Best MCP Gateways Compared: 8 Options for 2026

The best MCP gateways in 2026 depend on who runs them. Docker MCP Gateway, LiteLLM and agentgateway are open source and you operate them. Cloudflare, Portkey, Arcade and Permit.io add identity-provider sign-in and governance for company rollouts. MCPifex is a managed gateway for people who want Claude or ChatGPT connected without running anything. Facts below are as of October 30, 2026.

This is a list-style comparison, so it assumes you already know the basics. If not, start with what an MCP gateway is and how a gateway differs from a plain proxy. Every claim about another vendor comes from its own documentation, linked in each section. Features change quickly, so check the linked page before you commit.

How should you evaluate an MCP gateway?

Six questions separate gateways that look alike on a landing page.

• Hosting: do you run it (container, binary, proxy server) or does the vendor? Self-run means control and maintenance. Managed means less work and less control over where it runs.
• Authentication: how do people and agents prove who they are? API keys are simple. OAuth and your own identity provider (OIDC, SAML) matter once many staff connect.
• Tool-level policy: can you allow or deny single tools, or only whole servers? This is the difference between "the AI can reach the database" and "the AI can read but not delete." Our piece on controlling what AI agents can reach goes deeper.
• Logging: is each tool call recorded with who, which tool and when? You need it for debugging and for audits.
• Multi-tenant access: can different keys, teams or users see different tools? Solo use does not need it. A team does.
• Transport: does it speak Streamable HTTP for web clients such as Claude.ai and ChatGPT, or only stdio for local apps?

We use these six in every section. They come from the official MCP specification concepts, plus what teams ask us when they move from one laptop to many users.

What are the best MCP gateways?

1. Docker MCP Gateway

Docker describes its gateway as an open source solution for orchestrating MCP servers. It sits between AI clients and servers, starts each needed server as a container on demand, and limits container privileges, network access and resources. With Docker Desktop's MCP Toolkit it runs in the background. On Docker Engine you install the binary yourself. The repository is MIT licensed.

Tool control is per profile: you enable or disable individual tools, or all tools of a server, with the docker mcp profile tools command. Transports are stdio by default, plus SSE and streaming for several clients. Docker documents built-in logging and call tracing. Per-user identity is not part of what the page describes.

Best for: a developer or small team already on Docker who wants local, containerized servers. Type: open source, self-run. We compare it head-on with MCPifex in MCPifex vs. Docker MCP Gateway.

2. LiteLLM MCP Gateway

LiteLLM Proxy provides an MCP gateway with a fixed endpoint and access control by key, team or organization. It supports Streamable HTTP, SSE and stdio. Stdio is off by default and needs an environment variable on the proxy process. The auth list is long: API key, bearer token, basic, OAuth 2.0, token exchange, AWS SigV4 and more. It can also turn an OpenAPI spec into an MCP server, and an x-litellm-end-user-id header applies per-customer permissions and budgets.

The docs link an MIT license. They do not say which MCP features sit behind LiteLLM Enterprise, so confirm that before you plan around a feature. You run the proxy yourself. Anyone already routing model calls through LiteLLM gets MCP in the same place.

Best for: platform teams that already use LiteLLM for model routing. Type: open source proxy, self-run.

3. Cloudflare MCP server portals

Cloudflare's gateway-style product is called an MCP server portal. It is a feature of Cloudflare Access. A portal puts several MCP servers behind one HTTP endpoint. Admins can switch off individual tools or prompts, use an allowlist with default_disabled, and rename tools. Users sign in through Cloudflare Access and your identity provider, and machine clients can use service tokens.

Cloudflare logs each tool request with time, status, server, capability and duration. Logpush export is Enterprise only. A portal supports up to 80 servers, and only remote HTTP MCP servers. You need a Cloudflare domain and an identity provider configured in Zero Trust. The docs also warn that users can bypass portal policies through a server's direct URL unless Access is that server's OAuth provider.

Best for: organizations already on Cloudflare Zero Trust. Type: managed service. Cloudflare's separate remote-MCP-server tooling covers building servers, not gating them.

4. Portkey MCP Gateway

Portkey's MCP gateway adds authentication, access control and audit to MCP. It supports OAuth 2.1, API tokens, header auth and JWT validation, with bring-your-own identity provider (Okta and Entra are named). Role-based access applies at organization, workspace, team or user level, and tools not approved in the gateway cannot be used by agents. Each invocation is logged and searchable, and guardrails can stop unauthorized calls before they run.

Portkey lists self-hosted, your-own-cloud and fully managed options. The page calls the product open source and community driven but does not name a license, and it gives no prices. The page's heading reads "Portkey is now PRISMA AIRS AI Gateway", so check how that affects packaging.

Best for: enterprises that need governance across teams. Type: open source and managed, per its own page.

5. Arcade MCP Gateways

Arcade gateways federate tools from several MCP servers into one collection at a URL like https://api.arcade.dev/mcp/{slug}. You choose which tools each gateway exposes in a dashboard, by natural-language request, or through a Tool Recommendation mode that returns only the allowed tools that fit a task. Three auth modes exist: Arcade Auth for development, User Source (your OIDC provider) for production, and Arcade Headers as a fallback for clients that cannot run browser OAuth.

The page does not say whether gateways are open source or how pricing works, and it describes hosting only as a URL on Arcade's domain. Treat it as a managed service unless Arcade says otherwise.

Best for: products that serve many end users, each signing in through your identity provider. Type: managed.

6. agentgateway

agentgateway is an Apache-2.0 open source proxy and a Linux Foundation project. It covers agent-to-LLM, agent-to-tool and agent-to-agent traffic, and its MCP side supports tool federation, stdio, HTTP, SSE and Streamable HTTP, plus OpenAPI and OAuth. Its MCP authorization uses CEL expressions evaluated on MCP methods. Tools a client may not use are removed from the list response, so the client never sees them. Combined with JWT authentication, rules can use claims such as jwt.sub.

One documented limit: tool arguments are not available to the MCP authorization rules, so argument-based rules need a route-level policy. You deploy and operate it.

Best for: engineers who want expressive policy as code and no vendor. Type: open source, self-run.

7. Permit.io MCP Gateway

The Permit MCP Gateway sits between clients such as Cursor, Claude Desktop and Claude Code and your upstream servers. It uses three trust levels: low for read tools, medium adds write tools, high adds destructive tools. Tools get a level by keyword on import and admins can override each one. Admins set a maximum level per user, and each allow or deny decision is logged with the person, agent, tool, server and time. The Community plan keeps audit logs for 7 days.

Sign-in options include passkeys, Google, GitHub, Microsoft, SAML 2.0 and OIDC. Hosting is SaaS, customer-controlled or on-premises, and the last two need an Enterprise plan. The Community plan is labeled free forever, up to 1,000 monthly active identities. Permit's policy engine and OPAL are open source, but the page does not say the gateway is.

Best for: teams that want read, write and destructive tiers per person. Type: managed, with enterprise self-hosting.

8. MCPifex

MCPifex is a managed gateway that also hosts the servers. You pick a server from the marketplace, save your credentials, choose the allowed tools, and paste one URL (https://mcp.mcpifex.com/mcp) into Claude, ChatGPT, Claude Code or Cursor. Five servers are live: PostgreSQL, Google Trends, Google Search Console, App Store Connect and WhatsApp.

Each tool is allowed or denied per instance. Write and destructive tools start off, and a tool outside the catalog is refused. Every session runs in its own process, and each instance keeps call logs. The key works in an Authorization header or in the URL path for web connectors that cannot send headers. Plans: Free with 3 instances, Pro at $19 a month with 10, Team at $49 a month with 30 and up to 5 members. Calls are unlimited on every plan; see pricing.

Honest limits: MCPifex runs its curated server list, not any server you bring, and MCPifex clients authenticate with an MCPifex API key. This page makes no claim about sign-in through your own identity provider (SAML or OIDC); check that first if you need it. For a first connection, follow the quickstart.

Best for: people and small teams who want Claude or ChatGPT on their data without running anything. Type: managed.

How do the eight gateways compare side by side?

Entries come from each vendor's documentation as of October 30, 2026. "Not stated" means the page we checked did not say.

Which gateway should you pick for your use case?

• One developer, local servers, already on Docker: Docker MCP Gateway.
• You already route model calls through a proxy: LiteLLM keeps MCP in the same place.
• Company on Cloudflare Zero Trust: MCP server portals reuse your identity setup.
• Governance across many teams and audit needs: Portkey or Permit.io.
• A product where each end user signs in with your identity provider: Arcade.
• Policy as code, no vendor lock-in: agentgateway.
• Claude or ChatGPT on your database, Search Console or app data with nothing to install: MCPifex. Start on the free plan, no card. Create a free account.

If you are weighing hosting itself, read hosted vs. self-hosted MCP. For team rollouts, see MCP for teams with a centralized gateway.

What should you test before you commit?

Marketing pages describe the best case. Run four checks on any gateway you shortlist. Call an allowed tool and confirm it works. Call a denied tool and confirm it is refused, not just hidden. Connect as a second user and confirm they cannot see the first user's data. Then open the logs and find your own test calls. Ten minutes on those four checks tells you more than any comparison table, including this one.

← Back to comparisons