Best MCP Gateway for Enterprise Agents: How to Choose and Test One

Reviewed 17 August 2026 · 18 minute read

There is no best MCP gateway for every enterprise. Kong is a strong fit when MCP must reuse a mature API gateway estate. Portkey is a strong fit for teams combining model and MCP traffic with managed credential isolation. Cloudflare fits globally distributed remote MCP services and Zero Trust access. MuleSoft fits organizations exposing existing integration flows and legacy systems as agent tools. Test all four against the same failure cases before choosing.

This guide is for platform and security teams selecting a production boundary for remote MCP servers. It compares documented capabilities, separates gateway controls from transaction authorization and provides an evaluation fixture that can be run without trusting a product checklist.

What does an MCP gateway do?

An MCP gateway sits between MCP clients and one or more MCP servers. Depending on the product, it can authenticate callers, validate OAuth tokens, register servers, restrict server or tool access, inject upstream credentials, aggregate tools, translate APIs into tools, apply traffic policies and record protocol-aware telemetry.

That list contains several different jobs:

Swipe horizontally to inspect the full diagram.

Most MCP gateways focus on the first six. Some add approval or policy hooks. Consequential actions still need a reliable business-authorization object if the decision depends on amount, supplier, purpose, destination, prior approval, mandate usage or current budget.

Kong vs Portkey vs Cloudflare vs MuleSoft

The matrix below compares documented product scope reviewed on 17 August 2026. It is not a benchmark result and does not claim feature parity where documentation uses similar labels.

When Kong is the better fit

Choose Kong when the organization already operates Kong for APIs and wants MCP as another governed protocol on the same data plane. Current Kong documentation describes proxying MCP traffic, converting REST APIs into MCP tools, OAuth, ACLs, rate controls, audit logs and metrics. The secure internal gateway recipe requires Kong Gateway 3.14 and demonstrates OAuth plus per-tool access for aggregated internal services. Kong's MCP overview and secure internal MCP gateway recipe support this profile.

Kong is less compelling if the buyer does not want to introduce a general gateway platform or needs a turnkey service centered on model-provider routing rather than API operations.

When Portkey is the better fit

Choose Portkey when the team wants one operational surface for LLM and MCP traffic, managed server registration and upstream credential isolation. Portkey documents separate agent-to-gateway and gateway-to-server authentication layers. It can authenticate with API keys, OAuth or an external IdP, then inject user or shared upstream credentials without giving them to the agent. Portkey's MCP authentication guide describes the two-layer model.

Read status labels carefully. Portkey's authorization documentation currently lists workspace and server-level controls as available and tool-level authorization as coming soon. Portkey's MCP authorization documentation should be checked again during procurement because this boundary can change.

When Cloudflare is the better fit

Choose Cloudflare when the product is already built on Workers or when globally distributed remote MCP services, Zero Trust access and edge controls matter. Cloudflare provides an OAuth Provider Library for remote MCP servers and documents integrations with Access, third-party OAuth providers and custom authorization handlers. Cloudflare's MCP authorization guide includes runnable patterns.

Cloudflare also describes an MCP server portal for controlling which users may access vetted MCP servers and under which device or location conditions. Cloudflare's MCP governance documentation is a good fit for controlling shadow MCP and distributed access. It is not, by itself, a transaction mandate or business reconciliation service.

When MuleSoft is the better fit

Choose MuleSoft when the hard problem is exposing existing enterprise applications, legacy systems and integration flows as agent-ready capabilities. The MCP Connector can run Mule as an MCP server or client, expose existing APIs as focused tools and support Streamable HTTP plus distributed tracing. MuleSoft MCP Connector documentation describes version 1.6 and its runtime requirements.

MuleSoft is broader integration infrastructure. A buyer should decide whether that breadth is an advantage or unnecessary weight for a smaller MCP deployment.

Where the products sit in the wider control stack

Enterprise agent market positioning

Product-scope analysis, not market share, quality or maturity

Text summary of highlighted companies

Company or protocol	Primary scope represented on the map
Intelliger	Transaction-specific authority, deterministic enforcement, reconciliation and portable evidence.
Kong	LLM, MCP and A2A traffic gateway, authentication and observability.
Portkey	AI and MCP gateway, credential isolation, observability and guardrails.
Cloudflare	Distributed traffic, security, remote MCP and AI gateway infrastructure.
MuleSoft	Enterprise API integration, orchestration and agent-facing connectivity.

The chart does not rank gateway quality. It shows why an enterprise may need both a gateway and a transaction-control layer. The gateway should remain responsible for transport, routing, token checks, limits, credential isolation and upstream enforcement. Transaction control should supply the exact action, business authority, current policy result, approval binding, idempotency state and evidence obligations.

For a deeper distinction between existing API infrastructure and MCP-aware controls, read MCP gateway versus API gateway. For broad policy design, use the AI agent authorization guide.

A reproducible MCP gateway evaluation

Do not start with a production integration. Create one disposable MCP server with two tools:

{
  "tools": [
    {
      "name": "catalog_lookup",
      "risk": "read",
      "inputSchema": {
        "type": "object",
        "properties": { "sku": { "type": "string" } },
        "required": ["sku"],
        "additionalProperties": false
      }
    },
    {
      "name": "issue_refund",
      "risk": "material_action",
      "inputSchema": {
        "type": "object",
        "properties": {
          "order_id": { "type": "string" },
          "amount_minor": { "type": "string", "pattern": "^[0-9]+$" },
          "currency": { "type": "string", "enum": ["EUR"] },
          "destination": { "const": "original_payment_method" }
        },
        "required": ["order_id", "amount_minor", "currency", "destination"],
        "additionalProperties": false
      }
    }
  ]
}

The read tool tests basic routing. The refund tool tests whether the gateway can preserve meaning through authentication, authorization and execution.

Run this minimum suite:

Record the gateway version, deployment mode, configuration, latency distribution and raw results. A product comparison without a reproducible configuration is marketing analysis, not an engineering result.

Verify OAuth resource binding

MCP authorization follows OAuth conventions, but production safety depends on the resource boundary being enforced correctly. Test that a token issued for one MCP server is rejected by another, redirect URIs are validated, PKCE is required where applicable and the upstream receives only the intended identity context.

Do not forward caller-selected identity headers unless the gateway removes and regenerates them after authentication. Otherwise an agent can supply x-tenant-id or x-user-id values that look like trusted gateway context.

The protected server must still validate its authorization context. A gateway can be bypassed through a forgotten direct route, internal load balancer or standing credential. Network policy and service authentication should make the gateway the enforced path for material tools.

Separate credential replay from business retries

These controls solve different problems:

const proofKey = `${verificationMethod}\0${audience}\0${nonce}`;
await replayStore.claimOnce(proofKey, proofExpiresAt);

const operation = await idempotencyStore.reserve({
  tenantId,
  idempotencyKey,
  requestDigest,
});

The replay store rejects a repeated credential proof. The idempotency store recognizes an intentional retry of the same business operation. If the same key arrives with a different digest, return a conflict. If execution timed out after submission, query the provider by the stable key before sending again.

Ask each vendor where these states live, whether they work across replicas and what happens when the store is unavailable. Rate limiting is not a substitute for either control.

Add transaction authorization without replacing the gateway

The integration contract can remain narrow:

MCP request
  -> gateway authentication and schema validation
  -> normalize tool into action, resource and protected arguments
  -> external deterministic authorization decision
  -> gateway enforces allow, deny or approval obligation
  -> inject short-lived upstream credential
  -> execute and capture stable provider reference
  -> reconcile outcome and emit bounded evidence

An authorization request should carry verified identity and the canonical transaction fields. An allow response should be bound to the request digest and expire quickly. If the external decision is unavailable, the gateway needs an action-specific failure rule. A global failure_mode_allow is inappropriate for irreversible tools.

Intelliger is complementary here. It is not a general MCP traffic gateway. OATI can provide the mandate, transaction envelope, deterministic evaluation and receipt objects that a Kong, Portkey, Cloudflare or MuleSoft enforcement point consumes.

Questions to answer before selecting an MCP gateway

Does every enterprise MCP deployment need a gateway?

Not every local experiment does. A gateway becomes useful when several clients or servers need shared authentication, routing, policy enforcement, credential isolation, observability or lifecycle management. Consequential tools also need a controlled path that is difficult for the agent to bypass.

Which MCP gateway is best?

There is no universal winner. Kong is a natural candidate for teams extending an existing API-gateway estate. Portkey is oriented toward AI gateway operations and managed MCP controls. Cloudflare fits edge-native deployments built on Workers and Access. MuleSoft fits enterprises exposing governed integration assets. Test the required product edition and current feature status against the fixture in this guide.

Can an MCP gateway replace a transaction policy engine?

Only if it can evaluate the full business transaction, not merely identity, server and tool. For payments, refunds, procurement or production changes, the decision may require mandates, cumulative limits, exact-argument binding, approval state and atomic reservations. A gateway can enforce that external decision without owning all of its semantics.

Can an API gateway proxy MCP traffic?

Often yes, but protocol-aware behavior still matters. Verify transport handling, session behavior, tool discovery, message limits, upstream credential isolation and MCP-specific authorization metadata. A generic pass-through proxy should not be assumed to provide these controls.

Current Intelliger and OATI boundary

The public OATI developer preview implements schemas, canonical signing, trust resolution, deterministic mandate evaluation, replay checks, receipts, SDKs and a reference Envoy authorization path. A trust and lookup vertical slice built from the public and private repositories is deployed.

This is not a managed, production-ready MCP gateway fleet. Customer gateway operations, the complete policy compiler, durable evidence and dispute workflows, independent protocol review and two-enterprise production acceptance remain incomplete. The integration pattern is usable for evaluation, while a commercial deployment still requires those release gates.

MCP gateway buying checklist

• Confirm the exact MCP protocol versions and transports supported.
• Distinguish proxying an existing server from generating tools from APIs.
• Test external IdP integration and protected-resource audience handling.
• Verify server-level and tool-level authorization status separately.
• Inspect how upstream credentials are stored, rotated and isolated.
• Test whether identity headers are stripped and regenerated.
• Confirm multi-replica replay and session behavior.
• Test request and response size limits plus schema rejection.
• Measure whether sensitive parameters and responses are logged by default.
• Verify fail-closed behavior for material actions.
• Separate proof replay, business idempotency and provider reconciliation.
• Export the configuration and results so another team can reproduce them.

Expert review required before publication: an MCP gateway and identity specialist should rerun the product-status check and validate the OAuth, replay, bypass and failure-mode guidance.

For a narrower product decision, compare Kong Agent Gateway with Portkey Agent Gateway. To apply the test fixture to a consequential tool, open the OATI developer path and map its deterministic authorization response into your selected gateway.