Top 5 MCP gateways for AI agents in your product in 2026

Model Context Protocol (MCP) is an open standard for connecting AI agents to external tools. As MCP adoption has grown, MCP gateways have emerged to manage and govern traffic between agents and MCP servers. There are two main use cases for MCP gateways: Internal and enterprise governance: Organizations use MCP gateways to govern how employees’ AI agents access MCP servers. Examples include TrueFoundry, Lunar.dev MCPX, and Microsoft MCP Gateway. Agents in SaaS products: SaaS companies need to connect customer-facing agents to each user’s third-party accounts, such as Salesforce, Gmail, or Notion. For this use case, a gateway needs to support end-user authorization, isolate credentials between tenants, and prevent credentials from being exposed to the model. In this article, we evaluate MCP gateways specifically for the second use case: AI agents embedded in your product. What is the best MCP gateway? The best MCP gateway depends on your project requirements. Arcade.dev is a strong choice if you need agent-native authentication and tool execution. Composio combines a large catalog of pre-built integrations with managed authentication and tool execution. Pipedream MCP stands out for connecting agents to a broad range of APIs. However, if your main goal is to give customer-facing agents authenticated access to SaaS APIs, you may not need an MCP gateway. An integration platform like Nango provides pre-built and custom tools with per-user authentication, exposing them to agents over MCP. It removes the need to build, authenticate, and operate underlying MCP servers yourself. TL;DR Arcade.dev: An MCP runtime and gateway with a large catalog of agent-optimized tools and built-in end-user authentication. It handles per-user authorization, tool execution, and governance while keeping credentials out of the LLM and MCP client. Composio: A managed MCP gateway with 1,500+ managed toolkits and support for custom MCP servers behind a single endpoint. However, a May 2026 security incident compromised about 0.3% of its active connections, including more than 5,000 GitHub connections. Pipedream MCP: A hosted MCP integration layer offering 10,000+ tools across 3,000+ APIs, with managed authentication for connecting end-user accounts. When to skip a gateway entirely: If your main requirement is connecting each customer’s account to third-party APIs, you may not need a separate MCP gateway. An integration platform like Nango with per-user authentication, pre-built tools, and MCP support can handle the API integration layer and expose those tools directly to your agents. What is an MCP gateway? An MCP gateway is a service between AI agents (clients) and the MCP servers they call. It routes MCP traffic through a single governed endpoint instead of connecting each agent directly to individual servers. It applies authentication, access policies, rate limits, and logging. This service is different from the related components around it. An MCP server exposes tools, resources, or prompts to clients. An MCP registry helps clients discover available servers. Routers and proxies primarily route traffic or provide a common endpoint in front of multiple servers. However, some products add gateway-like policy and governance features. Also read the distinctions between MCP gateway vs MCP proxy, including when a gateway is not worth operating. The July 2026 MCP specification also made gateways easier to operate at scale. MCP now supports stateless requests and exposes the method and tool name in HTTP headers. It allows gateways to route, authorize, and rate-limit requests without inspecting the JSON-RPC body. How we evaluated these MCP gateways End-user auth, not platform auth: Does your gateway support per-user OAuth for every connected account? Does it provide white-labeling and isolated tokens per tenant, and never expose them to the model? This is the biggest gap in governance-first gateways, which assume the caller is an employee. Tool governance at agent granularity: Can you control which tools an agent can use for each tenant and require user approval before it performs sensitive actions? Catalog and custom tools: How many pre-built servers are available, and can your engineers build and deploy custom tools when the catalog doesn’t cover what you need? Context discipline: Giving an agent a large catalog of tools at once consumes context and can make tool selection less reliable. Look for gateways that can expose only relevant tools dynamically instead of loading the entire catalog into the model’s context. This helps reduce the token and accuracy costs of exposing too many tools. Protocol fidelity: The gateway should support Streamable HTTP and stateless operation so it can scale horizontally. It should also support the OpenAI tool format alongside MCP because many agent frameworks still do not support MCP. Deployment and compliance: Check whether the provider offers the deployment model you need, such as SaaS, self-hosted, or BYOC. For compliance requirements, look for SOC 2, BAA availability if you handle health data, and EU data residency. Pricing legibility: Will you pay per tool call, per connection, or per seat? Model an agent that makes 50 tool calls in one session before you choose. The 5 best MCP gateways for product-embedded agents 1. Arcade.dev Overview Arcade.dev is an MCP gateway and runtime for AI agents, with built-in end-user authorization. It offers more than 8,000 agent-optimized tools. It also lets developers build and deploy their own MCP tools. Arcade MCP Gateways can combine its hosted tools with tools from custom or third-party MCP servers behind a single endpoint. Best for Arcade is best for teams building customer-facing agents that need per-user authentication and access to a large catalog of ready-made tools. It is particularly suitable when end-user OAuth and governed tool execution are core requirements. Pros End-user OAuth as the default: Arcade runs the authorization flow per user, stores the tokens, and keeps them out of the model and the client. Custom tools on the same runtime: The arcade-mcp framework lets engineers build MCP servers. Deployment options for residency: This tool supports managed deployments in your AWS or Azure account, as well as self-hosting with Helm on your own Kubernetes cluster. Cons Focused on tool execution: Arcade focuses on tool calls rather than data syncs for RAG, webhook ingestion, or polling-based triggers. Advanced governance requires Enterprise: Features such as Role-Based Access Control (RBAC), Single Sign-On (SSO), audit logs, and self-hosted deployment are available only on Arcade’s Enterprise plan. Arcade appears on the consent screen by default: If you want users to see your own brand instead of Arcade during authorization, you need to configure your own OAuth client for each provider and set up a custom verifier route. Arcade Cloud is US-only, and training is opt-out: The managed Arcade Cloud stores data in the United States. Tool queries, execution inputs, and results may be used as training data and retained for up to five years unless the organization opts out. Per-call pricing adds up at agent volume: the Team plan bills $0.10 per auth event and $0.01 per tool call, so a session with 50 tool calls costs about $0.50 before the model bill. Usage-based pricing can add up at scale: The Team plan charges $0.10 per auth event and $0.01 per tool call, on top of a $25 monthly platform fee. At that rate, 50 tool calls add $0.50 in usage charges before authentication and model costs. For a detailed head-to-head, see Arcade.dev vs Nango. 2. Composio Overview Composio is a managed tool and MCP platform that gives AI agents access to 1,500+ integrations. It handles end-user authentication and provides just-in-time tool search. This lets agents find the tools they need without loading the entire catalog into context. Its MCP Gateway can also bring managed tools and custom MCP servers behind a single endpoint, with access controls, dynamic tool selection, and logging. Best for Composio is best for teams that want a large catalog of agent-ready integrations with managed end-user authentication and tool execution. It is particularly useful when broad API coverage and just-in-time tool discovery are priorities. Pros A large managed catalog: Composio offers 1,500+ integrations reachable through one MCP URL. Just-in-time tool search: It lets agents search for tools when they need them, instead of receiving the full catalog at once. Payload retention controls: Its zero data retention control keeps request and response bodies out of Composio’s store, metered per tool call. Cons White-label OAuth requires your own provider apps: End users see Composio on the OAuth consent screen. To show your own product instead, you need use your own OAuth app. Custom tools don’t run on Composio’s hosted runtime: You can write custom tools, but they run inside your application rather than being deployed to Composio. If you want custom tools over MCP, you need to operate your own remote MCP server. Compliance features add usage costs: A BAA is available on Pro and Enterprise for an additional $0.0003 per tool call. Zero Data Retention is also a paid add-on, costing $0.0001 per tool call and $0.0005 per trigger event. Important: Composio disclosed a security incident on May 21, 2026. An attacker gained a foothold in an internal agentic tool, escalated through the sandboxed execution environment, and reached an auxiliary credential cache. The incident affected 5,001 GitHub connections, and a cache containing 5,241 API keys was also considered potentially exposed. Composio revoked affected credentials and required customers to rotate their API keys. Teams evaluating the platform should account for both the incident and Composio’s remediation in their security review. Read the best Composio alternatives to see the alternatives for this platform. 3. Pipedream MCP Overview Pipedream MCP is Pipedream’s hosted MCP integration layer for developers building AI applications. This platform gives agents access to 10,000+ tools across 3,000+ APIs. It handles authentication for each end user through Pipedream Connect. Pipedream also offers a separate MCP gateway, Conduit. It primarily targets internal enterprise use with centralized access policies, SSO, audit logs, and observability. Workday has announced its acquisition of Pipedream on November 19, 2025. Best for Pipedream MCP is best for teams that prioritize broad integration coverage. With 10,000+ tools across 3,000+ APIs and managed authentication for end users, it is particularly useful for agents that need to take actions across many third-party applications. Pros A broad catalog: Pipedream offers a broad catalog with managed auth across every app in it. Per-user connections without building the flow: If a user needs to connect to an account, Pipedream MCP can handle the authorization through a Connect Link. You don’t have to build the connection flow yourself. Cons Non-standard tool schemas: Instead of plain JSON schemas, Pipedream has created its own schema for action input with non-standard data types like dynamic and external props. This limits compatibility with agent tooling. Auth is not white-label: End users see Pipedream on the connection screen. Pipedream’s team has confirmed on its community forum that this holds even when you register your own OAuth client. Per-user pricing on top of the plan: Connect is $99 per month plus $2 per additional user. So cost scales with your customer count rather than usage. Roadmap uncertainty: Pipedream has been part of Workday since November 2025. So its long-term direction may increasingly align with Workday’s agent ecosystem instead of customer-facing embedded use cases. 4. Klavis AI Overview Klavis AI’s Strata provides a single MCP endpoint for connecting agents to tools across multiple MCP servers. Strata does not expose every tool definition to the agent at once. It progressively discovers server, action, and tool details as needed. This helps avoid large tool catalogs overloading the model’s context. Strata can work with Klavis-hosted integrations as well as custom and third-party MCP servers. Teams can self-host this Strata if they want to run the gateway on their own infrastructure. Best for Klavis AI is best for teams that need to give agents access to many tools without overloading the model’s context. Strata is useful for discovering tools as needed and combining different MCP servers behind one endpoint. Pros Progressive tool discovery: Strata exposes tools as the agent needs them. It doesn’t list the catalog on every request. White-label OAuth: You can run the flows under your own branding and your own OAuth applications. Open source and self-hostable: The Strata server runs on your own infrastructure. Cons Progressive discovery adds extra steps: Strata reduces context usage by discovering tools in stages. But this means the agent may need several tool calls before it reaches and executes the final action. You still operate custom MCP servers: Strata can connect to custom and third-party MCP servers. But it does not host those external servers for you. You remain responsible for deploying and maintaining them. Limited public compliance information: Strata resources do not provide details on certifications such as SOC 2, HIPAA/BAA support, or regional data residency. You need to confirm them with Klavis for enterprise deployments. 5. Docker MCP Gateway Overview MCP Gateway is Docker’s open-source solution for orchestrating MCP servers. It acts as a centralized proxy between clients and servers. It handles server lifecycle, routing, authentication, configuration, credentials, and access control. It also provides built-in logging and call tracing. This gateway runs MCP servers in isolated Docker containers. Best for Docker MCP Gateway is best for teams already using Docker that want to run and isolate MCP servers in containers. It is particularly suitable when your team wants to operate the gateway and control how MCP servers are deployed. Pros Container-per-server isolation: Each MCP server runs in an isolated Docker container with restricted privileges, network access, and resource usage. Control which servers are exposed: Docker profiles determine which MCP servers are available through a gateway instance. Built-in observability: The gateway provides logging and call tracing for MCP tool activity. Cons Some enterprise functionality is invite-only: Since MCP Gateway is part of Docker AI Governance, it currently requires access through Docker Sales. Self-managed deployments require operations work: If you run the gateway directly with Docker Engine, your team is responsible for deploying and operating it. Profiles work at the server level: The documented profile mechanism determines which MCP servers a client can access. This page does not describe the kind of per-user or per-tool authorization policies offered by some managed gateways. Do you need an MCP gateway or an integration platform that supports MCP? MCP gateways govern traffic between agents and MCP servers. But they do not handle all the API integration work behind those servers. You still need to handle OAuth, token refresh, rate limits, pagination, and API-specific behavior. The MCP specification also forbids token passthrough: an MCP server cannot simply forward the token it receives from an MCP client to an upstream API. Therefore, you need a separate layer to manage each customer’s credentials and API access for the agents embedded in your product. Nango connects your AI agent to 1000+ APIs with 7,000+ pre-built tool calls and managed auth behind each one. You can use the catalog as it ships, then customize what you need with code on infrastructure built for scale. Hundreds of AI companies run it in production. You need to consider three things for this comparison: A pre-built catalog: Nango provides 7,000+ tool calls across 1000+ APIs. It supports white-label authentication for OAuth, API keys, JWT, and MCP Auth for external MCP servers. Customers authenticate from your app under your brand, while credentials remain server-side. The agent uses a connection ID instead of credentials. Enterprise deployment and controls: Each agent session gets its own MCP endpoint, with one connection per integration. You can control the tools available to the agent with allow and deny lists. The nango_tool_search meta tool lets the agent find tools when needed instead of loading the full catalog into context. Nango logs each execution, including requests and responses, and supports OpenTelemetry export. For enterprise deployments, Nango supports SOC 2 Type II, GDPR, HIPAA with a BAA, self-hosting, and BYOC deployments in your own cloud account and region. Code and developer-first: Nango Functions are written in TypeScript and deployed through the CLI. The AI builder skill works with Claude Code, Cursor, Codex, and other coding agents. The agent can research an API, write the integration, test it against a real connection, and deploy it. Nango used this approach to generate around 200 integrations across five APIs in 15 minutes. The same approach can also support just-in-time integrations, where new integration functionality is built when a customer needs it. When to use a gateway instead: Nango is not designed to route or aggregate arbitrary third-party MCP servers. If you already have MCP servers and need a central layer for routing and access policies, use an MCP gateway. Fine-grained RBAC for connections shared across multiple users is also still being developed. Comparison of MCP gateways Capability Arcade.dev Composio Pipedream MCP Klavis AI Docker MCP Gateway Nango (not a gateway) Per-user OAuth Yes Yes Yes Yes No Yes White-label auth Partial No No Yes Not applicable Yes Pre-built catalog 80+ servers, 7,500 tools 1,500+ integrations 3,000+ APIs, 10,000 tools ~100 integrations None 1000+ APIs, 7,000+ tools Custom tools on the runtime Yes No Partial No Yes Yes Coding agents build tools No No No No No Yes Tool allow and deny lists Enterprise Partial No Partial Yes Yes Just-in-time tool exposure No Yes No Yes No Yes Syncs and webhooks No No Partial No No Yes Open source No No No Yes Yes Yes Self-host or BYOC Enterprise Enterprise Partial Yes Yes Yes SOC 2 / BAA SOC 2 II / unverified SOC 2 II / paid add-on SOC 2 II / confirm Unverified Not applicable SOC 2 II / on request Pricing model Per auth event and tool call Per tool call Per month and external user Contact vendor Free Per connection FAQ What is an MCP gateway and why do you need one? An MCP gateway sits between your AI agents and MCP servers. It gives you one place to manage authentication, control which tools agents can use, route requests, and log activity. A gateway becomes useful when multiple clients or teams use many MCP servers and need the same policies across them. If one team uses only a few MCP servers it manages directly, a gateway may not be necessary. What is the difference between an MCP gateway, an MCP server, and an MCP registry? An MCP server executes tools against one system, such as Salesforce or GitHub. An MCP gateway sits in front of many servers and governs the traffic to them. An MCP registry is a directory that lists servers and doesn’t route requests. Is an LLM gateway like LiteLLM or Portkey the same as an MCP gateway? No. An LLM gateway manages requests to model providers, including API keys, costs, and fallbacks. An MCP gateway manages the connection between agents and MCP servers, including tool access and routing. They solve different problems, and you may need both in the same agent architecture. Are there SOC 2 compliant managed MCP gateways? Yes. Arcade.dev and Composio are both SOC 2 Type II compliant, and Composio also holds ISO 27001 certification. When comparing providers, look beyond the certification itself. Check what the audit covers, whether you can review the report, and whether the provider offers agreements such as a BAA. Nango is also SOC 2 Type II compliant and supports GDPR and HIPAA requirements. You can review its compliance information in the Nango Trust Center, and a BAA is available on request. Its runtime is open source, which also lets security teams inspect the code. How do MCP gateways handle OAuth for end users? MCP authentication and authentication to the underlying API are separate. Your agent may authenticate with the MCP gateway. However, a customer still needs to authorize access to an application such as Salesforce. The MCP specification does not allow the gateway to simply forward the token it received from the MCP client to that API. For customer-facing agents, check how the gateway handles these end-user credentials. Tokens should remain on the server, be kept separate for each customer, and only be used when the agent executes a tool on that customer’s behalf. See our guide to secure AI agent authentication. What is the most scalable MCP setup for embedded SaaS integrations? For embedded SaaS integrations, use a stateless MCP endpoint and keep each customer connection separate. This lets requests run on any available instance without mixing customer credentials. As you add more tools, expose them only when the agent needs them rather than loading the full catalog into context. Nango follows this approach with agent sessions. Each session gets its own MCP URL and uses one connection per integration. You can also control which tools are available using allow and deny lists. Do I need an MCP gateway if my agent only uses a few tools? Probably not. If your agent uses only a few tools or MCP servers, you can usually connect them directly and manage authentication for each one. A gateway introduces another service to deploy, monitor, and maintain. It becomes more useful as you add more MCP servers or clients and need consistent access policies, credential isolation, and logging across them. Can AI agents in my product use my customers’ existing MCP servers? Yes, as long as the MCP server supports an authentication flow your application can use. Nango’s MCP Auth can handle authentication with compatible MCP servers and securely store each customer’s credentials. Your agent can then call the MCP server through Nango using the correct customer connection, without handling the credentials itself. Conclusion MCP gateways are useful when you already have MCP servers and need a central place to manage access, routing, and policies. For agents embedded in a SaaS product, another requirement is that each customer connects their own accounts without exposing credentials to the agent. The five products in this article handle that problem differently. Before choosing one, check its end-user authentication model, tool controls, deployment options, and pricing against your own architecture. If you need to build and maintain the API integrations behind your MCP servers, an integration platform may be better than an MCP gateway. Nango provides managed authentication and pre-built tools for 1000+ APIs, supports custom tools, and exposes them to agents through MCP. You can try it with the Nango quickstart. Related reading: MCP gateway vs MCP proxy: Do you need one? Best MCP servers for agent API integrations in 2026 MCP vs tool calls for AI agents: which is better? Stateless MCP: how it changes the way agents call tools Best AI agent integration platforms in 2026