate and secure agents across multiple heterogeneous MCP servers. It functions as both a zero-code aggregator and a strong traffic control layer, surfacing disparate local and remote tool servers behind a single, clean interface. MCPX Enterprise adds centralized user management, profiles, organizational catalog, hosted MCP, full auditability, secret management, and self-hosted Kubernetes for VPC, on-prem, or air-gapped deployments.
Pricing
Free open-source local usage with a sales-led enterprise tier adding centralized visibility and governance features.
Enterprise fit
The platform uses a client-based access control list model to restrict tool usage and integrates with broader AI gateway policies for runtime enforcement. MCPX proves developer-friendly for teams migrating from local Claude Desktop configurations toward containerized deployments.
However, the basic access control list model is less expressive than strict intersection logic for managing complex, multi-tenant corporate role hierarchies in production.
Verdict: a lightweight standalone gateway. Great for aggregation and prototyping, short of a runtime's per-user authorization.
7. MCP Manager: consent-aware MCPgateway
Best for
European environments requiring strict consent-aware data access.
Overview
MCP Manager focuses on consent-aware MCP governance, centralized policies, and permission visibility. The gateway provides a governance layer supporting remote, managed, and workstation server topologies while tracking exact permissions across varied environments.
Pricing
Enterprise SaaS licensing based on deployment models and consent tracking volume.
Enterprise fit
MCP Manager introduces a multi-layered consent-aware approach to agentic data access. Gating agent actions behind explicit user consent flows makes this platform a strong fit for European environments beholden to GDPR and the EU AI Act.
While highly specialized for privacy compliance, this heavy consent focus may prove unnecessary and overly complex for purely internal-use infrastructure workloads.
Verdict: a consent-focused gateway. It layers policy on top of tools rather than executing and authorizing them as a runtime does.
8. IBM ContextForge: federated MCP gateway
Best for
Federated multi-region infrastructure and environments mixing diverse communication protocols.
Overview
IBM ContextForge is an open-source gateway that federates any MCP server alongside agent-to-agent protocols, REST endpoints, and gRPC APIs. It provides centralized discovery, rate limiting, and observability across geographically distributed deployments through advanced network discovery mechanisms like mDNS.
Pricing
Free open-source foundation with enterprise support and hosting available through standard IBM procurement channels.
Enterprise fit
The platform excels in global enterprise environments by reducing per-region configuration toil through automatic gateway federation. Native multi-protocol fan-out proves useful for hybrid fleets migrating legacy REST services to the new standard over time.
However, ContextForge requires significant in-house engineering expertise to deploy. It lacks the out-of-the-box vendor polish found in dedicated SaaS runtimes.
Verdict: a federated standalone gateway. Strong at multi-region routing, but the runtime capabilities are yours to build and operate.
9. Docker MCP Gateway: local development sandbox
Best for
Local developer sandboxing and isolated agent prototyping.
Overview
Shipped directly inside Docker Desktop and Docker Engine, this gateway provides a built-in catalog surface area for developers to discover and configure MCP servers locally. It uses standard containerization to isolate servers, so each developer can run reproducible agent stacks without polluting their host operating system or exposing local environmental variables.
Pricing
Included within existing Docker subscription tiers.
Enterprise fit
Because the gateway integrates deeply into the standard developer workflow, many engineers use it as their default starting point. Container isolation prevents cross-server credential leakage during local testing.
But Docker MCP Gateway functions strictly as a local-first, standalone gateway rather than a production runtime. Transitioning from this sandbox to a governed production environment means implementing entirely separate network security and identity controls.
Verdict: a local sandbox gateway, not a production runtime.
10. Azure API Management MCP support: Azure-native MCP gateway
Best for
Teams fully committed to the Azure ecosystem that need MCP support within their existing API Management stack.
Overview
Azure API Management can expose and secure MCP server endpoints using the Azure API Management policy, identity, monitoring, and gateway model. It fits teams already standardized on APIM.
Pricing
Billed through standard Azure API Management consumption and tier-based pricing structures.
Enterprise fit
Microsoft addresses the confused deputy threat vector by requiring dynamic client registration tied to Azure-native authentication. Scoping access tokens per user mitigates excessive agency risks.
While the architecture provides strong integration within Azure, the gateway enforces severe ecosystem lock-in. It's an impractical choice for multi-cloud environments or organizations using non-Microsoft identity providers.
Verdict: an Azure-native standalone gateway. Convenient inside Microsoft, but it routes and authenticates rather than delivering a portable runtime.
11. Kong AI Gateway: API gateway with MCP support
)
Best for
Extending existing enterprise API gateway infrastructure to support basic agent routing and semantic caching.
Overview
Kong AI Gateway governs large language model and agent traffic by extending its unified API interface. Kong's AI MCP OAuth2 plugin is currently marked as Tech Preview and is part of AI Gateway Enterprise. Kong introduces semantic caching, payload observability, and semantic prompt guards directly at the network edge. The Konnect MCP Server turns the developer portal into an accessible tool server for coding assistants.
Pricing
Enterprise licensing bundled with the broader Kong Konnect API management platform.
Enterprise fit
Built on top of heavily battle-tested infrastructure, Kong allows operations teams to manage agent traffic using familiar API practices. The semantic caching capabilities transparently handle failover across providers while reducing redundant token spend.
Strong for enterprises already standardized on Kong, with MCP auth and proxy support at the gateway layer. It is not a hosted intent-level action runtime.
Verdict: an API gateway extended to MCP. Familiar operations, but not an agent-native runtime.
12. Lasso Security: open-source MCP gateway
Best for
Open-source gateway foundations for teams building their own MCP orchestration layer.
Overview
Lasso Security's open-source mcp-gateway is a plugin-based gateway for orchestrating MCP servers and building enterprise agents.
Pricing
Open-source repository with self-hosted operating costs.
Enterprise fit
The repository does not include multi-user OAuth/OBO, tenant isolation, intent-level tools, OTel audit logs, or SOC 2 coverage.
Verdict: an OSS gateway foundation, not an enterprise action runtime.
13. Amazon Bedrock AgentCore: AWS-native MCP gateway
Best for
Pure AWS agent fleets requiring stateful, long-running asynchronous execution environments.
Overview
Amazon Bedrock AgentCore is an AWS-native agent platform. Its Gateway handles tool discovery across MCP servers, Lambda, and OpenAPI targets; AgentCore Identity supports OBO token exchange; fine-grained access control is implemented through interceptors or AWS resource policies; observability flows through CloudWatch metrics, logs, and spans.
Pricing
Twelve-component per-invocation pricing charges fractions of a cent for API invocations layered with separate compute and memory hourly rates.
Enterprise fit
Alignment with AWS architectures and AWS-native integrations removes cross-cloud egress networking costs. The capability to support asynchronous execution sessions lasting up to eight hours unlocks sophisticated agent workflows previously impossible in standard request-response models.
However, the fragmented pricing structure makes the total cost of ownership difficult to predict for bursty workloads. Choosing AgentCore also requires the engineering resources and expertise to assemble and manage multiple separate AWS services (IAM, STS, KMS, CloudWatch) yourself, introducing higher ongoing engineering costs. And using this service guarantees total architectural lock-in to the AWS cloud ecosystem.
Verdict: an AWS-native gateway you assemble from separate services. Powerful inside AWS, but not a portable, unified runtime.
MCP gateway reference architecture for enterprise deployment
Deploying an MCP gateway in an enterprise environment requires specific architectural patterns to ensure credential security and accurate identity attribution. The fundamental shift moves from static, single-tenant integrations to dynamic, multi-tenant execution flows.
The single-tenant versus multi-tenant deployment pattern dictates how identity flows through the system. In a naive single-tenant architecture, the gateway authenticates to downstream systems using a static service account.
For enterprise scale, you need a multi-tenant identity flow. The original end-user authenticates via the agent user interface, and that specific OAuth identity context passes securely through the gateway. The runtime evaluates the intersection of the agent's baseline capabilities and the human user's specific downstream permissions, acquiring an On-Behalf-Of token before executing the action.
The vaulted secrets pattern is non-negotiable. Credentials must never enter the large language model's context window.
Five primary paths exist for credential leakage: system prompts, retrieval-augmented generation ingestion, tool responses, agent memory, and configuration files. Once a token enters context, a single prompt injection can exfiltrate it. A secure runtime solves this by storing credentials server-side in an isolated vault and injecting them into the network request dynamically at execution time. Credentials stay entirely isolated from the reasoning model.
For integrating with legacy or highly secure internal systems, most enterprises prefer to self-host the action runtime directly within their virtual private cloud or air-gapped environments. This lets agents natively execute actions against internal databases and on-premises APIs without requiring network teams to expose internal systems to the public internet.
Build vs buy: the true TCO of an MCP gateway runtime
Building an MCP gateway looks simple while the scope is local and single-user. The runtime layer is the real work, covering OAuth lifecycle management, credential vaulting, multi-user authorization, permission intersection, audit pipelines, policy enforcement, and observability.
The build path fits three narrow cases: single-user scope, agent infrastructure as the core product, or pipelines where the team owns every API. Outside those cases, the burden compounds with every integration, user, role change, revoked permission, and upstream API change. Teams end up owning token rotation, schema drift, retry logic, audit correlation, and security patches permanently.
A runtime shifts that work out of the application team's roadmap. Platform teams still build proprietary MCP servers where needed, but inherit the runtime layer for auth, vaulting, policy, audit, observability, and governed execution.
How to choose the right MCP gateway or runtime
Solo developer or small team prototyping locally by bundling three or four local servers behind a coding assistant? Use an open-source, standalone gateway like Docker MCP Gateway or Lunar.dev MCPX. These tools provide excellent container isolation and zero-code aggregation without the overhead of enterprise identity setup.
Organization locked deeply into a specific cloud ecosystem that explicitly forbids multi-cloud architectures? Use native cloud gateways. Teams committed entirely to AWS should deploy Amazon Bedrock AgentCore. Microsoft-centric organizations using VS Code and Entra ID should adopt Azure API Management MCP support.
Enterprise platform team deploying sophisticated agents that must take authenticated actions on behalf of multiple distinct users under strict compliance and audit requirements? Choose a complete, portable action runtime like Arcade.
Conclusion
Across all 13 options, the split is clean: standalone gateways route, and runtimes route, authorize, execute, and audit. For a single-user prototype, a standalone gateway is enough. For multi-user production under audit, the best MCP gateway is a runtime.
If you're evaluating how to safely connect AI agents to your enterprise systems without expanding your security blast radius, Arcade provides a runtime that natively handles complex intersection authorization, tool optimization, and tool- and agent-level governance. This lets your engineering teams focus entirely on building agent logic rather than rebuilding integration plumbing.
Read our MCP authorization documentation to see how the two-identity authorization model works in practice to secure your production agents.
FAQ
What is an MCP gateway?
An MCP gateway is a control layer that sits between AI agents and MCP tool servers to handle discovery, routing, and (in mature products) security, policy, and observability.
What is the best MCP gateway for enterprise production?
The best MCP gateway for enterprise production is a runtime that combines gateway federation with delegated authorization, vaulted credentials, hosted execution, permission intersection, and audit logs. Arcade is built for that production runtime model.
What's the difference between a standalone MCP gateway and an action runtime?
A standalone gateway mainly multiplexes requests to multiple MCP servers and relies on each tool for auth and reliability. An action runtime executes tool calls with centralized policy enforcement, delegated per-user authorization, retries, and audit logging, and includes that gateway as one of its capabilities.
Do I need an action runtime for production, or is a standalone gateway enough?
For local development and prototyping, a standalone gateway usually suffices. For enterprise production, especially with multiple users and sensitive systems, you typically need an action runtime to enforce per-action authorization and produce audit trails.
How does delegated authorization (OAuth on-behalf-of) work in MCP?
The user authenticates in the agent UI, and the gateway/runtime exchanges that identity for an On-Behalf-Of token to call downstream systems as the user. This prevents agents from using broad service accounts for every action.
What is the "intersection of permissions" rule and why does it matter?
The rule means the effective permission for a tool call is the overlap of what the user may do and what the agent may do. This reduces blast radius and helps prevent confused-deputy-style privilege escalation.
Why are traditional API gateways not enough for agentic/MCP traffic?
API gateways optimize for stateless HTTP routing and static policies. Agentic traffic needs intent-aware tool execution, schema-driven retries, and per-invocation authorization decisions tied to user identity.
What should I look for in audit logging and observability for MCP tools?
Look for OpenTelemetry-compatible logs/spans that record user identity, agent identity, tool invoked, sanitized arguments, policy decisions, and cost/latency. This lets security teams investigate and prove compliance.
Why do "intent-level tools" reduce token usage compared to raw OpenAPI tools?
Intent-level tools present simpler, agent-optimized inputs so the model doesn't have to reason over large schemas and complex parameters. This typically reduces tokens and lowers parameter-hallucination risk.
Can I run an MCP gateway in a VPC or an air-gapped environment?
Yes, but not all vendors support this. Enterprise teams should confirm support for VPC and air-gapped deployments if they have strict network or data residency requirements.
What's the biggest security risk with naive MCP deployments?
Agents often run with overly broad service-account credentials. This increases the blast radius of prompt injection and enables confused-deputy scenarios where a low-trust user triggers high-privilege actions.
When should I choose Arcade.dev?
Choose Arcade.dev when you need a complete action runtime for multi-user, multi-tenant agent deployments under strict compliance requirements. Arcade is the right fit when your agents must take authenticated actions on behalf of distinct users across multiple business systems, you need delegated authorization enforcing the intersection of agent and user permissions, and your security team requires immutable audit logs and SOC 2 Type II certification. Arcade is agnostic to models, frameworks, and clients, making it a strong choice for teams that want to avoid ecosystem lock-in.
Top comments (0)