The 11 best MCP gateways for enterprise governance in 2026, compared

A sales rep asks Claude to move a deal to the next stage. Somewhere between the request and Salesforce, something has to confirm who is asking, check that this person may edit that deal, and keep a record of the change. That something is an MCP gateway, and the eleven below do the job in different ways.

The short answer. The products split on one question: do you want to govern the MCP servers you already run, or run fewer of them? Workato, Boomi, TrueFoundry, Kong, Docker and Microsoft can sit in front of existing servers. Tray.ai, Composio and Zapier publish governed tools from their own connectors, so there are fewer servers to govern in the first place. Bifrost and Obot are open-source options for teams that want to host it themselves.

We make Tray.ai, so read our entry with that in mind. Every claim about another product comes from that vendor’s own pages, read on 22 October 2026, and each one gets a “best for” we would stand behind.

MCP gateways at a glance

Pricing checked against each vendor’s own pricing page on 22 October 2026. “Unpublished” means the vendor quotes through sales.

Integration platforms with governed MCP

Tray.ai Agent Gateway for MCP

Best for: enterprises that would rather run one governed MCP layer than a separate MCP server for every system.

Most teams that adopt MCP end up with a server for Salesforce, another for Jira and another for Slack, each with its own credentials, permissions and log. Agent Gateway for MCP takes a different route. It connects to each system’s API directly through Tray’s connectors and publishes the tools through one governed layer, so there is one place to set access and one audit log, whichever client calls: Claude, OpenAI, Copilot Studio or your own framework.

J.W. Pepper used it to reduce 500+ MCP tools to about 20 governed workflows, with zero raw database access, in weeks. Two things follow from that design. Composite tools do a multi-step job in one call, such as a Customer 360 tool that pulls a customer’s Salesforce, Zendesk and Stripe records together, which cuts token use by up to 10× and runs the same steps every time. And there is no vendor MCP server in the path to patch or trust: Tray holds and scopes the credentials, and every call is traced to a user and agent. Regional hosting and on-premise connectors are available on Enterprise plans.

Trade-offs: Agent Gateway doesn’t proxy MCP servers, because it doesn’t need to: it connects to the systems’ APIs instead. That does mean it won’t sit in front of a server you already run. If a team needs a particular vendor’s server to stay in the path, Workato, Boomi, TrueFoundry, Kong, Docker or Microsoft can sit in front of it and Tray cannot. It is managed cloud, and the add-on price is quoted with sales.

Workato Enterprise MCP

Best for: Workato customers who want their own servers and third-party servers under one gateway.

Workato’s Enterprise MCP has four parts: Composer, Registry, Gateway and Runtime. Workato describes the gateway as “the central enforcement point for all MCP traffic”, covering servers built in Workato, its prebuilt servers and remote third-party servers it proxies. Verified User Access runs backend calls as the calling user rather than a shared service account, tool-level RBAC restricts individual tools to subgroups, and server logs capture the user, auth method and tool name and can stream to a SIEM.

Trade-offs: MCP pricing is not published; Workato’s docs send you to your Customer Success representative. The platform’s self-service plans start at $75 a month for 2,500 credits that expire each month, and Enterprise editions are quoted.

Boomi, including Lunar.dev MCPX

Best for: Boomi customers who want a gateway, a registry and managed tools from the same vendor.

Boomi completed its acquisition of Lunar.dev this year, and Lunar’s MCPX documentation now points to Boomi’s AI Gateway. The gateway aggregates local and remote MCP servers behind one endpoint, with policies on which tools each agent can reach. Boomi Connect, the managed connector service, adds IT-governed tools with OAuth pass-through so each call keeps the user’s own permissions, and an MCP Registry catalogs servers built on Boomi, imported from public registries or registered by admins.

Trade-offs: no published price for the gateway or Connect. The only published Boomi price is the Pay-As-You-Go platform plan.

Zapier MCP

Best for: teams that want agents acting in a long list of SaaS apps quickly.

Zapier MCP connects AI clients to Zapier’s own actions across 9,000+ apps, and it is on every plan, including Free. Each user connects their own apps, connections cannot be shared, and the History tab keeps a user-level log of tool calls. Each successful call uses two Zapier tasks.

Trade-offs: it governs Zapier’s own actions rather than other MCP servers, and Zapier’s access controls apply to the whole account rather than to MCP on its own. App and action restrictions are an Enterprise feature.

Composio

Best for: developers building agents into their own product, with per-user auth handled for them.

Composio positions its gateway as “a centralized security and control layer between AI agents and the MCP servers they call”, over its managed integrations and any servers you add. It makes the same argument we do about plain proxies: “A proxy forwards traffic but leaves you owning every connection.” Credentials are managed and never reach the agent, each end user gets their own connected accounts, and policies can block a single action without disabling a whole toolkit. It runs in Composio Cloud, your VPC or self-hosted.

Trade-offs: it is built for developers embedding agents in a product more than for an IT team governing company-wide use, and some of its enterprise claims appear only on its marketing pages.

Dedicated MCP gateways

TrueFoundry MCP Gateway

Best for: platform teams that want one gateway for both model traffic and MCP traffic.

Each MCP server registers with the gateway and becomes reachable through one endpoint, and virtual MCP servers expose only a subset of tools. Inbound, it accepts tokens from Okta, Azure AD and Auth0. Outbound, it supports per-user OAuth2, shared or per-user keys, and token pass-through. RBAC covers which servers and which tools a user can call. It runs as SaaS or in your VPC, on-prem or air-gapped.

Trade-offs: it governs servers you bring rather than shipping a connector catalog, so the tools themselves are still yours to build and maintain.

Kong AI Gateway

Best for: teams that already run Kong for APIs.

Kong can proxy an existing MCP server, aggregate tools into one endpoint, or turn REST API paths into MCP tools. Its OAuth plugin implements the MCP authorization spec, per-tool access lists are available, and audit logs record sessions, methods, payloads and errors.

Trade-offs: both MCP plugins are part of Kong’s AI Gateway Enterprise offering, which is priced with sales.

Bifrost by Maxim AI

Best for: teams that want human approval on every tool call and an open-source gateway they host.

Bifrost connects to MCP servers and exposes them through one endpoint. By default, tool calls from a model are suggestions only, and nothing runs until your application calls the execute endpoint, unless you list a tool for auto-execution. Per-user OAuth gives each end user their own token to the upstream service, and virtual keys carry tool allow-lists.

Trade-offs: SSO and signed audit logs are Enterprise features, and the split between the open-source and Enterprise MCP features is not spelled out in one place.

Obot

Best for: teams that want an open-source registry, gateway and server hosting in one stack.

Obot hosts MCP servers as Docker or Kubernetes workloads, can turn an OpenAPI description into a hosted server, and combines several servers behind one virtual endpoint. SSO covers GitHub, Google, Okta and Microsoft Entra, RBAC decides which users and groups can discover and call which servers, and every MCP call is logged. All editions run the same open-source code.

Trade-offs: the Obot Cloud price is not published, and per-user OAuth to upstream servers is not clearly documented.

Open-source gateways from platform vendors

Microsoft MCP Gateway and Azure API Management

Best for: teams standardized on Azure and Entra ID.

Microsoft’s open-source MCP Gateway is a reverse proxy and management layer for MCP servers on Kubernetes, with Entra ID tokens and role-based access. Azure API Management can expose an existing MCP server or turn a REST API into one, with OAuth 2.1 through Entra ID and Azure Monitor logging.

Trade-offs: in API Management, policies apply to all operations exposed as tools rather than to individual tools, and only MCP tools are supported, not resources or prompts.

Docker MCP Gateway

Best for: running each MCP server in an isolated container.

Docker’s open-source MCP Gateway runs every server in its own restricted container, draws on a catalog of 300+ verified servers, and supports per-tool allow-lists, built-in OAuth flows and call tracing. The paid Docker MCP Enterprise Gateway adds deny-by-default for unvetted servers, allow and deny rules down to the call, and per-user audit events streamed to your SIEM, running in your cloud or air-gapped.

Trade-offs: the Enterprise Gateway is quoted through sales.

How to choose

• You need to govern MCP servers teams already run. Look at Workato, Boomi, TrueFoundry, Kong, Docker or Microsoft, which can sit in front of them.
• You would rather run fewer servers. Look at Tray.ai, Composio or Zapier, which publish governed tools from their own connectors, or Boomi Connect. MCP vs API sets out what proxying a server per system costs in tokens, credentials and logs.
• Every call must run as the person asking. Check per-user execution system by system. Workato, Zapier, Composio, Boomi Connect, TrueFoundry and Bifrost document it, and Tray traces every call to a user and agent.
• You want a person to approve tool calls. Bifrost requires it by default. Elsewhere, check how approval fits the actions that matter, such as anything that moves money or reaches a customer.
• You need to self-host. Bifrost, Obot, Microsoft’s gateway and Docker’s are open source, and Composio and TrueFoundry run in your own VPC.
• You need a price before a call. Zapier, Composio, TrueFoundry and the open-source editions publish one. Tray starts at $50 a month.

Sources

Every product claim was read on 22 October 2026 on the vendor’s own pages:

• Workato: MCP Gateway, Enterprise MCP, workato.com/mcp, pricing, self-service pricing
• Boomi: AI Gateway overview, Boomi Connect, Lunar.dev acquisition, Pay-As-You-Go
• Zapier: Zapier MCP, MCP security, pricing
• Composio: MCP Gateway, docs, pricing
• TrueFoundry: MCP Gateway, auth and security, pricing
• Kong: AI Gateway MCP, AI MCP Proxy, AI MCP OAuth2, pricing
• Bifrost: Bifrost, MCP overview, per-user OAuth
• Obot: obot.ai, GitHub
• Microsoft: MCP Gateway, API Management MCP servers, securing MCP servers
• Docker: MCP Gateway, MCP Catalog and Toolkit, GitHub
• Tray.ai: Agent Gateway for MCP, pricing. For the security controls behind any of these choices, see the MCP security checklist.