Tools · MCP security & gateways
MCP gateways and MCP security tools
MCP, the Model Context Protocol, is the open standard AI agents use to connect to tools and data. The gateways listed here sit between agents and MCP servers, decide which agent may call which tool and log the calls, and some hold the credentials so the agents do not; the scanners check servers, skills and plugins for injected instructions and risky code. A team needs one when agents connect to MCP servers faster than security can review them, because then there is no list of which agent can reach which tool and no single log to check when something goes wrong.
MCP security & gateways 18
-
Agent Gateway (vendor site, opens in a new tab)
generally availableGoogle Cloud on the vendor map
The enforcement point for agent traffic in Gemini Enterprise Agent Platform, covering user-to-agent, agent-to-agent and agent-to-tool calls. It authorizes requests using each agent's SPIFFE-based Agent Identity and the Agent Registry of approved agents, tools and MCP servers, and applies IAM policies and Model Armor screening.
-
agentgateway (vendor site, opens in a new tab)
generally availableAgentic AI Foundation
Open-source proxy for agent-to-LLM, agent-to-tool and agent-to-agent traffic over MCP and A2A. It handles authentication (JWT, API keys, OAuth), role-based access with a CEL policy engine, rate limits, content guardrails and LLM spend controls, and emits OpenTelemetry logs and traces.
-
Amazon Bedrock AgentCore Policy (vendor site, opens in a new tab)
generally availableIntercepts agent traffic passing through AgentCore Gateway and checks each tool request against deterministic policies, written in Cedar or drafted in plain English, before the agent gets tool access.
-
C1 MCP Gateway (vendor site, opens in a new tab)
generally availablePuts identity-aware policy in front of MCP, tool and API calls: reads are approved automatically, writes go to an approver and destructive calls are denied unless policy allows them. An agent acting for a person starts from that person's grants, and each call's caller, action, decision and outcome is recorded.
-
Cloudflare MCP server portals (vendor site, opens in a new tab)
generally availablePuts multiple MCP servers behind one endpoint in Cloudflare Access, where admins choose which tools and prompts each portal exposes and users sign in before reaching any server. Portal requests are logged, with log export on Enterprise plans.
-
Composio MCP Gateway (vendor site, opens in a new tab)
generally availableA control point between agents and the MCP servers they call, covering more than 1,500 managed integrations. It enforces access policy, manages the OAuth tokens and API keys agents would otherwise carry, and records an audit trail of tool calls.
-
ContextForge (vendor site, opens in a new tab)
generally availableIBM
Open-source registry and proxy that puts MCP servers, A2A agents and REST or gRPC APIs behind one endpoint with central discovery, authentication, role-based access, rate limiting and OpenTelemetry tracing. More than 40 plugins add further transports, protocols and integrations.
-
Helmet (vendor site, opens in a new tab)
private previewHelmet Security on the vendor map
Discovers agents, MCP servers, skills and plugins from EDR, identity provider, network and SaaS signals, and keeps a verified registry that scans them for secrets, code flaws and drift. Policy is enforced through agent hooks and an MCP gateway, with decisions logged and exportable to a SIEM.
-
HOL Guard (vendor site, opens in a new tab)
generally availableHOL
Open-source tool that runs on a developer's machine and hooks into coding agents such as Claude Code, Codex and Cursor. It checks shell commands, secret reads, package installs, MCP tool calls and plugin or skill installs before they run, allows, blocks or pauses each for approval under local policy, and keeps a local record of decisions. What it can see differs by agent; an optional paid cloud tier adds shared policy and synced history.
-
Kong AI Gateway (vendor site, opens in a new tab)
generally availableGoverns LLM, MCP and agent-to-agent traffic from one gateway: who can use which models and MCP servers, how agents discover tools, and limits on data leakage and token usage.
-
MCP Scanner (vendor site, opens in a new tab)
generally availableCisco
Open-source tool that scans MCP servers' tools, prompts, resources and source code for malicious or risky behavior using YARA rules, LLM analysis and the Cisco AI Defense API. It also checks Python dependencies for known vulnerabilities.
-
MCPX (vendor site, opens in a new tab)
generally availableLunar.dev
Self-hosted MCP gateway that gives each agent its own environment with a separate identity, MCP access and tool permissions. It records both the user and the agent behind every tool call for audit.
-
Mintive MCP Gateway (vendor site, opens in a new tab)
generally availableSits between AI clients and MCP servers: admins approve servers into an internal catalog, bundle them by role, and switch off individual tools for every client. Credentials stay in the gateway and each tool call is logged.
-
Obot MCP Gateway (vendor site, opens in a new tab)
generally availableObot AI
Open-source, self-hostable gateway that centralizes OAuth for MCP servers, publishes a curated catalog, sets which users and agents can reach which servers, and audits every tool call.
-
Operant MCP Gateway (vendor site, opens in a new tab)
generally availableCatalogs MCP tools and the agents calling them across endpoints and cloud, and detects prompt injection, tool poisoning and unauthorized access in MCP traffic. It blocks untrusted servers and tools, redacts sensitive data in flight and enforces least-privilege execution.
-
Rippling MCP Gateway (vendor site, opens in a new tab)
generally availableChecks each tool call over supported MCP connections against admin-set policy and the caller's Rippling identity before it runs, and logs the call for audit. Admins assign tools by group or person using Rippling's employee records, nobody has access until a policy exists, the connected app's own permissions still apply, and access follows role changes and ends at offboarding. The connections Rippling documents are its own MCP server and Slack.
-
Runlayer (vendor site, opens in a new tab)
generally availableRoutes MCP requests from clients such as Claude, Cursor, ChatGPT and Codex through one gateway that checks OAuth, scopes access by user, group, role, agent account and tool, and runs security scans before company systems are reached. Every call is logged, and a discovery feature finds unapproved MCP servers, skills and plugins.
-
Snyk Agent Scan (vendor site, opens in a new tab)
generally availableSnyk
Open-source scanner that finds the agents, MCP servers and agent skills installed on a machine and checks them for prompt injection and other vulnerabilities.
Recent launches
- Kong AI Registry · announced
- Kong AI Gateway 2.0 · generally available
- IAM Unified Access Policies for Gemini Enterprise Agent Platform (Google) · generally available
- Rippling MCP Gateway · generally available
- Temporal policies and rate limiting in Amazon Bedrock AgentCore (AWS) · announced
- Cloudflare WriteGuard for MCP server portals · private preview
Announced in the last 90 days. Each launch on New tools links the vendor's own announcement.
The briefing
New AI agent governance tools, by email
The briefing's New Tools section covers the latest governance launches, each linked to the vendor's announcement, next to the news that decides which ones matter. At least once a week, five-minute read, free.
You confirm by email. Unsubscribe in one click.
Questions to ask vendors
Neutral questions for a request for proposal (RFP) or a security questionnaire. No product here is named as the answer.
-
Can access be allowlisted per agent and per tool, rather than only per server? An agent that needs one tool from a server should not inherit all of them.
-
Does the log capture the full tool call and the full response, and can we export it to our existing security tooling?
-
How is tool output screened for injected instructions, and what happens on a hit: block, redact, or flag for review?
Injected instructions are prompt injection: text hidden in content an agent reads, including what its own tools hand back, that tries to change what the agent does.
-
Which spec revision does it implement today, and which extensions does it pass through, inspect, or block?
At the explainer's October 2026 review, the current MCP revision was dated 2026-07-28. Capabilities such as Tasks and MCP Apps now arrive as named extensions, so "we support MCP" is not a complete answer.
-
Who can change policy, and is every policy change itself logged?
-
How much latency does the gateway add per tool call, measured, not estimated?
More questions, grouped by topic: Questions to ask AI agent security vendors.
Related incidents
- Attackers exploited a Langflow flaw that runs an MCP server's command field as a shell command
- Google, Rapid7 and three other organizations acknowledged flaws that pass injected prompts between agents
- An OAuth flaw in the MCP Python SDK could enable account takeover
- Ruflo's MCP harness carried an unauthenticated CVSS 10.0 remote code execution flaw
Every record in the AI agent incident database links the sources that reported it.
Missing a product, or found an entry that is out of date? Write to [email protected]. A submission is read, never paid for, and does not guarantee a listing. The glossary defines the terms used here.