Model Context Protocol (MCP) is an open standard for connecting AI agents to external tools. As MCP adoption has grown, MCP gateways have emerged to manage and govern traffic between agents and MCP servers.
There are two main use cases for MCP gateways:
In this article, we evaluate MCP gateways specifically for the second use case: AI agents embedded in your product.
The best MCP gateway depends on your project requirements. Arcade.dev is a strong choice if you need agent-native authentication and tool execution. Composio combines a large catalog of pre-built integrations with managed authentication and tool execution. Pipedream MCP stands out for connecting agents to a broad range of APIs.
However, if your main goal is to give customer-facing agents authenticated access to SaaS APIs, you may not need an MCP gateway. An integration platform like Nango provides pre-built and custom tools with per-user authentication, exposing them to agents over MCP. It removes the need to build, authenticate, and operate underlying MCP servers yourself.
An MCP gateway is a service between AI agents (clients) and the MCP servers they call. It routes MCP traffic through a single governed endpoint instead of connecting each agent directly to individual servers. It applies authentication, access policies, rate limits, and logging.
This service is different from the related components around it. An MCP server exposes tools, resources, or prompts to clients. An MCP registry helps clients discover available servers. Routers and proxies primarily route traffic or provide a common endpoint in front of multiple servers. However, some products add gateway-like policy and governance features.
Also read the distinctions between MCP gateway vs MCP proxy, including when a gateway is not worth operating. The July 2026 MCP specification also made gateways easier to operate at scale. MCP now supports stateless requests and exposes the method and tool name in HTTP headers. It allows gateways to route, authorize, and rate-limit requests without inspecting the JSON-RPC body.
Overview
Arcade.dev is an MCP gateway and runtime for AI agents, with built-in end-user authorization. It offers more than 8,000 agent-optimized tools. It also lets developers build and deploy their own MCP tools. Arcade MCP Gateways can combine its hosted tools with tools from custom or third-party MCP servers behind a single endpoint.
Best for
Arcade is best for teams building customer-facing agents that need per-user authentication and access to a large catalog of ready-made tools. It is particularly suitable when end-user OAuth and governed tool execution are core requirements.
Pros
arcade-mcp framework lets engineers build MCP servers.
Cons
For a detailed head-to-head, see Arcade.dev vs Nango. Composio is a managed tool and MCP platform that gives AI agents access to 1,500+ integrations. It handles end-user authentication and provides just-in-time tool search. This lets agents find the tools they need without the entire catalog into context. Its MCP Gateway can also bring managed tools and custom MCP servers behind a single endpoint, with access controls, dynamic tool selection, and logging.
Composio is best for teams that want a large catalog of agent-ready integrations with managed end-user authentication and tool execution. It is particularly useful when broad API coverage and just-in-time tool discovery are priorities.
Important: Composio disclosed a security incident on May 21, 2026. An attacker gained a foothold in an internal agentic tool, escalated through the sandboxed execution environment, and reached an auxiliary credential cache. The incident affected 5,001 GitHub connections, and a cache containing 5,241 API keys was also considered potentially exposed. Composio revoked affected credentials and required customers to rotate their API keys. Teams evaluating the platform should account for both the incident and Composio’s remediation in their security review.
Read the best Composio alternatives to see the alternatives for this platform.
Pipedream MCP is Pipedream’s hosted MCP integration layer for developers building AI applications. This platform gives agents access to 10,000+ tools across 3,000+ APIs. It handles authentication for each end user through Pipedream Connect.
Pipedream also offers a separate MCP gateway, Conduit. It primarily targets internal enterprise use with centralized access policies, SSO, audit logs, and observability.
Workday has announced its acquisition of Pipedream on November 19, 2025. Pipedream MCP is best for teams that prioritize broad integration coverage. With 10,000+ tools across 3,000+ APIs and managed authentication for end users, it is particularly useful for agents that need to take actions across many third-party applications.
Klavis AI’s Strata provides a single MCP endpoint for connecting agents to tools across multiple MCP servers.
Strata does not expose every tool definition to the agent at once. It progressively discovers server, action, and tool details as needed. This helps avoid large tool catalogs over the model’s context.
Strata can work with Klavis-hosted integrations as well as custom and third-party MCP servers. Teams can self-host this Strata if they want to run the gateway on their own infrastructure.
Klavis AI is best for teams that need to give agents access to many tools without over the model’s context. Strata is useful for discovering tools as needed and combining different MCP servers behind one endpoint.
MCP Gateway is Docker’s open-source solution for orchestrating MCP servers. It acts as a centralized proxy between clients and servers. It handles server lifecycle, routing, authentication, configuration, credentials, and access control. It also provides built-in logging and call tracing.
This gateway runs MCP servers in isolated Docker containers.
Docker MCP Gateway is best for teams already using Docker that want to run and isolate MCP servers in containers. It is particularly suitable when your team wants to operate the gateway and control how MCP servers are deployed.
MCP gateways govern traffic between agents and MCP servers. But they do not handle all the API integration work behind those servers. You still need to handle OAuth, token refresh, rate limits, pagination, and API-specific behavior. The MCP specification also forbids token passthrough: an MCP server cannot simply forward the token it receives from an MCP client to an upstream API. Therefore, you need a separate layer to manage each customer’s credentials and API access for the agents embedded in your product.
Nango connects your AI agent to 1000+ APIs with 7,000+ pre-built tool calls and managed auth behind each one. You can use the catalog as it ships, then customize what you need with code on infrastructure built for scale. Hundreds of AI companies run it in production.
You need to consider three things for this comparison:
nango_tool_search meta tool lets the agent find tools when needed instead of the full catalog into context. Nango logs each execution, including requests and responses, and supports OpenTelemetry export. For enterprise deployments, Nango supports SOC 2 Type II, GDPR, HIPAA with a BAA, self-hosting, and BYOC deployments in your own cloud account and region.
When to use a gateway instead: Nango is not designed to route or aggregate arbitrary third-party MCP servers. If you already have MCP servers and need a central layer for routing and access policies, use an MCP gateway. Fine-grained RBAC for connections shared across multiple users is also still being developed.
| Capability | Arcade.dev | Composio | Pipedream MCP | Klavis AI | Docker MCP Gateway | Nango (not a gateway) |
|---|---|---|---|---|---|---|
| Per-user OAuth | Yes | Yes | Yes | Yes | No | Yes |
| White-label auth | Partial | No | No | Yes | Not applicable | Yes |
| Pre-built catalog | 80+ servers, 7,500 tools | 1,500+ integrations | 3,000+ APIs, 10,000 tools | ~100 integrations | None | 1000+ APIs, 7,000+ tools |
| Custom tools on the runtime | Yes | No | Partial | No | Yes | Yes |
| Coding agents build tools | No | No | No | No | No | Yes |
| Tool allow and deny lists | Enterprise | Partial | No | Partial | Yes | Yes |
| Just-in-time tool exposure | No | Yes | No | Yes | No | Yes |
| Syncs and webhooks | No | No | Partial | No | No | Yes |
| Open source | No | No | No | Yes | Yes | Yes |
| Self-host or BYOC | Enterprise | Enterprise | Partial | Yes | Yes | Yes |
| SOC 2 / BAA | SOC 2 II / unverified | SOC 2 II / paid add-on | SOC 2 II / confirm | Unverified | Not applicable | SOC 2 II / on request |
| Pricing model | Per auth event and tool call | Per tool call | Per month and external user | Contact vendor | Free | Per connection |
An MCP gateway sits between your AI agents and MCP servers. It gives you one place to manage authentication, control which tools agents can use, route requests, and log activity. A gateway becomes useful when multiple clients or teams use many MCP servers and need the same policies across them. If one team uses only a few MCP servers it manages directly, a gateway may not be necessary.
An MCP server executes tools against one system, such as Salesforce or GitHub. An MCP gateway sits in front of many servers and governs the traffic to them. An MCP registry is a directory that lists servers and doesn’t route requests.
No. An LLM gateway manages requests to model providers, including API keys, costs, and fallbacks. An MCP gateway manages the connection between agents and MCP servers, including tool access and routing. They solve different problems, and you may need both in the same agent architecture.
Yes. Arcade.dev and Composio are both SOC 2 Type II compliant, and Composio also holds ISO 27001 certification. When comparing providers, look beyond the certification itself. Check what the audit covers, whether you can review the report, and whether the provider offers agreements such as a BAA.
Nango is also SOC 2 Type II compliant and supports GDPR and HIPAA requirements. You can review its compliance information in the Nango Trust Center, and a BAA is available on request. Its runtime is open source, which also lets security teams inspect the code.
MCP authentication and authentication to the underlying API are separate. Your agent may authenticate with the MCP gateway. However, a customer still needs to authorize access to an application such as Salesforce. The MCP specification does not allow the gateway to simply forward the token it received from the MCP client to that API.
For customer-facing agents, check how the gateway handles these end-user credentials. Tokens should remain on the server, be kept separate for each customer, and only be used when the agent executes a tool on that customer’s behalf. See our [guide to secure AI agent authentication](https://nango.dev/blog/guide-to-secure-ai-agent-api-authentication).
For embedded SaaS integrations, use a stateless MCP endpoint and keep each customer connection separate. This lets requests run on any available instance without mixing customer credentials. As you add more tools, expose them only when the agent needs them rather than the full catalog into context.
Nango follows this approach with agent sessions. Each session gets its own MCP URL and uses one connection per integration. You can also control which tools are available using allow and deny lists.
Probably not. If your agent uses only a few tools or MCP servers, you can usually connect them directly and manage authentication for each one. A gateway introduces another service to deploy, monitor, and maintain. It becomes more useful as you add more MCP servers or clients and need consistent access policies, credential isolation, and logging across them.
Yes, as long as the MCP server supports an authentication flow your application can use. Nango’s MCP Auth can handle authentication with compatible MCP servers and securely store each customer’s credentials. Your agent can then call the MCP server through Nango using the correct customer connection, without handling the credentials itself.
MCP gateways are useful when you already have MCP servers and need a central place to manage access, routing, and policies. For agents embedded in a SaaS product, another requirement is that each customer connects their own accounts without exposing credentials to the agent.
The five products in this article handle that problem differently. Before choosing one, check its end-user authentication model, tool controls, deployment options, and pricing against your own architecture.
If you need to build and maintain the API integrations behind your MCP servers, an integration platform may be better than an MCP gateway. Nango provides managed authentication and pre-built tools for 1000+ APIs, supports custom tools, and exposes them to agents through MCP. You can try it with the Nango quickstart. Related reading: