AI Defense Stack

Agent & MCP security

agentgateway: open-source proxy for agent, MCP and LLM traffic

agentgateway is an open-source proxy for agent, MCP and LLM traffic from agentgateway (a Series of LF Projects, LLC). It is released under the Apache-2.0 license and is offered as: CLI, Self-hosted, Cloud-native.

  • Last reviewed
Visit agentgateway (opens in a new tab) Documentation (opens in a new tab) Source code (opens in a new tab)
Open sourceApache-2.0 Layer 7: Agent and tool access

Best for

Platform teams that want one open-source gateway in front of MCP servers and LLM providers, with token validation, CEL rules per MCP method and pluggable guardrails

Ownership

The README states that agentgateway is a Linux Foundation project. Source, checked October 21, 2026: github.com (opens in a new tab)

Consider instead if

  • You want an MCP gateway with built-in server scanning and reputation checks. See Lasso MCP Gateway.
  • You want a gateway delivered as a Docker feature with container-based MCP servers. See Docker MCP Gateway.

What agentgateway does

agentgateway is an open-source (Apache-2.0) proxy for AI agent traffic and a Linux Foundation project. One data plane carries LLM requests, MCP tool calls and agent-to-agent (A2A) traffic. For security, it validates JWTs and OAuth 2.0 tokens, applies CEL rules to HTTP requests and to MCP methods so a client reaches only permitted tools, and can send MCP tool calls and results to an external guardrail server that passes, changes or denies them. LLM prompt guards use regex, moderation services or webhooks to mask or reject content. It runs as a standalone binary or on Kubernetes. The pages we read state no price.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
agentgateway (a Series of LF Projects, LLC) Source, checked October 21, 2026: agentgateway.dev (opens in a new tab)
Status
Active Source, checked October 21, 2026: api.github.com (opens in a new tab)
Ownership
The README states that agentgateway is a Linux Foundation project. Source, checked October 21, 2026: github.com (opens in a new tab)
Open source
Yes: Apache-2.0 Source, checked October 21, 2026: github.com (opens in a new tab)
Repository
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
GitHub stars
5,472 as of October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest push
October 22, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release
October 2, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Deployment
CLI, Self-hosted, Cloud-native Source, checked October 21, 2026: agentgateway.dev (opens in a new tab)
Pricing model
Free Source, checked October 21, 2026: github.com (opens in a new tab)
Website
agentgateway.dev Source, checked October 21, 2026: agentgateway.dev (opens in a new tab)
Documentation
agentgateway.dev Source, checked October 21, 2026: agentgateway.dev (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
agentgateway.dev Source, checked October 21, 2026: agentgateway.dev (opens in a new tab)
Security page
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
Attestations or disclosure
Vulnerabilities are reported through a private GitHub security advisory report Source, checked October 21, 2026: github.com (opens in a new tab)

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where agentgateway fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that agentgateway covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L7 Agent access Agent and tool access Primary Limit which tools, MCP servers, data and credentials an agent can use, and require approval for risky actions. Follows its category, Agent & MCP security
L8 Monitoring Monitoring and response Also covers Documents logging of tool calls and their arguments, with OpenTelemetry traces and access logs. MCP observability logs tool calls and their arguments after a request completes, alongside OpenTelemetry traces and access logs

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to agentgateway, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM02 Sensitive Information Disclosure Regex prompt guards can mask patterns such as credit card numbers and emails in LLM requests and responses. HTTP and network authorization with CEL rules, plus external authorization that can delegate decisions to services such as OPA; MCP guardrails send tool calls and tool results to an external ExtMCP server that can pass, change or deny each message; the default failure mode denies; LLM prompt guards check requests and responses with regex, external moderation services or webhooks, and can mask, reject or only log content
LLM06 Excessive Agency CEL rules limit which MCP tools a client can use, and guardrails can deny tool calls before they reach the backend. MCP authorization applies CEL rules to MCP method invocations to limit which tools, prompts and resources a client can reach; HTTP and network authorization with CEL rules, plus external authorization that can delegate decisions to services such as OPA; MCP guardrails send tool calls and tool results to an external ExtMCP server that can pass, change or deny each message; the default failure mode denies; LLM prompt guards check requests and responses with regex, external moderation services or webhooks, and can mask, reject or only log content

Not mapped in our analysis: LLM01, LLM05, LLM07. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in Agent & MCP security, ranked within the category by Coverage Score.

Cisco DefenseClaw

Cisco

Open sourceApache-2.0
  • CLI
  • Self-hosted

Scans skills and MCP servers, inspects agent tool calls and keeps an audit trail around AI coding agents.

Best for: Security teams that want scanning, guardrails and an audit trail around the coding agents developers already run, starting in observe mode before anything is blocked

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Docker MCP Gateway

Docker

Open sourceMIT
  • CLI
  • Self-hosted

Proxies AI clients to MCP servers it runs as isolated Docker containers, with tool filters and call logs.

Best for: Developers and platform teams that already use Docker and want MCP servers to run in containers behind one gateway with per-server tool selection

Coverage Score 72 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

NeuralTrust

NeuralTrust

Open sourceApache-2.0 Freemium
  • SaaS
  • Self-hosted
  • On-prem

Routes agent traffic through a gateway with per-agent tool access, prompt inspection and audit trails.

Best for: Teams that want a gateway in front of agents, models and MCP tools with per-tool access and audit, and that can start on a free plan or self-host the gateway

Coverage Score 68 out of 100
  • LLM01 Prompt Injection
  • LLM06 Excessive Agency

Reviewed

agentgateway FAQ

Who owns agentgateway?

The README says it is a Linux Foundation project and the site footer reads a Series of LF Projects, LLC. The home page banner says it has joined the Agentic AI Foundation, and Solo.io is listed among contributing companies.

Can it limit which MCP tools an agent calls?

Yes. The docs describe MCP authorization with CEL rules run against MCP method invocations, which limit the tools, prompts and resources a client can reach. Rules can match claims in a validated JWT.

How can it be deployed?

As a standalone binary (also in Docker) driven by a YAML file, or on Kubernetes with its controller and Gateway API support, according to the home page and README.

Key facts you can cite

We have no commercial relationship with agentgateway (a Series of LF Projects, LLC).

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.