MCP security: gateways compared, with a best-practice checklist
SHORT ANSWER
Editorial assessment · Desk research from public vendor material · Reviewed 2026-09-29
Ranking
| Rank | Product | Total | Best for |
|---|---|---|---|
| 1 | Docker MCP Enterprise Gateway | 8.4 / 10 | Running third-party MCP servers under central policy, including air-gapped |
| 2 | Aembit | 7.6 / 10 | Brokering credentials for agents without them ever holding one, with a free tier |
| 3 | NewCore | 7.4 / 10 | Per-call policy and human approval on MCP calls, tied to an accountable owner |
| 4 | Silverfort | 6.1 / 10 | Adding an MCP gateway to an existing Silverfort identity deployment |
| 5 | Descope | 5.6 / 10 | Teams building and publishing their own MCP servers who need OAuth handled |
How the scores are weighted
- c1 Credentials kept from the agent 25%
- c2 Policy per tool call 25%
- c3 User and agent bound together 15%
- c4 Audit trail 10%
- c5 Server isolation and approval 15%
- c6 Deployment choice and buying clarity 10%
Totals are the weighted average of the criterion scores, computed from the weights shown. Nothing is adjusted by hand.
Scorecard
| Criterion | Docker MCP Enterprise Gateway8.4 / 10 | Aembit7.6 / 10 | NewCore7.4 / 10 | Silverfort6.1 / 10 | Descope5.6 / 10 |
|---|---|---|---|---|---|
| c1Credentials kept from the agent25%The agent calls tools without ever holding the downstream credential. | 8Credentials are read from your secret store at call time and never distributed through client config files. Source: Docker MCP Enterprise Gateway | 9Highest in setAgents never hold direct credentials for MCP servers; Aembit mints and exchanges them at request time. Source: Aembit: IAM for agentic AI | 9Highest in setThe MCP gateway executes calls "with credentials the agent never sees". Source: NewCore: Agent Guardian | 5Lowest in setThe agent page does not describe how downstream credentials are handled. Source: Silverfort: AI agent security | 6Handles token management and consent for MCP servers built on it; aimed at teams publishing MCP servers rather than governing third-party ones. Source: Descope |
| c2Policy per tool call25%Allow or deny by server, tool and call before anything runs. | 9Highest in setAllow and deny rules by server, tool, transport and call, evaluated before anything runs. Source: Docker MCP Enterprise Gateway | 7A policy decision is recorded for every MCP request; tool-level rules are not detailed on the page reviewed. Source: Aembit: IAM for agentic AI | 9Highest in setEach call is checked at the operation level, with optional human approval. Source: NewCore: Agent Guardian | 8Every tool call reaches the gateway first and is approved or blocked against authorization planes and scopes. Source: Silverfort: AI agent security | 6Lowest in setScope-based access control. Source: Descope |
| c3User and agent bound together15%Each call carries both the agent and the person behind it. | 8Authenticates the user through your identity provider; each event is tied to user and agent. Source: Docker MCP Enterprise Gateway | 9Highest in setBlended Identity joins the agent's identity with the human operating it. Source: Aembit: IAM for agentic AI | 8Every action is tied to the agent, the accountable human or team, and the policy. Source: NewCore: Agent Guardian | 8SSO through your identity provider ties each agent session to a person. Source: Silverfort: AI agent security | 7Lowest in setConsent flows and Cross-App Access support. Source: Descope |
| c4Audit trail10%Structured records of each decision, ready for a SIEM. | 9Highest in setOne structured event per evaluation, streamed to your SIEM. Source: Docker MCP Enterprise Gateway | 8Logs each request with agent identity, user identity, target server and policy decision. Source: Aembit: IAM for agentic AI | 8Audit records cover agent, accountable party, policy, tool and requested action. Source: NewCore: Agent Guardian | 7Gap in public materialMaps agent actions to responsible people for audits; SIEM export is not described on the page reviewed. Source: Silverfort: AI agent security | 5Gap in public materialLowest in setAudit export is not described on the page reviewed. Source: Descope |
| c5Server isolation and approval15%Running MCP servers isolated, and approving which servers are allowed. | 9Highest in setRuns each server in its own container and lets you approve servers before agents can reach them. Source: Docker MCP Enterprise Gateway | 4Gap in public materialThe gateway runs in your environment, but isolation of MCP servers is not described. Source: Aembit: IAM for agentic AI | 3Gap in public materialLowest in setIsolation of MCP servers themselves is not described. Source: NewCore: Agent Guardian | 3Gap in public materialLowest in setIsolation of MCP servers is not described. Source: Silverfort: AI agent security | 3Lowest in setServer isolation is outside its scope. Source: Descope |
| c6Deployment choice and buying clarity10%Where it can run, and whether pricing or a free tier is published. | 7Runs in your cloud account or as an air-gapped appliance; Docker-managed cloud is listed as coming soon. Pricing through sales. Source: Docker MCP Enterprise Gateway | 8Highest in setFree-forever tier; gateway deploys as a Linux VM in your environment. Source: Aembit: IAM for agentic AI | 4Gap in public materialLowest in setDeployment model and pricing are not published. Source: NewCore home page | 5Gap in public materialPricing not published. Source: Silverfort platform | 6Gap in public materialDeveloper platform with OAuth 2.1 and Dynamic Client Registration; pricing not on the page reviewed. Source: Descope |
Docker MCP Enterprise Gateway
8.4 / 10
c1 · 25%
Credentials kept from the agent
8
Credentials are read from your secret store at call time and never distributed through client config files.
Source: Docker MCP Enterprise Gateway
c2 · 25%
Policy per tool call
9Highest in set
Allow and deny rules by server, tool, transport and call, evaluated before anything runs.
Source: Docker MCP Enterprise Gateway
c3 · 15%
User and agent bound together
8
Authenticates the user through your identity provider; each event is tied to user and agent.
Source: Docker MCP Enterprise Gateway
c4 · 10%
Audit trail
9Highest in set
One structured event per evaluation, streamed to your SIEM.
Source: Docker MCP Enterprise Gateway
c5 · 15%
Server isolation and approval
9Highest in set
Runs each server in its own container and lets you approve servers before agents can reach them.
Source: Docker MCP Enterprise Gateway
c6 · 10%
Deployment choice and buying clarity
7
Runs in your cloud account or as an air-gapped appliance; Docker-managed cloud is listed as coming soon. Pricing through sales.
Source: Docker MCP Enterprise Gateway
Aembit
7.6 / 10
c1 · 25%
Credentials kept from the agent
9Highest in set
Agents never hold direct credentials for MCP servers; Aembit mints and exchanges them at request time.
Source: Aembit: IAM for agentic AI
c2 · 25%
Policy per tool call
7
A policy decision is recorded for every MCP request; tool-level rules are not detailed on the page reviewed.
Source: Aembit: IAM for agentic AI
c3 · 15%
User and agent bound together
9Highest in set
Blended Identity joins the agent's identity with the human operating it.
Source: Aembit: IAM for agentic AI
c4 · 10%
Audit trail
8
Logs each request with agent identity, user identity, target server and policy decision.
Source: Aembit: IAM for agentic AI
c5 · 15%
Server isolation and approval
4Gap in public material
The gateway runs in your environment, but isolation of MCP servers is not described.
Source: Aembit: IAM for agentic AI
c6 · 10%
Deployment choice and buying clarity
8Highest in set
Free-forever tier; gateway deploys as a Linux VM in your environment.
Source: Aembit: IAM for agentic AI
NewCore
7.4 / 10
c1 · 25%
Credentials kept from the agent
9Highest in set
The MCP gateway executes calls "with credentials the agent never sees".
Source: NewCore: Agent Guardian
c2 · 25%
Policy per tool call
9Highest in set
Each call is checked at the operation level, with optional human approval.
Source: NewCore: Agent Guardian
c3 · 15%
User and agent bound together
8
Every action is tied to the agent, the accountable human or team, and the policy.
Source: NewCore: Agent Guardian
c4 · 10%
Audit trail
8
Audit records cover agent, accountable party, policy, tool and requested action.
Source: NewCore: Agent Guardian
c5 · 15%
Server isolation and approval
3Gap in public materialLowest in set
Isolation of MCP servers themselves is not described.
Source: NewCore: Agent Guardian
c6 · 10%
Deployment choice and buying clarity
4Gap in public materialLowest in set
Deployment model and pricing are not published.
Source: NewCore home page
Silverfort
6.1 / 10
c1 · 25%
Credentials kept from the agent
5Lowest in set
The agent page does not describe how downstream credentials are handled.
Source: Silverfort: AI agent security
c2 · 25%
Policy per tool call
8
Every tool call reaches the gateway first and is approved or blocked against authorization planes and scopes.
Source: Silverfort: AI agent security
c3 · 15%
User and agent bound together
8
SSO through your identity provider ties each agent session to a person.
Source: Silverfort: AI agent security
c4 · 10%
Audit trail
7Gap in public material
Maps agent actions to responsible people for audits; SIEM export is not described on the page reviewed.
Source: Silverfort: AI agent security
c5 · 15%
Server isolation and approval
3Gap in public materialLowest in set
Isolation of MCP servers is not described.
Source: Silverfort: AI agent security
c6 · 10%
Deployment choice and buying clarity
5Gap in public material
Pricing not published.
Source: Silverfort platform
Descope
5.6 / 10
c1 · 25%
Credentials kept from the agent
6
Handles token management and consent for MCP servers built on it; aimed at teams publishing MCP servers rather than governing third-party ones.
Source: Descope
c3 · 15%
User and agent bound together
7Lowest in set
Consent flows and Cross-App Access support.
Source: Descope
c4 · 10%
Audit trail
5Gap in public materialLowest in set
Audit export is not described on the page reviewed.
Source: Descope
c5 · 15%
Server isolation and approval
3Lowest in set
Server isolation is outside its scope.
Source: Descope
c6 · 10%
Deployment choice and buying clarity
6Gap in public material
Developer platform with OAuth 2.1 and Dynamic Client Registration; pricing not on the page reviewed.
Source: Descope
What is MCP security?
The Model Context Protocol (MCP) is the protocol many AI agents use to call tools: an agent acts as an MCP client and each tool is exposed by an MCP server. MCP security covers who may call which server, with which credentials, and what happens to the tokens along the way.
Authorization is optional in the specification. Implementations that use HTTP should follow its authorization rules; implementations that run over local STDIO should instead take credentials from the environment. That makes the choice of gateway, and its defaults, more important than in protocols where security is mandatory.
What does the MCP specification require for authorization?
The 2025-06-18 version of the authorization specification, on which this page is based, sets out the core rules. A later version, dated 2025-11-25, is also published.
- MCP servers act as OAuth 2.1 resource servers and must publish Protected Resource Metadata (RFC 9728) so clients can find the authorization server.
- Clients must send a resource parameter (RFC 8707) naming the MCP server a token is for.
- Servers must check that each token was issued for them, and must not accept or pass through tokens issued for anything else.
- Clients must use PKCE, and authorization servers should issue short-lived access tokens.
- Every HTTP request must carry the token in the Authorization header; tokens must never go in the query string.
MCP security best practices: a checklist from the specification
The specification's Security Best Practices page describes the attacks it expects and what to do about each. In short:
- Confused deputy: an MCP proxy that uses one static client ID with a third-party API must ask each user for consent per client, before sending them to the third party.
- Token passthrough: never forward a token the server received to another API. Get a separate token for the upstream call.
- Server-side request forgery: during OAuth discovery, require HTTPS and block private and link-local addresses, including cloud metadata endpoints.
- Session hijacking: do not use sessions for authentication. Use random session IDs and bind them to the user.
- Local MCP server compromise: before a client runs a local server, show the exact command and ask for approval; run servers sandboxed with minimal privileges.
- Malicious authorization URLs: accept only http and https schemes, and never open URLs through a shell.
- Scope minimization: start with minimal scopes and ask for more only when a privileged operation is attempted; avoid wildcard scopes.
A gateway can enforce several of these for every server behind it, which is the main argument for using one.
What is an MCP gateway?
An MCP gateway sits between agents and MCP servers. Every call passes through it, so it can authenticate the user and the agent, apply policy to the specific tool and operation, supply the credential for the downstream system, and record what happened. MCP gateway security is the question of how well it does each of those, which is what the scorecard measures.
What is an MCP identity gateway?
Aembit uses the name MCP Identity Gateway for its product, and the phrase describes a gateway whose main job is identity: working out who the agent is, who it acts for, and exchanging that for a credential the agent never sees. NewCore's MCP gateway and Silverfort's work on the same principle. Docker's gateway adds a second job, running and isolating the MCP servers themselves.
The five gateways, one by one
Docker MCP Enterprise Gateway
Governed gateway for MCP servers
Best for: Running third-party MCP servers under central policy, including air-gapped
LEADS ON
c2 Policy per tool call 9
Allow and deny rules by server, tool, transport and call, evaluated before anything runs.
Source: Docker MCP Enterprise Gateway
c5 Server isolation and approval 9
Runs each server in its own container and lets you approve servers before agents can reach them.
Source: Docker MCP Enterprise Gateway
TRAILS ON
c6 Deployment choice and buying clarity 7
Runs in your cloud account or as an air-gapped appliance; Docker-managed cloud is listed as coming soon. Pricing through sales.
Source: Docker MCP Enterprise Gateway
c1 Credentials kept from the agent 8
Credentials are read from your secret store at call time and never distributed through client config files.
Source: Docker MCP Enterprise Gateway
Visit Docker MCP Enterprise Gateway
Docker MCP Enterprise Gateway alternatives · Compare Docker MCP Enterprise Gateway head to head
Aembit
Access management for workloads and AI agents
Best for: Brokering credentials for agents without them ever holding one, with a free tier
LEADS ON
c1 Credentials kept from the agent 9
Agents never hold direct credentials for MCP servers; Aembit mints and exchanges them at request time.
Source: Aembit: IAM for agentic AI
c3 User and agent bound together 9
Blended Identity joins the agent's identity with the human operating it.
Source: Aembit: IAM for agentic AI
TRAILS ON
c5 Server isolation and approval 4
The gateway runs in your environment, but isolation of MCP servers is not described.
Source: Aembit: IAM for agentic AI
c2 Policy per tool call 7
A policy decision is recorded for every MCP request; tool-level rules are not detailed on the page reviewed.
Source: Aembit: IAM for agentic AI
NewCore
Identity provider for people and AI agents, launched June 2026
Best for: Per-call policy and human approval on MCP calls, tied to an accountable owner
LEADS ON
c1 Credentials kept from the agent 9
The MCP gateway executes calls "with credentials the agent never sees".
Source: NewCore: Agent Guardian
c2 Policy per tool call 9
Each call is checked at the operation level, with optional human approval.
Source: NewCore: Agent Guardian
TRAILS ON
c5 Server isolation and approval 3
Isolation of MCP servers themselves is not described.
Source: NewCore: Agent Guardian
c6 Deployment choice and buying clarity 4
Deployment model and pricing are not published.
Source: NewCore home page
Silverfort
Inline identity protection across on-prem, cloud and agents
Best for: Adding an MCP gateway to an existing Silverfort identity deployment
LEADS ON
c2 Policy per tool call 8
Every tool call reaches the gateway first and is approved or blocked against authorization planes and scopes.
Source: Silverfort: AI agent security
c3 User and agent bound together 8
SSO through your identity provider ties each agent session to a person.
Source: Silverfort: AI agent security
TRAILS ON
c5 Server isolation and approval 3
Isolation of MCP servers is not described.
Source: Silverfort: AI agent security
c1 Credentials kept from the agent 5
The agent page does not describe how downstream credentials are handled.
Source: Silverfort: AI agent security
Descope
Customer and agentic identity platform for developers
Best for: Teams building and publishing their own MCP servers who need OAuth handled
LEADS ON
Questions
Is authorization required in MCP?
No. The specification makes authorization optional. When it is used over HTTP, implementations should follow the specification's OAuth-based rules.
What is token passthrough and why is it forbidden?
It is when an MCP server forwards a token it received from a client to another API. The specification forbids it because it bypasses the downstream system's controls and breaks the audit trail.
Which MCP gateway scores highest?
Docker MCP Enterprise Gateway on the weights used here, mainly because it isolates and approves MCP servers. NewCore and Aembit score highest on keeping credentials from the agent.
Do I need a gateway if my MCP servers already use OAuth?
Not necessarily, but a gateway gives one place to apply policy, approve servers and collect audit records across all of them, instead of relying on each server to get it right.
Related topics
From the blog: How to run a proof of concept for an MCP gateway · Reading the 2025-11-25 MCP authorization specification: what buyers should check
Sources
- Docker MCP Enterprise Gateway: https://www.docker.com/products/mcp-enterprise-gateway/
- NewCore: Agent Guardian: https://newcore.com/platform/agent-guardian
- NewCore home page: https://newcore.com/
- Aembit: IAM for agentic AI: https://aembit.io/iam-for-agentic-ai/
- Silverfort: AI agent security: https://www.silverfort.com/platform/ai-agent-security
- Silverfort platform: https://www.silverfort.com/
- Descope: https://www.descope.com/
- MCP specification: Authorization (2025-06-18): https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization
- MCP specification: Security Best Practices: https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices