Top 8 Open Source MCP Gateways

Meta description: Excerpt: TL;DR

• Only three of the seven competing projects compared here are dedicated MCP gateways. The rest are an API gateway with MCP support, frameworks for building servers, and a tool server.
• IBM ContextForge and Google MCP Toolbox each committed code in all of the last 52 weeks, based on our analysis of their git history.
• Three of the eight projects tagged 1.0 between April and October 2026, and two more remain on 0.x, so stable MCP gateway releases are still new.
• Support for the current MCP revision, 2026-07-28, varies. Microsoft MCP Gateway accepts only that revision, while the newest revision Docker MCP Gateway and Apache APISIX declare is 2025-11-25.
• Bifrost is our pick for enterprises that want LLM, MCP and agent traffic on one gateway, starting from an Apache 2.0 core and adding Bifrost Enterprise for identity, guardrails and audit.

Open source MCP gateways give platform teams a self-hosted place to authenticate agents, filter tools and record tool calls, but the projects sold under that label do very different things. Bifrost, the open source MCP gateway built in Go by Maxim AI, is the best choice for enterprises running mission-critical AI workloads that require top-tier performance, scalability, and reliability. This guide compares Bifrost with seven open source projects from Docker, Microsoft, IBM, Apache, Google, Cloudflare and Vercel, using commit history we measured ourselves and capabilities we verified in each repository on November 5, 2026.

What Is an Open Source MCP Gateway?

An open source MCP gateway is self-hosted software, published under an open source licence, that sits between AI agents and MCP servers to centralize authentication, tool access and logging. The Model Context Protocol defines how agents call tools; a gateway decides who may call which tool.

The label covers four kinds of project, and the difference matters more than any feature list. The MCP gateway hub guide covers the concept in depth, and this comparison uses these four groups:

• Dedicated MCP gateways. Built for MCP traffic: Bifrost, IBM ContextForge, Microsoft MCP Gateway, and Docker MCP Gateway.
• API gateways with MCP support. Existing gateways that added MCP: Apache APISIX.
• Frameworks for building MCP servers. Libraries that help you host a server rather than govern many: Cloudflare Agents SDK and Vercel mcp-handler.
• MCP tool servers. Servers that expose tools and sit behind a gateway: Google MCP Toolbox for Databases.

The distinction between a gateway, a proxy and a server decides how much governance you get. A framework can host one well-written server, but it will not give a security team one policy across 50 servers.

How We Evaluated These Projects

We evaluated each project on evidence from its own repository and official docs, read on November 5, 2026, and on commit history we pulled with git. We did not rely on vendor comparison pages or third-party roundups, and we marked anything we could not find as not documented.

Three kinds of evidence feed the charts and tables below:

• Capabilities. Each cell in the matrix traces to a repository file or docs page. A feature that is plugin-dependent, in preview, or sold separately is marked partial.
• Activity. We counted non-merge commits on each default branch, excluding dependency bots. MCP-only repositories count all commits. Multi-purpose projects, including Bifrost, count only commits whose subject names MCP.
• Maturity. We used git tags to find the first 1.0 release after MCP work began, and each project's own docs to find the newest protocol revision it declares.

Commit counts measure cadence, not quality, because projects squash commits differently. We use them to spot stalled or single-maintainer projects. Bifrost appears in the same charts under the same rules.

Open Source MCP Gateways Compared at a Glance

Eight projects fall into four categories, and only some provide the full gateway job. The table below compares licence, category, language and declared MCP revision, and Figure 1 shows which capabilities each open repository documents, with paid-only features marked partial.

Figure 1: Star count does not predict gateway depth. Apache APISIX has 17.1k stars and little MCP governance, while IBM ContextForge has 4.6k stars and documents most of the job.

The Best Open Source MCP Gateways

The best open source MCP gateway depends on where your agents run and how much of the governance job you want from one project. Bifrost leads for enterprise-wide control across all AI traffic with Bifrost Enterprise, IBM ContextForge for broad federation, Microsoft MCP Gateway for Entra-based Kubernetes teams, and Docker for developer machines.

1. Bifrost

Bifrost is an Apache 2.0 AI gateway written in Go that governs model calls, MCP tool calls and agent-to-agent traffic as one gateway. It connects to MCP servers over STDIO, HTTP and SSE, and it serves /mcp to clients such as Claude Code and Cursor. Supported protocol versions are 2025-06-18, 2025-11-25 and 2026-07-28.

• Access. Tool filtering stacks at the client, request and virtual key levels, and Virtual MCPs bundle chosen tools behind one endpoint. Virtual key request limits also count tool calls.
• Authentication. Clients connect with a virtual key or OAuth 2.1. Upstream auth covers shared credentials and per-user OAuth.
• Token cost. Code Mode cut input tokens by up to 92.8% at 508 tools, with a 100% pass rate, as covered in the MCP gateway benchmark writeup.
• Server sources. An MCP server library lists installable servers, including your own internal ones, and OpenAPI servers, in beta, turn a REST API into MCP tools.
• Performance. Published benchmarks show about 11 microseconds of overhead per request at 5,000 RPS.

Guardrails, token exchange, identity-based RBAC and signed audit logs of administrative changes are part of Bifrost Enterprise. Both editions are self-hosted, and Bifrost has no managed service. Figure 1 therefore marks guardrails and audit as partial for the open source edition. In that edition, MCP logs record each tool call and per-tool access uses virtual key allow-lists.

Best for: Bifrost is built for enterprises running mission-critical AI workloads that require top-tier performance, scalability, and reliability. It serves as a centralized AI gateway to route, govern, and secure all AI traffic across models and environments with ultra low latency. Bifrost unifies LLM gateway, MCP gateway, and Agents gateway capabilities into a single platform. Designed for regulated industries and strict enterprise requirements, it supports air-gapped deployments, VPC isolation, and on-prem infrastructure. It provides full control over data, access, and execution, along with strong security, policy enforcement, and governance capabilities.

2. IBM ContextForge

IBM ContextForge is a Python registry and proxy that federates MCP servers, A2A agents and REST or gRPC APIs behind one endpoint. Virtual servers expose a chosen set of tools, teams and roles scope access, and an OpenAI-compatible proxy handles LLM traffic. It has one of the widest open feature sets in this comparison, and it reached 1.0 in May 2026.

Audit trails are off by default, guardrails depend on plugins, and Code Mode is a roadmap item. The repository recorded 147 author emails in the last 12 months, the deepest bench here.

Best for: Platform teams that want federation of MCP, A2A and REST in one self-hosted project with an Apache 2.0 core repository.

3. Docker MCP Gateway

Docker MCP Gateway is the Docker CLI plugin behind the MCP Toolkit. It runs each local MCP server in an isolated container, exposes them through one gateway, and manages secrets, OAuth to upstream services, and profiles that can be shared through OCI registries.

The gateway is strongest on a developer machine. Inbound authentication is a static bearer token, and per-user policy and organization audit logs sit in Docker's paid, invite-only AI Governance plan. Dynamic tools and code-mode are experimental. Teams leaving it for production can compare Docker MCP Gateway alternatives.

Best for: Individual developers and small teams who want containerized MCP servers on their own machines.

4. Microsoft MCP Gateway

Microsoft MCP Gateway is a C# reverse proxy and control plane that deploys MCP servers on Kubernetes and routes each request to a ready instance. Entra ID handles authentication, and app roles control access to adapters and tools.

Version 1.0 requires MCP 2026-07-28 clients and adapters, with no legacy mode, so older clients need a pinned earlier release. Authentication is Entra-only, and telemetry goes to Application Insights rather than OpenTelemetry. One author made 82% of the 28 commits we counted in 12 months.

Best for: Azure teams on AKS whose clients already speak the current MCP revision.

5. Apache APISIX

Apache APISIX is a cloud-native API gateway under the Apache Software Foundation. Its current MCP path is the openapi-to-mcp plugin, added in 3.19.0, which serves one MCP tool per OpenAPI operation.

The older mcp-bridge plugin is deprecated and was removed from the master branch in October 2026. The new plugin does not proxy or aggregate MCP servers, and its docs state there is no per-tool authorization.

Best for: Existing APISIX users who want to expose REST APIs to agents.

6. Google MCP Toolbox for Databases

Google MCP Toolbox for Databases, renamed from Gen AI Toolbox, is an MCP server that exposes prebuilt and custom database tools defined in configuration. It groups tools into toolsets, validates OIDC tokens, holds database credentials centrally, and emits traces and metrics.

It is a tool server, not a gateway, and it belongs behind one. We found no open source MCP gateway from Google; its managed options are covered in our enterprise MCP gateway comparison.

Best for: Teams giving agents governed access to databases.

7. Cloudflare Agents SDK

Cloudflare Agents SDK is an MIT-licensed framework for stateful agents on Durable Objects that can act as MCP servers or clients. The companion workers-oauth-provider library adds OAuth 2.1 to remote servers.

It is not a gateway. It runs on Cloudflare Workers, tool scopes are enforced in your own handlers, and Cloudflare's gateway-style product, MCP Server Portals, is closed and hosted.

Best for: Developers publishing remote MCP servers on Cloudflare Workers.

8. Vercel mcp-handler

Vercel mcp-handler is a framework-agnostic adapter that turns one MCP server definition into a web-standard request handler for Next.js, Nuxt, SvelteKit or Hono. Version 2 serves MCP 2026-07-28 and falls back to stateless Streamable HTTP for older clients.

It serves one server and has no gateway behavior. The package declares Apache 2.0, but the repository has no LICENSE file, which legal reviewers may want to flag. We found no MCP proxying in the Vercel AI Gateway docs.

Best for: JavaScript teams adding one MCP endpoint to an existing web application.

Which Open Source MCP Projects Are Most Active?

IBM ContextForge and Google MCP Toolbox are the most consistently active, each with commits in all of the last 52 weeks. Consistency is the useful signal, because a gateway must track protocol changes such as the 2026-07-28 specification.

Figure 2: IBM ContextForge and Google MCP Toolbox ship every week. Microsoft MCP Gateway, Vercel mcp-handler and Apache APISIX commit in fewer than 20 of 52 weeks.

Two patterns stand out. MCP work in Bifrost increased through 2026, with 295 of its 474 MCP commits landing in the last 90 days, including an unusually large final week. Microsoft MCP Gateway, by contrast, recorded 28 commits in 12 months, so a team adopting it should plan around slower upstream change.

Contributor depth tells a related story. A project with many authors and no dominant one can lose a maintainer without stalling, which matters when the gateway holds your MCP authorization policy.

Figure 3: IBM ContextForge and Google MCP Toolbox have the deepest benches. Microsoft MCP Gateway has the highest top-author share at 82%, followed by Cloudflare Agents SDK at 55%.

Bifrost sits in the middle: 31 author emails committed MCP work, and the top author made 46% of those commits. Maxim AI maintains it commercially, which reduces that risk but does not remove it.

How Mature Are Open Source MCP Gateways?

Most open source MCP gateways are young. Three projects tagged 1.0 between April and October 2026, and Docker MCP Gateway and Cloudflare Agents SDK remain on 0.x tags. A 1.0 tag signals API intent, not production proof, so treat it as a starting point for your own testing.

Figure 4: Google, IBM and Microsoft all reached 1.0 within seven months of each other.

Protocol support is the second maturity check. The 2026-07-28 revision removed protocol-level sessions and the initialize handshake, so a gateway built around session affinity needs real changes. Our guide to the six jobs of an MCP gateway charts which projects have moved.

What Open Source Covers in Each MCP Gateway

Open source does not mean the whole product is free. Some projects keep everything in the open repository, some sell governance separately, and some publish only a client library for a closed service. Check this boundary before you compare features, because a capability you need may not be in the code you can run.

Two well-known projects are left out of the ranking for this reason. Kong's README mentions MCP, but the open source repository holds no MCP code; the MCP plugins need Kong Gateway 3.12 or later and an AI Gateway Enterprise license. Apache ShenYu's aggregation and per-identity features sit in an Agent Gateway plugin that had not shipped in its latest 2.7.1 release when we checked.

How to Choose an Open Source MCP Gateway

Choose by where agents run first, then by the controls your security team requires. A laptop workflow, a Kubernetes platform and an enterprise-wide control plane need different projects, and picking by GitHub stars will mislead you, as Figure 1 shows.

1. Developer machines: start with Docker MCP Gateway.
2. Azure with Entra ID: evaluate Microsoft MCP Gateway, after confirming every client supports 2026-07-28.
3. Broad federation with no paid tier: evaluate IBM ContextForge.
4. REST APIs as tools: evaluate Bifrost OpenAPI servers (beta) or Apache APISIX.
5. Publishing a single server: use Cloudflare Agents SDK or Vercel mcp-handler, then put a gateway in front of it as servers multiply.
6. One control plane for models, tools and agents: choose Bifrost as your MCP gateway.

Whatever you choose, test four things before committing: which credentials reach upstream servers, whether tool calls are logged per user, how the gateway behaves with a 2026-07-28 client, and what tool definitions cost in tokens at your real tool count. Our MCP security checklist covers the wider review, and enterprise deployment guidance covers in-VPC and air-gapped setups.

Frequently Asked Questions

What is the best open source MCP gateway?

Bifrost is our pick for enterprises that want LLM, MCP and agent traffic on one gateway, starting from an Apache 2.0 core. IBM ContextForge suits teams that want broad federation with no paid tier, and Docker MCP Gateway suits developer machines.

Is there a free open source MCP gateway?

Yes. Bifrost, IBM ContextForge, Microsoft MCP Gateway and Docker MCP Gateway are all free to self-host under Apache 2.0 or MIT licences. Your cost is infrastructure and operations. Some projects, including Bifrost and Docker, sell additional governance features separately, so compare the open edition rather than the whole product.

What is the difference between an MCP gateway and an MCP server?

An MCP server exposes tools, such as a database query or a ticket action, to an agent. An MCP gateway sits in front of many servers and applies authentication, tool filtering, rate limits and logging across them. Google MCP Toolbox is a server, while Bifrost and IBM ContextForge are gateways.

Does Kong have an open source MCP gateway?

No. Kong's open source repository contains no MCP code, and its latest open source tag is 3.9.4. The AI MCP Proxy and AI MCP OAuth2 plugins require Kong Gateway 3.12 or later with an AI Gateway Enterprise license. Teams that need open source MCP governance should look at the dedicated gateways compared in this guide.

Which MCP gateways support the 2026-07-28 specification?

Bifrost, Microsoft MCP Gateway and IBM ContextForge all declare support for the 2026-07-28 revision. Microsoft MCP Gateway requires it, so older clients need an earlier pinned release. Docker MCP Gateway's latest stated revision is 2025-11-25.

Get Started with an Open Source MCP Gateway

Bifrost gives you an open source MCP gateway that starts with one command, runs in your own infrastructure, and extends to enterprise governance when you need it. To see Bifrost on your own tool traffic, book a Bifrost demo or review the MCP Gateway page and setup docs.