Governing MCP servers across a fleet is critical to secure AI agents from shadow AI. Compare the top 5 tools, led by Bifrost for unified control.
A 2026 state of the technology report by Zuplo found that 70% of AI agent consumers have between two and seven Model Context Protocol (MCP) servers configured, with 72% expecting their usage to grow over the next year. As AI coding assistants like Claude Code, Cursor, and GitHub Copilot connect to databases, local filesystems, and cloud APIs, managing these connections becomes an operational challenge. Without centralized infrastructure, developers often hardcode sensitive credentials, leading to sprawl and ungoverned shadow AI. To secure these workflows, engineering teams are adopting dedicated solutions to govern MCP servers across their fleets. Bifrost, an open-source AI gateway written in Go by Maxim AI, is one of several systems designed to handle this routing, enforcement, and auditing from a single point of control.
The Rise of MCP Sprawl and Shadow AI
The Model Context Protocol (MCP), originally introduced by Anthropic, has quickly become the standard interface for connecting Large Language Models (LLMs) to external data sources and developer tools. Rather than writing custom integration code for every tool, developers write an MCP server that exposes tools, resources, and prompts over a structured JSON-RPC protocol.
However, this simplicity has led to a challenge known as MCP sprawl. Because setting up a local MCP server is trivial, individual developers frequently install unverified, community-built servers directly on their local machines. These local servers often have full read and write access to filesystems, terminal execution environments, and internal company databases.
Without central visibility, security teams cannot determine which AI assistants are executing commands on employee machines, which databases are exposed, or where sensitive API keys are being stored. This lack of visibility represents a major governance gap, allowing shadow AI tools to operate completely outside the view of corporate security policies.
Why AI Teams Need to Govern MCP Servers
Operating AI agents at scale requires the same security rigor applied to traditional microservices and API integrations. Allowing agents to query local and remote MCP servers without a control plane introduces several critical risks:
- Credential Sprawl: Local config files (such as those for Cursor or Claude Desktop) often contain long-lived API tokens or access keys pasted by developers, creating a massive credential leakage risk.
- Excessive Privileges: Many MCP servers expose broad administrative capabilities, such as running arbitrary shell commands, when the calling agent only requires access to a single read-only database query.
- Prompt Injection Vulnerabilities: If an AI agent reads untrusted data (such as a customer support email) through an MCP resource, a malicious prompt hidden in that data can trick the agent into calling destructive MCP tools.
- Audit Deficits: Security compliance standards like SOC 2, HIPAA, and GDPR require organizations to maintain immutable records of data access. Direct client-to-server connections leave no centralized audit trail.
To mitigate these risks, platform teams use a centralized MCP gateway to establish a secure, single entry point where corporate policies can be applied globally.
Evaluating MCP Governance Tools: Core Criteria
When choosing a platform to govern an organization-wide MCP fleet, security and operations teams evaluate candidate tools against several core criteria:
- Endpoint Interception: The tool must be able to discover and secure MCP traffic directly on developer laptops, not just remote cloud environments, to prevent local shadow AI.
- Access Control and Tool Filtering: Administrators must be able to hide specific tools or restrict execute permissions based on user identity or roles.
- Identity Provider Integration: The tool should map standard enterprise identity providers (IdPs) like Okta or Microsoft Entra ID to the credentials used by upstream MCP servers.
- Comprehensive Audit Logging: Every tool execution, input prompt, and returned output must be recorded in structured logs for compliance auditing.
Top 5 Tools to Govern MCP Servers Across a Fleet
A variety of gateways and control planes have emerged to manage MCP connections. Below are the five leading tools available for securing and orchestrating MCP servers across developer machines and cloud infrastructure.
1. Bifrost (AI Gateway + Bifrost Edge)
Bifrost is a high-performance, open-source AI gateway that provides enterprise-grade control over model routing, compliance, and tool executions. It is built with a highly optimized Go architecture, adding only 11 microseconds of overhead per request at 5,000 requests per second in sustained benchmarks.
# Example config for routing and securing an upstream MCP server
mcp:
servers:
github:
type: http
url: https://api.github-mcp.internal/mcp
auth:
type: bearer
token: "${GITHUB_MCP_TOKEN}"
To solve the challenge of local developer sprawl, the platform employs a combined AI Gateway + Bifrost Edge architecture. The Bifrost AI gateway acts as the central policy engine and control plane, while Bifrost Edge (currently in alpha) runs as a native endpoint agent on macOS, Windows, and Linux.
Bifrost Edge automatically discovers local MCP servers and builds a fleet-wide MCP server inventory in the administrator console. Administrators can centrally approve or deny these servers, enforcing policy directly on the device. When an approved server runs, Edge routes all AI traffic through the gateway to apply virtual keys, budgets, and endpoint-level guardrails and policies.
Platform teams can deploy Bifrost Edge silently across thousands of corporate laptops using standard MDM platforms like Microsoft Intune and Jamf. To optimize agent executions, Bifrost Code Mode enables the gateway to generate Python scripts that execute multiple tools locally, resulting in up to 50% fewer tokens and 40% lower latency. For fully automated tools, autonomous agent executions run under explicit virtual key permissions with strict auto-approval policies.
Ultimately, this combined system serves as a central control plane for agent-to-tool communication. It applies reusable security profiles and generates immutable compliance records to prevent sensitive corporate data from leaving the host network.
Best for: Enterprises needing a high-performance gateway with native endpoint-level governance to control local developer environments and remote server deployments.
2. Zuplo MCP Gateway
Zuplo offers a fully managed, SaaS-based gateway designed to expose APIs as MCP-ready connections while securing team-wide tool access. It is built on an edge-native serverless architecture, specializing in bridging enterprise authentication with external AI clients.
The platform decouples agent authentication from upstream tools by using a built-in OAuth 2.0 engine. Instead of developers managing raw tokens locally, users authenticate once against the corporate identity provider. The gateway then mints independent, short-lived upstream credentials to call individual services like GitHub, Stripe, or internal databases. It also features robust administrative portals to curate which tools are exposed, allowing platforms to easily restrict raw database writes to read-only tool definitions.
Best for: Cloud-first platform teams seeking a fully managed SaaS gateway to secure and federate third-party API tools using OAuth 2.0.
3. IBM ContextForge
IBM's ContextForge (published as mcp-context-forge on GitHub) is an open-source, Python-based registry and proxy designed to federate MCP, Agent-to-Agent (A2A), and traditional REST or gRPC services behind a unified HTTPS endpoint.
ContextForge is highly extensible, supporting over 35 security plugins that execute pre-request and post-response validation. These plugins handle PII detection, content safety filtering, and rate limiting. It also provides gRPC-to-MCP translation using automatic, reflection-based service discovery, allowing legacy gRPC systems to instantly communicate with MCP-native AI agents. The system is built for Kubernetes deployment and uses a Redis-backed cache for high-throughput federation.
Best for: Self-hosted teams using Python-centric infrastructure who need protocol translation and complex multi-protocol federation.
4. Obot MCP Gateway
Built by the founders of Rancher Labs, Obot is an open-source AI control plane and MCP gateway designed to secure and distribute AI agents and skills across large enterprises.
Obot provides a centralized, web-based registry and app catalog, giving IT teams a clear interface to publish and manage approved MCP servers. The gateway maps user directories (such as Microsoft Entra ID or Okta) to granular access policies, allowing only authorized groups to call specific high-privilege tools. Additionally, Obot correlates user activity across user devices, hosted workloads, and LLM providers to generate a comprehensive audit trail of every database query or file modification executed by an agent.
Best for: IT operations teams needing a centralized, web-based app catalog to distribute approved MCP servers and manage OIDC roles.
5. ToolHive by Stacklok
Developed by the security engineers behind Stacklok, ToolHive is an open-source platform and desktop application designed to run and isolate MCP servers simply and securely.
ToolHive is built on the principle of container isolation. Instead of running unverified community MCP servers directly on a developer’s host OS, ToolHive launches each server inside a lightweight, sandboxed container, preventing unauthorized directory access. ToolHive also provides custom Cursor Hooks that run directly inside the editor to check whether a requested MCP tool is managed by ToolHive. If the server is not containerized and approved, the execution is blocked on the developer's laptop.
Best for: Individual developers and security teams seeking local sandbox containerization of MCP servers during exploration or local execution.
Comparing the Top MCP Governance Platforms
| Feature | Bifrost | Zuplo | IBM ContextForge | Obot | ToolHive |
|---|---|---|---|---|---|
| Deployment Model | OSS / Self-Hosted / VPC | SaaS / Cloud-Edge | OSS / Self-Hosted | OSS / Self-Hosted | OSS / Local Desktop |
| Control Plane | Yes | Yes | Yes | Yes | Yes |
| Endpoint Agent | Yes (Bifrost Edge) | No | No | No | Yes (Desktop App) |
| MDM Fleet Rollout | Yes | No | No | No | No |
| Auth Mediation | OIDC, API Keys | OAuth 2.1, PKCE | JWT, Bearer | SSO, OIDC | Local Keyring |
| Tool-Level ACLs | Yes | Yes | Yes | Yes | Yes |
The Critical Role of Endpoint-Level Governance
Traditional API gateways are effective for securing server-to-server traffic, but they struggle to address the specific vulnerabilities of client-side developer tools. When an engineer configures Claude Code or Cursor on their laptop, the AI agent interacts with local resources directly. If that traffic does not traverse a network-level gateway, it escapes security monitoring completely.
This is why endpoint-level governance is necessary. An endpoint agent like Bifrost Edge runs natively in the background, intercepting tool requests across desktop applications, terminal interfaces, and web browsers. It enforces the organization’s centralized AI gateway policies right on the physical device.
This combination ensures that regardless of where an MCP server is hosted, or how a developer initiates an AI session, the transaction remains fully authenticated, audited, and safe from prompt injection attacks.
Next Steps for Securing Your MCP Fleet
As Model Context Protocol adoption grows, leaving AI-to-tool connections unmonitored introduces serious data security and compliance risks. Securing these interactions requires transition from decentralized local config files to a unified governance layer.
Platform engineers can begin with open-source options to evaluate their current fleet posture. Organizations looking to secure developer machines and cloud integrations simultaneously can schedule a Bifrost demo or inspect the code directly via the open-source repository on GitHub to configure robust, fleet-wide endpoint guardrails.
Sources
- Model Context Protocol (MCP) official website:
https://modelcontextprotocol.io/ - Zuplo MCP Gateway Comparison guide (2026):
https://zuplo.com - IBM ContextForge Gateway repository:
https://github.com/IBM/mcp-context-forge - Obot AI Documentation & Control Plane:
https://obot.ai/docs - Stacklok ToolHive Open Source Platform:
https://github.com/StacklokLabs/toolhive
Top comments (0)