TL;DR
- An open source MCP gateway provides a centralized, self-hosted control plane to route, secure, and monitor connections between AI agents and Model Context Protocol servers.
- Direct point-to-point MCP integration causes tool credential sprawl, exposes internal network services, and depletes LLM context windows through bloated tool schema injection.
- Bifrost is the leading open-source choice, delivering Go-based sub-millisecond execution, Code Mode for 50% token reduction, and virtual key governance.
- Specialized self-hosted gateways such as Docker MCP Gateway, Microsoft MCP Gateway, IBM ContextForge, and Agentgateway offer distinct operational trade-offs across container sandboxing, Kubernetes environments, and protocol translation.
- Teams deploying self-hosted gateways can protect local agent execution by combining network-level proxy controls with endpoint policy enforcement.
An MCP gateway is a centralized proxy that mediates interactions between AI agents and external tool servers under the Model Context Protocol. As engineering teams connect autonomous clients like Claude Code, Cursor, and custom agentic frameworks to dozens of internal databases and APIs, point-to-point connections quickly create security gaps and operational friction. Bifrost, an open-source AI gateway developed in Go by Maxim AI, is one of several production platforms designed to consolidate tool routing, authentication, and policy enforcement under a single control plane. This guide examines nine open-source MCP gateways that organizations can self-host today to secure their agentic infrastructure.
What Is an MCP Gateway and Why Self-Host One?
An open source MCP gateway is a self-hosted intermediary service that sits between AI client applications and Model Context Protocol tool servers. It translates client requests, authenticates callers, enforces granular access policies, aggregates distributed tool definitions, and logs execution traces. Self-hosting ensures sensitive internal APIs, database schemas, and proprietary business logic remain inside private infrastructure boundaries.
In the original Model Context Protocol specification, AI clients connect directly to tools via local standard input/output (STDIO) subprocesses or remote Server-Sent Events (SSE) and Streamable HTTP transports. When an organization operates dozens of agents across multiple developer machines and automated pipelines, this point-to-point approach introduces severe operational challenges:
- Credential Fragmentation: Every developer machine and agent container holds direct credentials for production databases, cloud APIs, and internal services.
- Context Window Exhaustion: Registering 50+ tools directly with an LLM dumps extensive JSON schemas into the prompt context, burning tokens and degrading model reasoning.
- Absence of Centralized Auditing: Security teams cannot track which developer or autonomous agent invoked a destructive tool action.
- Transport Mismatches: Local CLI agents often expect STDIO processes, whereas shared enterprise services run over remote HTTP or gRPC networks.
A self-hosted gateway resolves these issues by acting as a single, governed entry point. It exposes one endpoint to client applications, authenticates incoming agent calls via OAuth 2.0 or virtual tokens, filters available tools dynamically, and executes tools against downstream targets within private VPCs.
+-------------------------------------------------------------+
| AI Agent Clients |
| (Claude Code, Cursor, Custom Agent Frameworks) |
+-------------------------------------------------------------+
|
| Authenticated MCP Traffic
v
+-------------------------------------------------------------+
| Self-Hosted MCP Gateway |
| - Authentication & RBAC - Virtual Keys & Budgets |
| - Schema Pruning & Code Mode - Audit Logs & Guardrails |
| - Protocol Translation - Semantic Caching |
+-------------------------------------------------------------+
|
+----------------------+----------------------+
| | |
v v v
+----------------+ +----------------+ +----------------+
| DB MCP Server | | Git MCP Server | | Cloud API MCP |
| (Postgres/SQL) | | (Internal) | | (AWS / GCP) |
+----------------+ +----------------+ +----------------+
Key Criteria for Evaluating Self-Hosted MCP Gateways
Selecting the right gateway requires balancing raw proxy latency, security isolation, protocol compliance, and token governance. Because tool invocations occur directly in the execution loop of reasoning models, gateway overhead compounds across multi-step agent trajectories.
| Evaluation Criterion | Technical Requirement | Architectural Impact |
|---|---|---|
| Proxy Latency & Concurrency | Sub-millisecond routing overhead, written in compiled languages (Go, Rust). | Prevents multi-step agent workflows from timing out during iterative tool loops. |
| Transport Flexibility | Bidirectional bridging across STDIO, SSE, and Streamable HTTP. | Allows local desktop clients to access remote infrastructure tools transparently. |
| Tool-Level Access Control | Per-user or per-key tool filtering and parameter validation. | Enforces least-privilege access, ensuring agents cannot call destructive tools arbitrarily. |
| Context Window Optimization | Dynamic schema pruning, progressive discovery, or code generation execution. | Reduces prompt token usage by 50% to 90%, preventing context degradation. |
| Identity & Authentication | Support for OAuth 2.0, OpenID Connect (OIDC), and API keys. | Integrates with enterprise identity providers (Okta, Entra ID, Keycloak). |
| Audit Logging & Tracing | OpenTelemetry (OTLP) instrumentation and structured audit trails. | Enables compliance teams to reconstruct agent decisions and tool call histories. |
The 9 Best Open Source MCP Gateways Compared at a Glance
The open-source ecosystem provides several specialized architectures for hosting MCP gateways, ranging from container runtimes to distributed Kubernetes proxies. The table below compares the nine leading self-hosted implementations.
| Gateway | Core Language | Primary Transport Support | Deployment Target | Key Architectural Strength |
|---|---|---|---|---|
| Bifrost | Go | STDIO, SSE, Streamable HTTP | Binary, Docker, Kubernetes | Unified LLM + MCP engine, Code Mode token optimization, microsecond routing. |
| Docker MCP Gateway | Go | STDIO, SSE, Streamable HTTP | Docker Desktop, Docker Engine | Container and microVM isolation per tool server. |
| Microsoft MCP Gateway | C# / .NET | Streamable HTTP, SSE | Kubernetes | Stateful, session-aware routing for enterprise Azure/Kubernetes clusters. |
| IBM ContextForge | Python | STDIO, SSE, Streamable HTTP | Docker, Kubernetes | Protocol translation (REST/gRPC to MCP) and federated tool registries. |
| Obot | Go | Streamable HTTP, SSE | Kubernetes, Docker | Centralized OAuth token brokering and packaged AI platform features. |
| Agentgateway | Rust | Streamable HTTP, SSE, gRPC | Kubernetes, Standalone Binary | Envoy-aligned proxy with Common Expression Language (CEL) policy enforcement. |
| Kong Gateway (MCP Module) | Lua / C | HTTP, SSE, gRPC | Kubernetes, VM, Bare Metal | High-throughput enterprise API gateway with modular plugin architecture. |
| Tyk | Go | HTTP, gRPC, SSE | Kubernetes, Docker, Bare Metal | Mature API gateway governance adapted for MCP tool routing. |
| MCPJungle | Python | STDIO, SSE, HTTP | Docker, Local Python | Lightweight registry and tool aggregator for rapid self-hosting. |
1. Bifrost
Bifrost is a high-performance, open-source AI and MCP gateway built in Go by Maxim AI. It is engineered to unify LLM model routing and MCP tool governance into a single infrastructure layer. Rather than treating tool execution as an external plugin, Bifrost acts simultaneously as an MCP client and an MCP server, allowing it to aggregate distributed tool backends and present a clean, governed interface to any AI client.
+-------------------------------------------------------------------------+
| Bifrost |
| |
| +---------------------------+ +-------------------------------+ |
| | Inbound Clients | | Virtual Key Engine | |
| | (Claude Code, Cursor) | ----> | - Tool Filtering & Scopes | |
| +---------------------------+ | - Dollar & Rate Budgets | |
| +-------------------------------+ |
| | |
| +-------------------------------------------+ |
| v v |
| +-----------------------+ +-----------------------+ |
| | Agent Mode | | Code Mode | |
| | - Autonomous Loop | | - Python Sandbox Run | |
| | - Configurable Auto- | | - 50% Token Reduction | |
| | Approval Workflows | | - Single Round-Trip | |
| +-----------------------+ +-----------------------+ |
| | | |
+----------|-------------------------------------------|------------------+
| |
+--------------------+----------------------+
|
v
+-------------------------------+
| Downstream MCP Servers |
| (Databases, Git, APIs, CLI) |
+-------------------------------+
The system includes two dedicated MCP execution architectures: Agent Mode and Code Mode. In Agent Mode, the gateway runs autonomous tool loops with configurable auto-approval settings. In Code Mode, the gateway instructs the model to write Python code that orchestrates multiple tools inside a sandbox, reducing token consumption by up to 50% and cutting latency by 40% compared to standard iterative round-trips.
Bifrost enforces security and governance through virtual keys. Administrators assign virtual keys to specific teams, applications, or developers, setting granular budgets, rate limits, and tool filtering policies. If an agent attempts to execute an unauthorized tool, the gateway intercepts and blocks the call before execution begins. For enterprise deployments, Bifrost supports clustering for high availability, zero-downtime rolling upgrades, and content guardrails.
Beyond server-side routing, the Bifrost platform addresses client-side risks. Bifrost applies centralized governance and security controls (virtual keys, budgets, guardrails, audit logs) at the gateway, and Bifrost Edge extends that same governance and security to AI traffic on employee machines, with endpoint enforcement across desktop AI tools and local MCP servers.
{
"virtual_key": "vk_dev_analytics_team",
"budget": {
"amount": 250.00,
"period": "monthly"
},
"mcp_rules": {
"allowed_servers": ["postgres-internal", "github-read"],
"blocked_tools": ["postgres_drop_table", "github_delete_branch"],
"require_approval": ["postgres_write_query"]
}
}
Performance benchmarks published on the benchmarks resource page show that Bifrost adds only 11 microseconds of overhead per request at 5,000 requests per second. It connects natively to over 1,000 models across OpenAI, Anthropic, AWS Bedrock, Google Vertex AI, and local vLLM instances, giving teams unified control over both model access and tool execution through its dedicated MCP gateway engine.
Best for: Engineering teams and enterprise organizations requiring a high-performance, unified AI and MCP gateway that combines microsecond-level routing, aggressive token reduction via Code Mode, and complete governance over models, tools, and endpoints.
2. Docker MCP Gateway
The Docker MCP Gateway is an open-source initiative created by Docker to manage MCP servers as containerized workloads. Traditional MCP tools execute directly on the host operating system, exposing local filesystems, environment variables, and private networks to potential agent errors or prompt injections. Docker isolates each tool server within its own container runtime, enforcing strict hardware, network, and storage boundaries.
# Run Docker MCP Gateway to aggregate local containerized servers
docker mcp gateway run --port 8080 --config ./mcp-catalog.json
The gateway integrates directly with the Docker Hub MCP Catalog, giving teams access to hundreds of verified, pre-configured server images. It translates incoming client requests from standard client interfaces (such as Claude Desktop or VS Code Copilot) into container network calls. By wrapping server lifecycles inside Docker Compose or Kubernetes, operators can enforce CPU limits, memory quotas, and read-only filesystem mounts on third-party tools.
Best for: Developers and DevOps teams looking to eliminate dependency conflicts and protect host environments by isolating MCP tool servers inside containerized sandboxes.
3. Microsoft MCP Gateway
Microsoft MCP Gateway is an open-source reverse proxy and management layer designed specifically for running MCP servers at scale on Kubernetes. Implemented in C# and .NET, the gateway focuses on solving statefulness and session persistence in distributed environments. Because many complex agent workflows maintain stateful interactions with tool servers over extended sessions, standard stateless load balancers frequently break multi-turn agent execution.
The architecture includes a Tool Gateway Router that dynamically inspects incoming tool requests and routes them to appropriate Kubernetes pods based on tool capabilities and session identifiers. It provides native integration with Microsoft Entra ID (Azure AD), allowing enterprise platform teams to map enterprise user identities to role-based access control (RBAC) policies across tool clusters.
Best for: Enterprise platform engineers managing Kubernetes clusters within Microsoft Azure who require session-aware routing and native Entra ID authentication.
4. IBM ContextForge
IBM's ContextForge is an open-source tool and agent registry and proxy created to federate disparate interfaces into a single endpoint. In large enterprises, most operational tools exist as traditional REST or gRPC endpoints rather than native MCP servers. ContextForge bridges this gap by offering protocol translation, generating MCP tool definitions directly from OpenAPI specifications or gRPC proto definitions without requiring code modifications.
ContextForge also incorporates TOON (Token-Optimized Object Notation) compression, which strips redundant structural metadata from JSON outputs before passing results back to the calling LLM. Furthermore, it supports Agent-to-Agent (A2A) communication protocols, allowing multi-agent systems to discover other agents as tools across the network.
Best for: Organizations with extensive legacy REST and gRPC API ecosystems that need to expose existing services as MCP tools without rewriting application backends.
5. Obot
Obot is an open-source MCP gateway and agent orchestration platform that provides a complete administrative control plane for enterprise tool management. While some gateways operate purely as headless network proxies, Obot includes a full administrative UI, identity brokering, and user permission management.
The core strength of Obot is centralized OAuth delegation. When tools require individual end-user credentials (such as Google Workspace, GitHub, or Jira), Obot handles token brokering, automatic token refresh, and per-user scope enforcement. The calling AI agent never receives raw authentication secrets; instead, Obot executes tool requests on behalf of the authenticated user, logging every operation in an immutable audit trail.
Best for: Teams requiring a complete self-hosted control plane with web management dashboards and automated OAuth token brokering for user-specific tool integrations.
6. Agentgateway
Agentgateway is a high-performance open-source proxy written in Rust, hosted under the Linux Foundation. Created by Solo.io in collaboration with the cloud-native community, Agentgateway treats MCP, A2A, and LLM inference traffic as first-class network protocols alongside standard HTTP and gRPC.
The gateway features a policy engine based on Google's Common Expression Language (CEL), enabling operators to write fine-grained authorization rules that inspect tool names, caller identities, and JSON arguments. It integrates directly with the Kubernetes Gateway API and Inference Gateway extensions, allowing intelligent tool routing based on cluster state, queue depth, and model server availability.
# Agentgateway tool-level authorization policy
apiVersion: gateway.agentgateway.dev/v1alpha1
kind: ToolPolicy
metadata:
name: restrict-production-tools
spec:
targetRef:
name: mcp-upstream-gateway
rules:
- match: "request.tool.name.startsWith('admin_')"
action: Deny
condition: "!('admin' in request.auth.claims.roles)"
Best for: Kubernetes-centric infrastructure teams and DevOps engineers looking for a cloud-native, Rust-based data plane that aligns with Envoy and Kubernetes Gateway API standards.
7. Kong Gateway (AI Gateway MCP Module)
Kong Gateway is a widely deployed open-source cloud-native API gateway built on Nginx and OpenResty. Through its AI Gateway capabilities and community plugins, Kong allows organizations to proxy and manage MCP traffic using the same infrastructure that powers their traditional API estates.
Kong provides battle-tested rate limiting, mutual TLS (mTLS), IP allowlisting, and distributed tracing plugins. By placing Kong in front of remote MCP servers operating over SSE or Streamable HTTP, platform teams can enforce consistent enterprise traffic policies without introducing a separate, untested proxy layer into their network architecture.
Best for: Enterprises already running Kong in production that want to manage MCP traffic through existing API infrastructure and Lua-based middleware.
8. Tyk
Tyk is an open-source enterprise API gateway written in Go that supports REST, GraphQL, gRPC, and Model Context Protocol routing. Tyk's approach treats MCP tools as managed API endpoints, applying established API management patterns to AI tool invocation.
Tyk provides key management, quota tracking, comprehensive analytics, and custom middleware scripting via JavaScript, Python, or Go plugins. Because it uses a shared-nothing Go architecture, Tyk scales horizontally across multi-cloud and on-premise environments with minimal operational friction, making it a reliable option for teams treating MCP servers as internal microservices.
Best for: Platform teams seeking an established Go-based API management solution that bridges standard microservices and MCP tool routing under unified governance.
9. MCPJungle
MCPJungle is a lightweight, open-source MCP gateway and registry designed for simple self-hosting. Unlike large enterprise gateways that require Kubernetes clusters or external databases, MCPJungle can be deployed locally or in a single Docker container within minutes.
MCPJungle allows developers to register local STDIO servers and remote HTTP endpoints into a unified catalog. It exposes a consolidated MCP endpoint to client applications, eliminating the need to update client configuration files every time an MCP server is added or modified. It also includes basic API key authentication and request logging, making it suitable for small teams and staging environments.
Best for: Small engineering teams and individual developers who need a simple, single-container tool aggregator without enterprise deployment complexity.
Architectural Deep Dive: Token Optimization, Security, and Edge Governance
Deploying an MCP gateway in production involves tradeoffs across protocol transport, token costs, and security boundaries. A basic reverse proxy simply forwards JSON-RPC messages; a true MCP gateway actively optimizes the agent-tool execution cycle.
Context Window Optimization: The Token Explosion Problem
When an agent connects to multiple MCP servers, the gateway exposes tool schemas to the LLM. If an agent connects to five servers that each declare twenty tools, the client must inject one hundred full JSON schemas into the prompt context on every request. This causes two immediate issues:
- Massive Token Overhead: Tool definitions can consume 10,000 to 30,000 tokens before the conversation even begins, rapidly increasing operational costs.
- Model Confusion: LLMs experience degradation in reasoning accuracy and tool selection when presented with massive tool lists.
Production gateways solve this through progressive disclosure and alternative execution models. In Bifrost, Code Mode replaces iterative conversational tool calls with programmatic execution. Instead of round-tripping through the model for every tool invocation, the LLM generates a single Python script that executes against the gateway's sandbox. The gateway orchestrates the internal tool calls directly, returning only the final processed output to the model. This eliminates intermediate reasoning tokens and reduces latency by 40%.
Security, Protocol, and Governance Matrix
The table below outlines how the nine open-source gateways implement transport protocols, security boundaries, and enterprise governance controls.
| Gateway | Supported Transports | Tool Isolation Model | Token Optimization Technique | Auth & Identity Support | Compliance & Audit Trail |
|---|---|---|---|---|---|
| Bifrost | STDIO, SSE, Streamable HTTP | Virtual key filtering & container sandboxing | Code Mode (Python orchestration) + Schema pruning | OAuth 2.0, API keys, OIDC | OpenTelemetry, Prometheus, structured audit logs |
| Docker MCP Gateway | STDIO, SSE, Streamable HTTP | Process-level microVM & container boundaries | Catalog-level tool selection | API keys, Docker SSO | Container runtime logs |
| Microsoft MCP Gateway | Streamable HTTP, SSE | Kubernetes Pod isolation | Dynamic tool capability routing | Microsoft Entra ID (OIDC / OAuth) | Kubernetes audit logging & Azure Monitor |
| IBM ContextForge | STDIO, SSE, Streamable HTTP | Process isolation | TOON metadata compression | API keys, basic auth | OpenTelemetry tracing |
| Obot | Streamable HTTP, SSE | Container isolation | Dynamic catalog filtering | OAuth 2.0 token brokering, OIDC | Full user-to-tool audit logs |
| Agentgateway | Streamable HTTP, SSE, gRPC | Network namespace isolation | CEL-based request transformation | JWT, OAuth, API keys | OpenTelemetry metrics & traces |
| Kong Gateway | HTTP, SSE, gRPC | Network proxy perimeter | Route-level plugin filtering | OAuth 2.0, mTLS, OIDC, API keys | Syslog, Datadog, Prometheus |
| Tyk | HTTP, gRPC, SSE | API endpoint isolation | Policy-based tool exposure | OAuth 2.0, HMAC, JWT, API keys | Tyk Analytics, OpenTelemetry |
| MCPJungle | STDIO, SSE, HTTP | Host process | Centralized catalog aggregation | Basic API keys | File-based request logs |
Bridging Gateway and Endpoint Governance
Securing server-side infrastructure with an MCP gateway addresses only half of the attack surface. In enterprise environments, developers regularly run local AI tools, such as Claude Desktop or Cursor, configured with local MCP servers on their laptops. These local tools bypass the central gateway entirely, re-introducing unmonitored data exfiltration and credential risks.
A comprehensive architecture pairs gateway-level routing with endpoint-level enforcement. While Bifrost governs traffic at the infrastructure level through data access control and audit logs, the Bifrost Edge endpoint agent runs natively across macOS, Windows, and Linux to govern endpoint AI applications. Edge automatically routes local AI interactions through the central gateway's policy engine, enforcing the same content guardrails and virtual key permissions across developer laptops without requiring manual app-by-app configuration.
Frequently Asked Questions
What is the difference between an MCP gateway and an API gateway?
An API gateway manages standard HTTP/REST requests between software clients and microservices, focusing on path routing, rate limits, and authentication. An MCP gateway specifically understands the Model Context Protocol, managing JSON-RPC schemas, bidirectional SSE/Streamable HTTP transports, dynamic tool filtering, and LLM context window optimization.
Can an MCP gateway convert REST APIs into MCP tools automatically?
Yes, certain gateways provide protocol translation capabilities. Gateways like IBM ContextForge parse OpenAPI specifications or gRPC proto files and automatically expose those endpoints as standard MCP tools to AI clients, eliminating the need to write custom server wrappers.
How does an MCP gateway reduce LLM token costs?
An MCP gateway reduces token costs by pruning unused tool schemas from the prompt, dynamically injecting only relevant tools, and utilizing execution patterns like Bifrost's Code Mode. Code Mode allows the model to write execution code rather than engaging in multi-turn conversational tool calls, cutting token usage by up to 50%.
What is the most secure transport protocol for self-hosted MCP gateways?
Streamable HTTP with OAuth 2.1 authentication is the most robust and secure transport for enterprise deployments. While local STDIO is common for desktop development, Streamable HTTP enables stateless load balancing, standard header inspection (via Mcp-Method headers), and centralized identity validation across network perimeters.
Is self-hosting an MCP gateway better than using a managed service?
Self-hosting provides total data sovereignty, zero third-party data processing risks, and complete access to internal network resources within private VPCs. Organizations operating in regulated industries or with strict compliance mandates (HIPAA, SOC 2, GDPR) generally require self-hosted gateways to prevent tool payloads and database schemas from traversing external vendor clouds.
How does an MCP gateway handle user authentication for tools like Jira or GitHub?
Advanced MCP gateways support OAuth token brokering. Instead of sharing a single global service credential, the gateway integrates with enterprise identity providers to authenticate individual users, passing user-scoped tokens to downstream tool servers and logging the exact human identity responsible for each action.
Getting Started with Self-Hosted MCP Infrastructure
Managing agentic tool connections with ad-hoc configuration files creates security liabilities and inflates operational token costs. Deploying an open-source MCP gateway gives engineering teams centralized visibility, granular access control, and reliable tool execution across all developer environments.
Teams planning production deployments should assess whether they require a standalone proxy, a container isolation runtime, or a unified AI data plane. Organizations that need a unified platform for multi-provider LLM routing, high-throughput MCP tool execution, and fleet-wide endpoint policy can request a Bifrost demo or inspect the codebase directly in the open-source GitHub repository.
Sources
- Model Context Protocol Specification - Official core specification defining JSON-RPC interfaces, transports, and message schemas.
- Model Context Protocol Blog: The 2026-07-28 Specification - Lead maintainer release detailing stateless protocol architecture, header-based routing, and authorization standards.
- Agentic AI Foundation Interceptors Charter - Standards documentation outlining gateway and proxy interception patterns across the agentic lifecycle.
- Bifrost Documentation - Official technical architecture, benchmark records, and configuration guides for the Bifrost AI and MCP gateway.
Top comments (0)