Best MCP Gateways in 2026: Ten Scored Criteria and Five Disqualifiers

Every MCP gateway ranking on this search result is written by a gateway vendor that put itself first — so here is a scored documentation audit of ten gateways, including our own, which finishes last.

Publisher disclosure: This site is published by ASCENDING, which builds Jarvis AI — including Jarvis Registry, an MCP and agent gateway that competes with several products scored below. Every capability here comes from vendor documentation opened on 14 August 2026 and cited inline. The Jarvis row is flagged wherever it appears, and it finishes last.

The scorecard: ten MCP gateways against ten criteria

If you already know what an MCP gateway is, the question is which one, and on what evidence. Each gateway scores 0, 1, or 2 per criterion — 20 possible.

One product clears 15 of 20; six cluster at 13 or 14; three sit at 10 or 11. Almost every entrant covers most criteria and leaves two or three genuinely empty, and the middle compresses so tightly that the columns matter far more than the ranking. Read down the column that matches your binding constraint.

How the scoring works, and what a zero means

This is a documentation audit, not a bake-off. I did not deploy ten gateways; I opened each vendor's own documentation on 14 August 2026 and scored what it states.

2 means the capability is documented specifically — named flags, RFCs, policy variables, quoted behaviour. 1 means it is documented generically ("OAuth support", "audit trails") without detail an architect could implement or an auditor could test. 0 means I could not open a vendor document confirming it.

One rule matters more than the rest, because it is the rule vendor-authored comparisons break: before scoring a zero, read the vendor's wider documentation set, not just the page that markets the capability. A control documented three clicks away is still documented, and a scorecard that reads one convenient page per competitor is not an audit. A surviving zero is still not proof of absence — but a capability you cannot cite is one you cannot put in a contract.

Credit where due, with two qualifications: Obot's evaluation framework for enterprise MCP gateways is the clearest framing ranking for this query, but Obot is itself a gateway vendor and one of only three products it compares — the exact pattern the sixth disqualifier below tells you to discount — and it dates from August 2025, a full spec revision ago. Use its questions, not its conclusions.

Out of scope: protocol definition (MCP glossary), handshake mechanics (MCP gateway auth and discovery) and the server-side threat model (MCP server security hardening).

Criterion 1: authorization, and the checkbox that went stale in July 2026

Start here, because most published gateway comparisons test the wrong thing.

MCP's current specification revision is 2026-07-28. In it, servers MUST implement OAuth 2.0 Protected Resource Metadata (RFC 9728), clients MUST implement Resource Indicators (RFC 8707), and servers MUST validate token audience — they "MUST NOT accept or transit any other tokens" [1].

The part that invalidates older checklists: authorization servers and clients SHOULD support OAuth Client ID Metadata Documents, while RFC 7591 Dynamic Client Registration is now "deprecated and retained for backwards compatibility" [1]. DCR has been this category's headline authorization checkbox for a year; it is now the legacy path.

What scored a 2. Zuplo runs its own OAuth 2.1 authorization server and supports both DCR and Client ID Metadata Documents, with CIMD the recommended path [2]. AgentCore serves RFC 9728 metadata at /.well-known/oauth-protected-resource and distinguishes 401 from 403 insufficient_scope [3]. Tyk "implements PRM natively" and returns the correct WWW-Authenticate challenge [4]. Kong's AI MCP OAuth2 plugin puts the gateway in the Resource Server role and "validates tokens, checks the intended audience, and blocks invalid or expired tokens" [5].

Everyone else scored 1, including Jarvis Registry, which lists OAuth and SAML and stops there [6]. Generic OAuth language is not conformance evidence.

Criteria 2–3: per-tool policy and credential brokering

Criterion 2 — per-tool authorization. Server-level allow/deny is not policy: one MCP server exposes dozens of tools with wildly different blast radii, and search_tickets and delete_project arrive over the same connection. The test is whether policy binds tool name to caller identity — and whether denied tools are filtered out of tools/list.

agentgateway is the strongest documented implementation: CEL-based RBAC over mcp.tool.name and mcp.tool.target against JWT claims, and "if a tool or other resource is not allowed, agentgateway automatically filters the resource from list responses" [7]. Tyk matches it — policy names "which individual tools, resources, and prompts it can invoke or discover," and tools/list "returns only the primitives that consumer is permitted to see" [4]. Kong's per-tool ACL is "an all-or-nothing override" of default_acl, evaluated deny-first [8]. Zuplo's mcp-capability-filter-inbound policy curates the same list methods [2]. AgentCore attaches policy engines that "use Cedar policies to define authorization rules with enforcement modes for logging only or actively enforcing access decisions" [26].

Docker scores 1: its allowlisting is real but static — enabled per gateway profile, not per calling identity [9], a deployment-time control, not an authorization one.

Criterion 3 — credential brokering. The gateway should hold upstream credentials and mint fresh, audience-scoped tokens downstream; the anti-pattern is passthrough, replaying the caller's inbound token to the target.

Seven products document a real mechanism. AWS states the trade-off most plainly: AgentCore supports JWT_PASSTHROUGH but warns it is "not the recommended approach for production," directing production users to on-behalf-of exchange for "a fresh, audience-scoped token" [3]. Zuplo stores upstream tokens "encrypted at rest, keyed by user" [2]. IBM ContextForge documents Authorization Code and client-credentials flows with PKCE "automatically enabled," secrets "stored encrypted at rest," and tokens "scoped per ContextForge user" [23]. agentgateway strips the caller's credential by default and can "exchange the incoming request's credential for a new, backend-specific token" [24]. Tyk sells Enterprise "OAuth 2.0 client credentials for OAuth-protected upstream MCP servers" [21] plus a token exchange after which "the inbound SSO token never reaches the upstream MCP server" [22]. Kong withholds tokens from upstreams by default [5]; TrueFoundry separates inbound auth, outbound auth and token management [10].

Docker, MintMCP and Jarvis Registry score 1: each describes handling credentials without naming the token it mints downstream. If your gateway cannot say which credential reached the SaaS tenant and who authorised it, you have added a hop — the argument in agent gateway vs API gateway.

Criteria 4–5: tool-description integrity and blast radius

These two columns are nearly empty across the field — the most important thing on the scorecard.

Criterion 4 — tool-description integrity. Invariant Labs published the tool poisoning attack in April 2025: "malicious instructions are embedded within MCP tool descriptions that are invisible to users but visible to AI models," alongside shadowing and rug pulls, where "a malicious server can change the tool description after the client has already approved it" [11]. Tool descriptions are prompt content: a gateway that proxies them without re-verification is a prompt-injection conduit with an audit log — see prompt injection defense for enterprise agents.

Exactly one gateway scores 2: Docker's --verify-signatures "verifies signatures of Docker MCP server images (default true)" [9]. AgentCore and ContextForge score 1 for documenting a place to put the control — interceptor Lambda functions [3], a 40-plus-plugin framework [12] — without shipping it. Everyone else, Jarvis Registry included, scores 0.

Criterion 5 — egress and blast radius. When a tool call goes wrong, what stops it? Docker is again alone at 2: --block-network "blocks tools from accessing forbidden network resources," --block-secrets is on by default, and per-server --cpus and --memory caps sit on top of container isolation [9]. AgentCore scores 1 for private VPC connectivity [3].

The uncomfortable read: the strongest containment controls come from the vendor with the weakest authorization story — Docker treated this as a supply-chain problem while everyone else treated it as identity. If exfiltration dominates your risk register, the highest-scoring gateway is not your answer.

Criteria 6–7: audit evidence and observability granularity

Criterion 6 — audit-log content. The bar is not "we have logs" but whether one log line answers, for one tool call: which human, which agent, which tool, which arguments, which policy decision, which upstream credential — the chain described in COSO's generative-AI control evidence guidance.

Zuplo publishes the most inspectable artifact: typed events across the MCP request, capability-invocation and OAuth lifecycles, where "structured logs carry tenant, MCP session, capability, latency, and failure origin," each failure mapped to a documented reason code [20]. Kong logs all ACL evaluations to an audit trail [8], Tyk emits structured access logs with OpenTelemetry metrics [4], and ContextForge documents OTel export to "Phoenix, Jaeger, Zipkin, and other OTLP backends" [12]. TrueFoundry claims "complete visibility and audit trail for all tools usage" [10], MintMCP "complete audit trails for every tool interaction" [13], Jarvis Registry "complete audit trails for every AI interaction" [6].

Note the pattern in that last group: three vendors, ours included, score 2 on a marketing sentence and none publish a log schema. A vendor that cannot produce a sample line has not built the export path — hence disqualifier four.

Criterion 7 — observability granularity. Per-proxy metrics tell you the gateway is up; per-tool metrics tell you which tool is burning context budget and which one quietly started failing. Tyk is explicit — "proxy-level charts" plus "primitive-level charts" broken down by individual tool, resource or prompt [4]. Zuplo splits p95 latency between gateway and upstream and attributes each failure to gateway, upstream or client [20]. TrueFoundry monitors "MCP server and tool-level request rates, latency, failures, and usage patterns" [10], and ContextForge inherits full OTel tracing [12]. Jarvis Registry lists real-time logs, analytics and alerts as separate features without stating granularity, and scores 1 [6]. See agent observability.

Criteria 8–10: federation, deployment, and the compliance claim

Criterion 8 — federation and nested servers. Past roughly thirty tools, tool-list bloat becomes the operational problem — every description is prompt tokens on every turn. ContextForge federates MCP, A2A and REST/gRPC into virtual servers across Kubernetes clusters [12], agentgateway multiplexes MCP backends behind one endpoint with composable multi-step tools [14], and Kong's AI MCP Proxy aggregates conversion-only tool definitions by tag [8].

AgentCore is the most distinctive: set the MCP gateway configuration's searchType to SEMANTIC — the only value the API accepts [27] — and agents call a built-in x_amz_bedrock_agentcore_search tool to find tools by natural-language query instead of loading the full catalog [15]. The catch is sharp: "You can only enable semantic search when creating a gateway" [26], an irreversible day-one decision. Wider trade-offs in AWS AgentCore vs Azure AI Foundry.

Criterion 9 — deployment model. This column discriminates less than buyers assume: eight of ten entrants document a self-managed path. TrueFoundry documents seven options, the most permissive self-hosting "the control-plane, gateway plane and compute plane all in your own infrastructure," though a licensing endpoint still receives employee emails and request counts [16]. ContextForge ships via PyPI, Docker or Helm under Apache 2.0 [12], Docker's is a CLI plugin on your own hosts [9], Kong documents traditional, hybrid and DB-less topologies [30], Tyk offers "Cloud, self-hosted, or hybrid" [21], and Jarvis Registry names EKS, AKS, GKE, hybrid and on-premises Kubernetes [6].

Zuplo also scores 2, and it is the trap this criterion sets. Its architecture page says statelessness "is what lets the gateway run on Zuplo's edge runtime" [2] — a scaling property, not a hosting restriction. Its hosting page documents Managed Edge, Managed Dedicated on the cloud provider of your choice, and "Self-Hosted (On-Premises)," which "runs exclusively on Kubernetes and is installed with a single Helm chart into your cluster" [19]. Read one page and you eliminate a strong product; read two and you do not.

MintMCP is weakest at 1: "Self-hosted or cloud deployment" [28], naming no orchestrator or isolation boundary. AgentCore also scores 1, being AWS-managed [3].

Criterion 10 — the compliance claim. Three products score 2. AgentCore's own compliance page states the service "is HIPAA eligible and FedRAMP (Class C), SOC 2 and ISO (27001:2022, 27017:2015 …) and CSA STAR compliant" [25] — named programs, named revisions, the service itself named. TrueFoundry documents SOC 2 Type II plus HIPAA and GDPR, and marks the boundary: certifications "apply to TrueFoundry's managed infrastructure," not to planes you self-host [17]. MintMCP states "enterprise-grade security and compliance (SOC 2 Type II)" [13].

Tyk scores 1, publishing ISO 27001, ISO 9001, SOC 2 and PCI DSS as company certifications without stating SOC report type or scope [29]. Docker, Kong, ContextForge, agentgateway and Jarvis Registry score 0 — structural for the open-source entrants, which have no service to attest.

Jarvis Registry scores 0 here, stated without hedging: ASCENDING publishes no SOC 2, HIPAA or FedRAMP certification claim for Jarvis Registry, and none should be inferred from this article. If your gate is a certification artifact, three products here clear it and ours is not one of them.

Five disqualifiers that should end an evaluation

Criteria produce a ranking. Disqualifiers produce a shorter list faster.

1. Inbound tokens are replayed to upstream targets by default, with no exchange path. AWS labels this pattern non-production [3]. A vendor presenting passthrough as the primary integration model has built a reverse proxy and called it a gateway.

2. Authorization is server-scoped only. If policy cannot name a tool, you cannot express "read the CRM, never write it" — the first policy every real deployment needs.

3. The deployment claim is a phrase rather than a document. Residency is binary, so verify it against something an architect can build from. The failure mode here is almost never a missing option; it is an unelaborated one. MintMCP offers "Self-hosted or cloud deployment" [28] and nothing further, while Zuplo names the runtime, the orchestrator and the install path [19]. One survives a residency review; the other becomes an unanswered questionnaire item.

4. The vendor cannot produce a sample audit log line. Not a dashboard screenshot — structured output with caller identity, tool name, arguments and policy decision. The fastest lie detector in the category.

5. Tool descriptions are proxied unverified with no change detection. Rug pulls work because MCP has no re-verification step after approval [11]; a gateway that never re-checks a description is a distribution channel for whatever the upstream server says next month.

A sixth, softer one: if a vendor's comparison table puts that vendor first on every row, discount the document.

Where each gateway actually wins

The one-line case for each:

Solo.io contributed agentgateway to the Linux Foundation in August 2025, with AWS, Cisco, IBM, Microsoft and Red Hat among named contributors [18]. Neutral governance is a criterion no proprietary product here — ours included — can score against.

Scoring Jarvis Registry against our own criteria

Jarvis Registry is our product. It scores 10 of 20 — last, tied with MintMCP and five points behind AWS AgentCore. Applying our own rules to our own product, here is where it loses.

Compliance posture (0/2). AgentCore, TrueFoundry and MintMCP each publish a certification artifact [25][17][13]. Jarvis Registry publishes none [6].

Tool-description integrity and blast radius (0/2, 0/2). Docker ships signature verification, network blocking and per-server resource caps as documented defaults [9]. We publish nothing equivalent.

Credential brokering (1/2). Seven products name the downstream token they mint and how it is scoped [23][24]. Our page describes governed access without describing the exchange — the column where the field moved furthest ahead of us.

Documented authorization detail (1/2). Listing OAuth and SAML [6] is not the artifact Zuplo produces by naming CIMD-first registration [2], or AgentCore by naming RFC 9728 and on-behalf-of exchange [3].

Observability granularity (1/2), losing to Tyk's primitive-level charts [4] and Zuplo's failure-origin attribution [20].

Where it holds up: "fine-grained access controls at the tool level," complete audit trails, and Kubernetes-anywhere deployment across EKS, AKS, GKE, hybrid and on-premises in one product [6] — governed tool access plus data-residency control without a SaaS hop. A genuine fit for regulated US buyers — one several competitors also offer.

The reason to publish this rather than a table where we win: an evaluation you cannot check is worth nothing. Treat our row exactly as the other nine — open the citation, and if the page does not say it, do not score it. Then open the pages the citation does not link, where most of these scores were decided.

The shortlist by buying situation, and what to put in the RFP

Four situations cover most enterprise MCP gateway decisions.

Regulated, US, data cannot leave your VPC. Eliminates less than buyers expect: TrueFoundry, IBM ContextForge, Kong, Tyk, Zuplo, Docker, agentgateway and Jarvis Registry (our product — see disclosure) all document a self-managed path [16][12][30][21][19][6]. AgentCore is the genuine exclusion. Pair the decision with HIPAA-compliant AI agent architecture.

Already on a cloud or API-management vendor. AgentCore if you are AWS-native; Kong if you already run Kong — but its MCP plugins need AI Gateway Enterprise on 3.12 or later [8].

Certification artifact is the gate. AgentCore has the broadest published scope, TrueFoundry states SOC 2 Type II with a self-hosting caveat, and MintMCP publishes SOC 2 Type II [25][17][13]. Everyone else, ours included, will be answering questionnaires.

Lock-in is the primary long-horizon risk. agentgateway under Linux Foundation governance [18], or ContextForge under Apache 2.0 [12]. Budget for the integration work those choices transfer to you.

Whichever you pick, put these six demands in the RFP and score the answers, not the deck. One: your client registration mechanism — CIMD or deprecated DCR [1]. Two: one structured audit log line for one tool call. Three: the policy expression denying one tool to one group, proven absent from tools/list. Four: whether the inbound token reaches the upstream target. Five: the deployment model satisfying our residency constraint. Six: the current certification report, or a plain statement that none exists.

Any vendor answering all six in writing belongs on your shortlist. Score what you can open, and revisit when the next spec revision lands.

FAQ

What is the single most important MCP gateway evaluation criterion?

Per-tool authorization bound to caller identity, with denied tools filtered out of tools/list rather than merely blocked on invocation. Server-level allow/deny cannot express "read the CRM, never write it," and a tool the model can see is a tool it will eventually try. agentgateway and Tyk document this most precisely: agentgateway filters unauthorised resources from list responses, and Tyk returns only the primitives a consumer may see.

Is dynamic client registration still a valid gateway requirement in 2026?

No, and this is the fastest way to date a vendor comparison. MCP's current specification revision, 2026-07-28, marks OAuth 2.0 Dynamic Client Registration (RFC 7591) as deprecated, retained only for backwards compatibility with authorization servers that do not support OAuth Client ID Metadata Documents — which clients and authorization servers now SHOULD support instead. Scoring DCR as the headline authorization capability tests whether a vendor read the 2025 spec rather than the current one.

Which MCP gateways can I self-host inside my own VPC?

Eight of the ten, verified from vendor documentation on 14 August 2026. TrueFoundry self-hosts the control, gateway and compute planes in customer infrastructure; IBM ContextForge ships via PyPI, Docker or Helm under Apache 2.0; Docker MCP Gateway is a CLI plugin; Kong documents self-managed traditional, hybrid and DB-less topologies; Tyk offers cloud, self-hosted or hybrid; agentgateway is a self-hosted proxy; Zuplo documents a Self-Hosted (On-Premises) option running exclusively on Kubernetes via a single Helm chart; and Jarvis Registry (our product) deploys on EKS, AKS, GKE and on-premises Kubernetes. AWS AgentCore is managed-only by design; MintMCP's claim is one unelaborated phrase.

Do any MCP gateways defend against tool poisoning attacks?

Barely. Tool poisoning embeds model-visible, user-invisible instructions in tool descriptions; rug pulls change a description after approval. Of the ten scored, only Docker MCP Gateway ships a documented control — --verify-signatures, which verifies MCP server image provenance and is on by default. AWS AgentCore and IBM ContextForge document extension points where you could build detection, but neither ships it. Assume you are buying the control plane and building change detection yourself.

Should I trust vendor-published MCP gateway rankings?

Verify every capability claim against the vendor's own current documentation before scoring it — including the claims here — and read the pages the comparison does not link, because a zero scored from one convenient page is how these documents get biased against competitors. This site is published by ASCENDING, which builds Jarvis Registry — a competing gateway that scores 10 of 20 here, finishes last, and loses on compliance, supply-chain controls, credential brokering and authorization detail. The test is not who wrote the ranking, but whether each cell links to a page you can open today.

References

1. The MCP authorization specification at revision 2026-07-28, the current revision, requires RFC 9728 Protected Resource Metadata and token-audience validation, makes Client ID Metadata Documents the SHOULD-level registration path, and marks RFC 7591 Dynamic Client Registration deprecated — Model Context Protocol (2026): https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization
2. Zuplo's MCP Gateway runs its own OAuth 2.1 authorization server, supports both DCR and Client ID Metadata Documents with CIMD recommended, stores upstream tokens encrypted at rest keyed by user, offers an optional capability-filter policy, and describes statelessness as what enables horizontal scaling on its edge runtime — Zuplo (2026): https://zuplo.com/docs/mcp-gateway/how-it-works
3. AgentCore Gateway supports JWT and IAM inbound authorization, advertises required scopes via WWW-Authenticate with resource_metadata, distinguishes 401 from 403 insufficient_scope, supports private VPC-hosted identity providers and interceptor Lambda functions, and labels JWT passthrough non-recommended in favour of on-behalf-of token exchange — Amazon Web Services (2026): https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-inbound-auth.html
4. Tyk serves the OAuth protected-resource metadata endpoint natively, scopes policy to individual tools, resources and prompts, filters list responses to permitted primitives, and provides primitive-level analytics with OpenTelemetry metrics — Tyk (2026): https://tyk.io/docs/ai-management/mcp-gateway/overview
5. Kong's AI MCP OAuth2 plugin places the gateway in the OAuth Resource Server role, validates token audience, withholds access tokens from upstreams by default, and adds token exchange in 3.14 — Kong (2026): https://developer.konghq.com/plugins/ai-mcp-oauth2/
6. Jarvis Registry documents fine-grained access controls at the tool level, OAuth and SAML authentication, complete audit trails, real-time logs, analytics and alerts, and Kubernetes deployment across EKS, AKS, GKE, hybrid and on-premises, with no certification claim published — ASCENDING (2026): https://ascendingdc.com/jarvis-ai/jarvis-registry/
7. agentgateway enforces CEL-based RBAC over mcp.tool.name, mcp.tool.target, prompts, resources and JWT claims, and automatically filters disallowed resources from list responses — agentgateway (2026): https://agentgateway.dev/docs/standalone/main/mcp/mcp-authz/
8. Kong's AI MCP Proxy plugin provides four operating modes, per-tool ACLs that override the default ACL outright, deny-first evaluation with audit logging, and requires AI Gateway Enterprise on Kong Gateway 3.12 or later — Kong (2026): https://developer.konghq.com/plugins/ai-mcp-proxy/
9. Docker MCP Gateway documents --verify-signatures, --block-secrets, --block-network, --log-calls, per-server --cpus and --memory limits, an --interceptor hook, and per-profile tool enable/disable — Docker (2026): https://github.com/docker/mcp-gateway/blob/main/docs/mcp-gateway.md
10. TrueFoundry's MCP Gateway documents governed tool access with approvals, OAuth 2LO/3LO flows, inbound and outbound authentication with token management, a full audit trail, and tool-level request rate, latency and failure monitoring — TrueFoundry (2026): https://www.truefoundry.com/docs/ai-gateway/mcp/mcp-overview
11. Tool poisoning attacks embed model-visible, user-invisible instructions in MCP tool descriptions; shadowing redirects trusted tools; rug pulls change descriptions after client approval — Invariant Labs (2025): https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks
12. IBM ContextForge federates MCP, A2A and REST/gRPC into virtual servers under Apache 2.0, ships via PyPI, Docker and Helm, and provides JWT and RBAC, OpenTelemetry to Phoenix/Jaeger/Zipkin, 40-plus plugins, and Redis-backed Kubernetes federation — IBM (2026): https://ibm.github.io/mcp-context-forge/latest/
13. MintMCP states SOC 2 Type II compliance, OAuth and SSO authentication, and complete audit trails for every tool interaction on its own homepage — MintMCP (2026): https://www.mintmcp.com/
14. agentgateway documents MCP multiplexing across backends, virtual MCP servers, composable multi-step MCP tools, OpenAPI-to-MCP exposure, tool-level access control and tracing — Solo.io (2026): https://docs.solo.io/agentgateway/latest/mcp/
15. AgentCore Gateway's semantic tool search is invoked through the built-in x_amz_bedrock_agentcore_search tool — Amazon Web Services (2026): https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-using-mcp-semantic-search.html
16. TrueFoundry documents seven deployment options including fully self-hosted control plane, gateway plane and compute plane in customer infrastructure, with a licensing endpoint that still receives employee emails and request counts — TrueFoundry (2026): https://www.truefoundry.com/docs/platform/deployment-overview
17. TrueFoundry documents SOC 2 Type II certification covering security, availability, processing integrity, confidentiality and privacy, plus HIPAA and GDPR, and states that certifications apply to its managed infrastructure while self-hosted compliance depends on customer controls — TrueFoundry (2026): https://www.truefoundry.com/docs/platform/security-and-compliance
18. Solo.io contributed agentgateway to the Linux Foundation on 25 August 2025, with AWS, Cisco, Huawei, IBM, Microsoft, Red Hat, Shell and Zayo named as contributors — The Linux Foundation (2025): https://www.linuxfoundation.org/press/linux-foundation-welcomes-agentgateway-project-to-accelerate-ai-agent-adoption-while-maintaining-security-observability-and-governance
19. Zuplo documents three hosting options — Managed Edge, Managed Dedicated on the customer's chosen cloud provider including AWS, GCP and Azure, and Self-Hosted (On-Premises), which runs exclusively on Kubernetes and installs with a single Helm chart — Zuplo (2026): https://zuplo.com/docs/articles/hosting-options
20. Zuplo's MCP Gateway emits typed analytics events across the MCP request lifecycle, capability invocations and the OAuth lifecycle, with structured logs carrying tenant, session, capability, latency and failure origin, documented failure reason codes, and export to Datadog, Honeycomb and Splunk — Zuplo (2026): https://zuplo.com/blog/introducing-zuplo-mcp-gateway
21. Tyk's MCP Gateway product page documents Enterprise upstream auth using OAuth 2.0 client credentials for OAuth-protected upstream MCP servers, and cloud, self-hosted or hybrid deployment on MDCB-managed clusters — Tyk (2026): https://tyk.io/tyk-mcp-gateway/
22. Tyk documents a token-exchange middleware that replaces the Authorization header with a backend-scoped token so the inbound SSO token never reaches the upstream MCP server — Tyk (2026): https://tyk.io/docs/ai-management/mcp-gateway/core-concepts
23. IBM ContextForge documents OAuth Authorization Code and client-credentials flows with PKCE automatically enabled, client secrets stored encrypted at rest, automatic refresh near expiry, and tokens scoped per ContextForge user to prevent token sharing — IBM (2026): https://ibm.github.io/mcp-context-forge/manage/oauth/
24. agentgateway's backend authentication policy strips the original credential before forwarding by default, supports static keys, AWS and GCP credentials, OAuth token exchange for a new backend-specific token, and Cross App Access, with passthrough as an explicit opt-in — agentgateway (2026): https://agentgateway.dev/docs/standalone/latest/configuration/security/backend-authn/
25. Amazon Bedrock AgentCore is documented as HIPAA eligible and FedRAMP (Class C), SOC 2, CSA STAR and ISO 27001:2022, 27017:2015, 27018:2019, 27701:2019, 22301:2019, 20000-1:2018 and 9001:2015 compliant — Amazon Web Services (2026): https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/compliance-validation.html
26. AgentCore gateway creation documents the Cedar-based policy engine with logging-only and enforcing modes, gateway interceptors, and states that semantic search can only be enabled at creation and cannot be added to an existing gateway — Amazon Web Services (2026): https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-create.html
27. The CreateGateway API reference defines the MCP gateway configuration's searchType field with SEMANTIC as its only valid value — Amazon Web Services (2026): https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_MCPGatewayConfiguration.html
28. MintMCP's engineering page states self-hosted or cloud deployment without naming an orchestrator, artifact or isolation boundary — MintMCP (2026): https://www.mintmcp.com/for-engineering
29. Tyk publishes ISO 27001, ISO 9001, SOC 2 and PCI DSS as company certifications, and cloud, self-managed and hybrid deployment models, without stating SOC report type or scope — Tyk (2026): https://tyk.io/company-information-for-ai-llms/
30. Kong Gateway documents traditional, hybrid and DB-less deployment topologies, all available as self-managed deployments on customer infrastructure — Kong (2026): https://developer.konghq.com/gateway/deployment-topologies/