The best open-source MCP gateways in 2026: 8 compared

Last updated November 9, 2026. Facts come from each project's own repo and docs; star counts and release dates were read from GitHub on November 2, 2026. No lab results yet: this is a fact comparison, not a ranking by test score.

Short answer: there is no single best open-source MCP gateway. It depends on where you run it.

• You want a fast, standalone data plane for MCP, A2A and LLM traffic: agentgateway (Apache-2.0, an Agentic AI Foundation project, about 5,900 GitHub stars). Version 1.7.0 (Oct 27, 2026) makes prompt guards inspect tool outputs by default.
• You want a registry plus gateway that federates MCP, A2A and REST/gRPC APIs: IBM's ContextForge (Apache-2.0, about 4,700 stars, v1.1.0 on Oct 20, 2026).
• You run MCP servers as containers on developer machines: Docker MCP Gateway (MIT). Use 0.42.2 or later because of CVE-2026-55887.
• You run Kubernetes and want stateless MCP routing: Microsoft MCP Gateway (MIT). The current version only accepts clients that speak MCP protocol version 2026-07-28.
• You're on Red Hat OpenShift: Red Hat MCP Gateway (Kuadrant project, Apache-2.0), generally available in Connectivity Link 1.5 since Oct 16, 2026, with NeMo Guardrails checks on tool calls.
• You want a full governance platform (gateways, registries, audit logs) you can self-host: Obot (MIT, with a commercial offering).
• You already run Kong: Kong AI Gateway governs LLM, MCP and agent-to-agent traffic on one Konnect control plane (Apache-2.0 core + commercial; Konnect Plus from $25/mo + usage).
• You want a lightweight local proxy that masks secrets in MCP traffic: Lasso MCP Gateway (MIT). It has had no release since v1.2.0 in January 2026.

Comparison table

What an MCP gateway should do for security

An MCP gateway sits between AI clients (agents, IDEs, chat apps) and the MCP servers they call. When you compare them, check five things: who is allowed to reach which server and tool, whether credentials stay in the gateway instead of the agent, whether tool calls and tool outputs are screened for prompt injection, whether every call is logged with the user and agent behind it, and how the gateway itself is protected. Docker's CVE-2026-55887 is a reminder that the gateway is attack surface too.

Gateway by gateway

agentgateway. Open-source data plane for LLM, MCP, A2A and HTTP traffic, hosted by the Agentic AI Foundation (Linux Foundation) since June 4, 2026. Version 1.7.0 makes prompt guards inspect tool outputs by default, filters MCP traffic with CEL expressions, encrypts MCP session IDs by default in standalone mode, and stops dynamic backends from reaching loopback and cloud-metadata addresses. Full listing

ContextForge (IBM). Registry and proxy that puts MCP, A2A and REST/gRPC APIs behind one endpoint, with rate limiting, authentication, retries, 40+ plugins and OpenTelemetry tracing. Full listing

Docker MCP Gateway. Docker CLI plugin and gateway for running and managing containerized MCP servers. Versions 0.21.0 through 0.42.1 are affected by CVE-2026-55887, where a malicious image label could run code on the host; it is fixed in 0.42.2. Full listing

Obot. Open-source platform with MCP and LLM gateways, curated MCP server and skill registries, tool access by user or identity-provider group, isolated hosting for MCP servers, and correlated audit logs. Full listing

Microsoft MCP Gateway. Reverse proxy and management layer for MCP servers on Kubernetes. It routes each request independently to a ready server instance and handles authorization, lifecycle and telemetry. The current version requires MCP 2026-07-28 clients and drops legacy sessions. Full listing

Lasso MCP Gateway. Plugin-based proxy in front of other MCP servers that masks sensitive data and can check a server's reputation before loading it. Quiet since January 2026. Full listing

Red Hat MCP Gateway. Envoy-based gateway from the Kuadrant project, generally available in Red Hat Connectivity Link 1.5 (Oct 16, 2026), with gateway isolation, prompt and resource federation, and NeMo Guardrails checks on tool calls. Full listing

Kong AI Gateway. Runtime governance for LLM, MCP and agent-to-agent traffic with one set of policies and one Konnect control plane; open source (Apache-2.0) plus commercial, also available standalone. Check which AI and MCP plugins are in the open-source edition; Konnect Plus starts at $25 a month plus usage. Full listing

Not open source, but worth knowing

If you'd rather buy than run one, the directory also lists commercial MCP gateways: Lunar.dev MCPX (now owned by Boomi), Runlayer, Mintive, PointGuard AI Gateway and Google Cloud Agent Gateway. If you want to check MCP servers before you connect them, see MCP security scanners compared. See everything in MCP gateways & scanners, or download the open data.

Sources checked on November 2, 2026

• agentgateway: https://github.com/agentgateway/agentgateway, https://github.com/agentgateway/agentgateway/releases/tag/v1.7.0 and https://agentgateway.dev/blog/2026-06-04-agentgateway-joins-aaif/
• ContextForge: https://github.com/IBM/mcp-context-forge and https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.0
• Docker MCP Gateway: https://github.com/docker/mcp-gateway and https://github.com/docker/mcp-gateway/security/advisories/GHSA-r2xf-7jw5-pjg6
• Obot: https://github.com/obot-platform/obot and https://obot.ai/
• Microsoft MCP Gateway: https://github.com/microsoft/mcp-gateway
• Lasso MCP Gateway: https://github.com/lasso-security/mcp-gateway/releases/tag/v1.2.0
• Red Hat MCP Gateway: https://www.redhat.com/en/blog/model-context-protocol-gateway-red-hat-openshift-now-generally-available and https://github.com/Kuadrant/mcp-gateway
• Kong AI Gateway: https://konghq.com/products/kong-ai-gateway, https://github.com/Kong/kong and https://konghq.com/pricing
• Star counts, licenses and release dates: GitHub API, read November 2, 2026

All MCP gateways & scanners Open data (JSON) Methodology