Which open source MCP gateway fits your team?
Choose an open source MCP gateway by the job you need to operate: container execution, a shared registry, Kubernetes routing or a policy proxy. Docker MCP Gateway, IBM ContextForge, Microsoft MCP Gateway and agentgateway start from different places. The useful comparison is how each fits your clients and ownership model, followed by the same access and failure tests.
Last verified: November 3, 2026. This is a review of project documentation and main-branch READMEs, not a performance benchmark or a hands-on certification. Pin a release and repeat the checks before deployment.
Suppose two platform engineers support six teams using different IDEs. A local container gateway might solve server startup. A shared proxy might solve tool access. A catalog might solve approval and discovery. The team may need more than one of those jobs, but choosing a project before naming them makes the operating burden hard to see.
For the category definition, read our MCP gateway guide. For managed offerings and procurement scope, use the broader MCP gateway buyer’s guide.
Compare the documented deployment and control boundaries
The table records what the linked project documentation describes. A telemetry integration does not establish complete audit coverage, and a listed authentication method does not prove your identity-provider flow works.
| Attribute | Docker MCP Gateway | IBM ContextForge | Microsoft MCP Gateway | agentgateway |
|---|---|---|---|---|
| Deployment model | CLI gateway orchestrating MCP server containers | Registry and proxy; package, container and Kubernetes paths | Kubernetes data gateway and server lifecycle control plane | Standalone proxy or Kubernetes deployment |
| Identity and access control | Credential and access configuration; validate shared-user isolation | Authentication and RBAC documented; validate team and tool boundaries | Bearer-token authorization and RBAC; verify per-tool requirements | OAuth/JWT authentication and CEL-based MCP authorization |
| Audit logging | Inspect required events in the selected mode | Structured logs and OpenTelemetry; map fields to your evidence needs | Telemetry integration; inspect allowed and denied request evidence | Access logs and OpenTelemetry; configure and inspect event coverage |
| Supported MCP transports | README lists stdio and SSE/streaming run modes | Documents stdio, SSE and Streamable HTTP paths; check bridge direction | Current main requires 2026-07-28 and documents Streamable HTTP | Documents stdio, HTTP/SSE and Streamable HTTP; check client/backend direction |
| Hosting | Your Docker environment for the open source runtime | Your package/container platform or cluster | Your Kubernetes environment | Your host, container platform or cluster |
Sources: Docker documentation and CLI README; ContextForge README and documentation; Microsoft README; agentgateway README and MCP authorization guide.
Treat the transport row as a compatibility question, not a score. Supporting local stdio processes and accepting remote HTTP clients are different directions. A bridge can also change where a server executes, which files it can reach and who holds its credentials.
Docker: start here when server execution is the problem
Docker’s open source gateway manages MCP configuration and server containers. Its README provides local stdio and network run modes. That makes it worth evaluating when your immediate problem is starting approved containerized servers consistently.
Separate that runtime from Docker’s commercial governance offerings. The current Docker documentation labels its AI Governance gateway feature invite-only. Do not infer contracted management capabilities from an open source command or assume that a local profile supplies your enterprise’s per-user policy.
In a trial, inspect mounts, network access and the identity used by each server. Then attempt the same permitted and prohibited tool calls as two different users. Our Docker MCP Gateway alternatives guide covers migration paths that retain the Docker execution layer as well as paths that replace it.
ContextForge: start here when catalog and proxy belong together
ContextForge describes an integrated registry and proxy for MCP and other interfaces. Its documented deployment options span local packages, containers and Kubernetes; it also documents RBAC and OpenTelemetry integration.
That is a useful starting point when the platform team wants catalog administration and traffic handling in one project. It also means evaluating more than the request proxy. Review the database, administrative surface, configuration, backups and upgrade path alongside tool invocation.
Give two teams similar-looking tools and verify which records each can discover, change and invoke. Test an administrator’s rights separately from an ordinary user’s. For the operating record that should sit behind each catalog entry, use the private MCP registry guide.
Microsoft: start here when Kubernetes lifecycle is the requirement
Microsoft MCP Gateway describes a Kubernetes reverse proxy and control plane for server lifecycle management. The main-branch README reviewed for this article requires MCP revision 2026-07-28 clients and adapters and explicitly rejects legacy initialization and protocol downgrade.
That compatibility boundary belongs near the start of an evaluation. A platform built around an older client fleet cannot treat a current README quickstart as a drop-in upgrade. The project documents bearer-token authorization and telemetry integration; map those to the finer tool and evidence controls your workflow needs.
Record the installed client build, adapter release and gateway image together. Exercise an update and rollback with those exact versions. If the team cannot recover the previous working combination, a successful first request has left an operating risk unresolved.
agentgateway: start here when the proxy policy is the requirement
agentgateway documents standalone and Kubernetes deployments, MCP federation, OAuth/JWT authentication, CEL-based authorization and OpenTelemetry. Its MCP authorization guide describes applying policy to MCP requests.
Evaluate it when the team wants a configurable traffic and policy layer. Decide separately where approved server metadata, ownership and lifecycle decisions live. A proxy policy file can reference approved targets, but someone still needs to review and maintain those targets.
For products spanning model and tool traffic, draw both request paths. Our LLM gateway vs MCP gateway comparison explains which controls belong on each. A shared product can reduce the number of systems to operate, while still requiring separate policies and evidence for model calls and tool calls.
Run the same trial against every candidate
Use a read tool, a write tool, two identities and a harmless backend. Agree on pass criteria before running a candidate’s quickstart. Keep the project-specific configuration alongside the results.
Start with these questions:
- Can the actual employee client authenticate and discover the allowed tool?
- Does a direct call to the forbidden write tool fail before the backend changes?
- Does the backend receive the intended user or service credential?
- Does access withdrawal take effect from an already-open client within the agreed interval?
- Can an employee bypass the required proxy through a direct server URL?
- Can an operator find the caller, tool, decision and backend outcome without exposing secrets?
- Can the team upgrade and roll back the pinned deployment while preserving policy and catalog data?
Use the per-user tool-access tests for authorization and the MCP audit-evidence guide for event coverage. Review tool-definition changes before admitting a new server release.
Log a timeout as well as a success. If a write times out after the backend commits it, an automatic retry may repeat the operation. The gateway, server and destination owners need to agree which component can retry and how the workflow detects an already-completed action.
When is managed operation worth paying for?
Include the application boundary in the trial too. MCP vs REST API keeps existing service permissions in scope, while MCP vs function calling checks the host’s handling of a denied or failed tool result.
Managed operation is useful when the provider takes responsibility for work your team cannot staff: upgrades, availability, incident handling or supported identity integration. Read that scope in the contract. A hosting subscription that leaves policy, patching and recovery to your team may save less work than expected.
For a practical cost comparison, estimate the first deployment, recurring maintenance, support coverage and migration out. Include the ordinary month and an urgent security update. There is no defensible universal cost winner without that workload.
The AI vendor risk assessment helps review provider access, retention and exit terms when a managed option enters the shortlist. For an internal build, put the same responsibilities against named teams.
Where does Jarvis belong on the shortlist?
ASCENDING builds Jarvis. The Jarvis MCP gateway page describes its catalog and access-control layer. Evaluate it with the same client, credential, denial and withdrawal tests; ask for deployment and support scope alongside the product demonstration.
End the trial with an owner for every component in the proposed route. A short list of projects that passed your workflow is more useful than an overall ranking assembled from unrelated feature checkmarks.
References
- Docker MCP Gateway documentation and source repository
- IBM ContextForge source repository and deployment documentation
- Microsoft MCP Gateway source repository and compatibility requirements
- agentgateway source repository and MCP authorization
Open source MCP gateway buying questions
Which open source MCP gateway should an enterprise evaluate?
Start with the operating requirement. Docker MCP Gateway is relevant to container-based server execution; ContextForge combines a registry and proxy; Microsoft MCP Gateway targets Kubernetes routing and lifecycle management; agentgateway provides a proxy with MCP authorization controls. Test a pinned release with your clients, identity provider and servers before choosing.
Is an open source MCP gateway cheaper than a managed service?
It can reduce license cost, but infrastructure, upgrades, security fixes, identity integration and on-call support still need owners. Compare the total operating work with the scope included in a managed contract. Open source and managed are compatible labels when a provider operates open source software.
Do all open source MCP gateways support the same clients?
No. Protocol revision, transport binding and authorization behavior can differ. Microsoft's current main-branch README, reviewed November 3, 2026, explicitly requires MCP 2026-07-28 clients and adapters. Check the documentation for the release you intend to deploy and test the exact client build.
Does self-hosting establish security or compliance?
Self-hosting determines who operates the runtime. Your deployment still needs access controls, credential handling, patching, evidence retention and any required independent assurance. Evaluate those responsibilities and the actual data flows separately.
