Best Open-Source MCP Gateways and Proxies in 2026, Compared

The best open-source MCP gateway for most platform teams is agentgateway if you run Kubernetes and want one proxy for MCP, A2A and LLM traffic, IBM ContextForge if you want a self-hosted registry with SSO and RBAC, and MCP Gateway Registry if your identity provider is Keycloak, Entra ID or Okta and you need per-tool access control with audit logs. Bifrost, Microsoft MCP Gateway, Docker MCP Gateway, MCPHub and MCPJungle fit narrower cases, covered below.

If you only need to expose one stdio server over HTTP, you do not need a gateway at all. A small MCP proxy such as Supergateway or mcpo does that job.

Every feature claim below comes from the project's own README or docs, linked in place, and was read on 12 November 2026. AgenticMart lists these projects from public GitHub data. We have not run or scanned them, so treat this as a shortlist to evaluate, not a verdict.

MCP gateway comparison table

Stars are from the GitHub REST API, as of 12 November 2026. "Not in README" means we did not find the feature in the README or the docs page we read, not that the project lacks it.

Gateway	Auth and SSO	Policy and tool filtering	Audit logs	Rate limits	Deployment	Stars	Licence
agentgateway	JWT, API keys, OAuth (README)	RBAC with a CEL policy engine	OpenTelemetry logs and traces; no audit log named	Yes	Standalone binary with YAML, or Kubernetes controller with Gateway API	6,144	Apache-2.0
ContextForge	JWT, Basic; SSO with Google, GitHub, Entra ID	RBAC; virtual servers bundle chosen tools	Audit trails via metadata tracking	Yes (README)	PyPI, Docker, Helm	4,811	Apache-2.0
MCP Gateway Registry	OAuth with Keycloak, Entra ID, Okta, Auth0, Cognito, PingFederate (README)	Scopes; virtual MCP servers with per-tool access control	Yes, with credential masking	Not in README	Docker Compose, Amazon EKS (Helm), Amazon ECS (Terraform)	1,048	Apache-2.0
Bifrost	OAuth and per-user OAuth to MCP servers (docs); OIDC login is an enterprise feature	Tool allow-lists per virtual key	Docs mention an audit trail of tool operations	Yes, via virtual keys	npx or Docker; MCP needs the Gateway deployment, v1.4.0 or later	9,526	Apache-2.0, with a separate enterprise tier
Microsoft MCP Gateway	Entra ID bearer tokens (README)	Entra app roles per server and tool	Telemetry; no audit log named	Not in README	Kubernetes (local) or Azure AKS	917	MIT
Docker MCP Gateway	OAuth flows to upstream servers; secrets in Docker Desktop (README)	Enable or disable single tools per profile	Logging and call tracing	Not in README	Docker CLI plugin, Docker Desktop 4.59+	1,631	MIT
MCPHub	OAuth 2.0 client and server, bearer keys, GitHub and Google login (README)	Server and group visibility controls	Tool-call activity and server logs	Not in README	Docker	2,677	Apache-2.0
MCPJungle	Per-client bearer tokens in enterprise mode (docs)	Server allow-lists per client; tool groups	Not in the docs we read	Not in the docs we read	Docker Compose, CLI	1,622	MPL-2.0

AgenticMart listing pages show stars from our 8 November 2026 data refresh, so they may differ slightly from the table.

The picks, one by one

agentgateway: one proxy for MCP, A2A and model traffic

agentgateway is a Rust proxy built for MCP and A2A. Its README lists tool federation across stdio, HTTP, SSE and Streamable HTTP, OpenAPI integration, OAuth, RBAC through a CEL policy engine, rate limiting, TLS and OpenTelemetry. It runs two ways: a standalone binary driven by YAML, or a Kubernetes controller that uses the Gateway API.

Pick it if your platform team already speaks Kubernetes Gateway API and wants MCP policy written next to the rest of its traffic rules. The README does not name an audit log, so plan to ship its OpenTelemetry output to your own log store.

IBM ContextForge: a registry and gateway with SSO built in

ContextForge federates MCP servers, A2A agents and REST or gRPC APIs behind one MCP endpoint. Its distinguishing idea is the virtual server: you pick tools from the catalog and publish them as a new server, so each team sees only what it needs. The README covers JWT and Basic auth, federated SSO with Google, GitHub and Entra ID, RBAC, rate limiting, OpenTelemetry tracing and an admin UI. It also says it has more than 40 plugins.

Two setup notes from the README: JWT_SECRET_KEY and AUTH_ENCRYPTION_SECRET are required even locally, and arm64 is not supported in production containers, so Apple Silicon users run it through Rosetta or PyPI.

MCP Gateway Registry: OAuth with the IdP you already have

MCP Gateway Registry splits the job in two: an nginx data plane that validates auth and routes, and a FastAPI control plane that owns the inventory, access model and audit trail. It plugs OAuth into Keycloak, Entra ID, Okta, Auth0, Cognito or PingFederate, and its virtual MCP servers aggregate tools from many backends with per-tool access control.

It is the most enterprise-shaped pick on paper: a documented audit log with credential masking, per-user egress auth for OAuth-protected SaaS servers, and deployment guides for EKS and ECS. Its README also says it serves MCP 2026-07-28 clients and older clients on the same URLs, which matters during the protocol transition.

Bifrost: if you also need an LLM gateway

Bifrost is an AI gateway in Go first: one OpenAI-compatible API in front of many model providers. Its MCP docs describe connecting to MCP servers over stdio, HTTP or SSE, exposing Bifrost itself as an MCP server, and tool allow-lists per virtual key. Virtual keys also carry budgets and rate limits.

Read the licence boundary carefully. The README says enterprise deployments unlock features including "MCP gateway", while the docs describe MCP in the Gateway deployment without naming an edition. OIDC login sits under enterprise docs. Confirm which parts you need are in the Apache-2.0 build before you commit.

Microsoft MCP Gateway: for Azure and Entra ID shops

Microsoft MCP Gateway is a reverse proxy and management layer that runs on Kubernetes, locally or on AKS. Auth is Entra ID bearer tokens, and authorization uses Entra app roles assigned to users or service principals, so list calls return only what the caller may use.

One thing to check: the README says legacy initialization is rejected. That fits the stateless MCP 2026-07-28 revision, but older clients that still send initialize will need upgrading.

Docker MCP Gateway: for developer machines

Docker MCP Gateway is the CLI plugin behind Docker Desktop's MCP Toolkit. Each server from the catalog runs in its own container, and the README says npx and uvx servers get minimal host privileges. Tool filtering is per profile. This command is quoted from the README and was not run for this post:

docker mcp profile tools <profile-id> --enable github.create_issue --enable github.list_repos

It is strongest as a per-developer gateway. The README names no client SSO or rate limits, so for a shared team endpoint look at the picks above.

MCPHub and MCPJungle: lighter self-hosted control planes

MCPHub gives you a web UI, OAuth 2.0 in client and server modes, bearer keys, GitHub and Google login, group visibility controls and tool-call logs. Its README notes MCP endpoints require auth by default.

MCPJungle registers servers once and exposes one endpoint. In enterprise mode, its access control docs say no client can reach any server until you create a client identity with an allow-list, and that page strongly discourages --allow "*" in production. Tool groups narrow what each client sees.

Both suit a small team that wants one endpoint and a UI without running Kubernetes.

Also worth a look

• Pipelock (990 stars, as of 12 November 2026) is an agent firewall rather than an aggregator. It inspects MCP, A2A and HTTP traffic for secret leaks, prompt injection and tool poisoning. Its core is Apache-2.0 and its enterprise directory is under the Elastic License 2.0.
• Unla (2,252 stars) turns existing APIs and MCP servers into MCP endpoints from YAML, with Helm support. Its README still lists grouping and aggregating MCP servers as not done.
• Lunar (509 stars) includes MCPX, an MCP aggregator. Its README says it is free for non-production and personal use, with production features through paid tiers, so check terms first. Its MCPX docs link redirected to Boomi's documentation when we checked.

MCP proxies: when you only need a bridge

A gateway sits in front of many servers. An MCP proxy usually bridges one server from one transport to another. These three are the most starred in our MCP gateways category, as of 12 November 2026:

Proxy	What it does	Stars	Licence
Supergateway	Runs a stdio server over SSE, WebSocket or Streamable HTTP, and the reverse	2,957	MIT
mcp-proxy (sparfenyuk)	stdio to SSE or Streamable HTTP, and SSE to stdio	2,823	MIT
mcpo	Exposes an MCP server as an OpenAPI HTTP server, with an optional API key	4,423	MIT

One tip worth acting on today: Supergateway's README says that without --host it listens on every interface. On a laptop or shared host, bind it to loopback. Quoted from the README, not run for this post:

npx -y supergateway --stdio "uvx mcp-server-git" --host 127.0.0.1

What an MCP gateway does

An MCP gateway is a proxy between MCP clients and many MCP servers. It typically aggregates their tools behind one endpoint, bridges transports, checks who is calling, filters which tools each caller sees, and logs calls. The MCP specification defines clients, servers and authorization servers. It does not define a gateway role, so each project decides its own feature set.

Three spec rules shape any gateway that handles auth, from the 2026-07-28 revision and the official security best practices:

1. No token passthrough. The authorization spec says MCP servers "MUST NOT accept or transit any other tokens". A gateway that forwards a client's token unchanged to an upstream API is doing exactly what the best practices call an anti-pattern. Look for gateways that exchange or broker credentials per upstream, such as MCP Gateway Registry's per-user egress auth.
2. Per-client consent for OAuth proxies. The best practices say MCP proxy servers that use a static client ID with a third-party API MUST implement per-client consent, to block confused deputy attacks.
3. Stdio spawning is the risky part. Proxies that start servers as child processes SHOULD sandbox them, restrict file system access and log all stdio usage. Container isolation, as in Docker MCP Gateway, is one way to do that.

Authorization is optional in MCP and applies to HTTP transports. Stdio servers take credentials from the environment, which is another reason teams put a gateway in front of them.

MCP gateway vs API gateway

An API gateway routes HTTP requests by host and path. An MCP gateway has to understand JSON-RPC methods such as tools/list and tools/call, so it can merge tool lists from many servers and allow or deny a call by tool name. A plain API gateway sees one URL and one POST body. Several picks here do both jobs: ContextForge and MCP Gateway Registry also front REST APIs, and agentgateway and Bifrost also route model traffic. That split is our reading of their READMEs, not a definition from the spec.

How we picked

• Source: projects in the AgenticMart MCP gateways category, which lists original, non-archived repositories. MetaMCP was removed after its repository was archived.
• Scope: self-hostable gateways that put many MCP servers behind one endpoint. Hosted-only products are out.
• Evidence: a feature counts only if the README or official docs say so, linked in the table. Nothing was installed or benchmarked for this post, so there are no latency figures here.
• Order: by fit for a platform or security team choosing a shared gateway: auth integration first, then tool-level policy, audit logs, then deployment. Stars are shown for context, not used to rank.

Several of the roundups we read for "best MCP gateway" were published by a gateway vendor that ranks its own product first, and none of those dated its star counts. This list links every claim so you can check it.

A checklist before you choose

1. Does it validate tokens for itself and avoid passing client tokens upstream?
2. Can you filter tools per user or team, not only per server?
3. Is there a named audit log, or only telemetry you must turn into one?
4. Which MCP revisions does it serve? 2026-07-28 removed the initialize handshake.
5. Is the feature you need in the open-source licence or an enterprise tier?
6. What can each upstream server touch? Check the "What it can touch" section on each MCP server listing and apply least privilege.

Our MCP server security guide covers the server side of the same checks.

FAQ

What is the best MCP gateway?

There is no single best MCP gateway. For Kubernetes teams, agentgateway; for a self-hosted registry with SSO and RBAC, ContextForge; for OAuth against an existing IdP with per-tool access and audit logs, MCP Gateway Registry. Pick by your identity provider and where you deploy.

Is there a good open source MCP gateway for enterprise use?

ContextForge, MCP Gateway Registry and agentgateway are Apache-2.0 and their docs cover SSO or OAuth, RBAC or scopes, and observability. Bifrost and Lunar keep some features in paid tiers, so read their licence notes. An enterprise MCP gateway still needs your own review; we have not scanned any of these.

What is the difference between an MCP gateway and an MCP proxy?

An MCP proxy usually bridges one server between transports, such as stdio to Streamable HTTP. An MCP gateway puts many servers behind one endpoint and adds auth, tool filtering and logging. Some projects use the words interchangeably.

MCP gateway vs API gateway: do I need both?

Often yes, or one product that does both. An API gateway routes HTTP by path, while an MCP gateway reads MCP methods so it can filter tools by name. ContextForge, MCP Gateway Registry and agentgateway cover both kinds of traffic.

Does the MCP spec require a gateway?

No. The spec does not define a gateway role. Its authorization rules still apply to a gateway that acts as an MCP server, including validating that tokens were issued for it and not passing client tokens through.

List your gateway on AgenticMart

Built an MCP gateway, proxy or server? Platform teams use the protocols directory to shortlist tools. List free now, paid selling opens soon. Submit your project, and see the AgenticMart developer API to pull listing data into your own tools.