AI Defense Stack

Agent & MCP security

Google Cloud Agent Gateway: managed agent traffic gateway on Google Cloud

Agent Gateway is a managed agent traffic gateway on Google Cloud from Google Cloud. It is a commercial product offered as: Cloud-native, Managed service. Pricing model: not published.

  • Last reviewed
Visit Agent Gateway (opens in a new tab) Documentation (opens in a new tab)
Commercial Layer 7: Agent and tool access

Best for

Teams that run agents on Google Cloud's Agent Platform and want one place to enforce agent identity, access policy and content screening on agent traffic

Consider instead if

  • You want an open-source gateway you can run outside Google Cloud. See agentgateway.
  • You only need the content screening part, as a standalone API. See Model Armor.

What Agent Gateway does

Google Cloud Agent Gateway is a managed gateway in the Gemini Enterprise Agent Platform that Google's docs call a key enforcement component for agent traffic. It sits on the path between clients and agents (ingress) and between agents and anything outside (egress), and passes all HTTP traffic including MCP and A2A. Policies come from Agent Identity, IAM access policies that block every connection by default, an Agent Registry of approved destinations, plain-language Semantic Governance rules, custom authorization engines and optional Model Armor screening. The overview says it is currently available for agents on Gemini Enterprise Agent Platform, with GKE, Cloud Run and cross-cloud support coming soon. The docs state no price and carry no preview or GA label. It is a Google Cloud service, not open source.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Google Cloud Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Status
Active Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Open source
No: closed source (proprietary) Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Latest release
Not documented in the sources we checked
Deployment
Cloud-native, Managed service Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Pricing model
Not published in the sources we checked Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Website
docs.cloud.google.com Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Documentation
docs.cloud.google.com Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
docs.cloud.google.com Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where Agent Gateway fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Agent Gateway covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L7 Agent access Agent and tool access Primary Limit which tools, MCP servers, data and credentials an agent can use, and require approval for risky actions. Follows its category, Agent & MCP security
L6 Runtime Runtime guardrails Also covers Optional Model Armor screening checks prompts and tool responses for prompt injection and data leakage. Optional Model Armor scans prompts and tool responses for prompt injection, data leakage and harmful content on ingress and egress
L8 Monitoring Monitoring and response Also covers Documents Cloud Logging of gateway access logs, security audit logs and dry-run policy evaluation events. Exports network-layer telemetry to Agent Observability; Cloud Logging captures gateway access logs, security audit logs and dry-run policy evaluation events

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Agent Gateway, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection Optional Model Armor screening checks prompts and tool responses for prompt injection. Optional Model Armor scans prompts and tool responses for prompt injection, data leakage and harmful content on ingress and egress
LLM02 Sensitive Information Disclosure The same optional screening looks for data leakage in prompts and tool responses. Optional Model Armor scans prompts and tool responses for prompt injection, data leakage and harmful content on ingress and egress
LLM06 Excessive Agency Default-deny access policies tied to agent identity and plain-language rules limit what tools agents can reach and use. Uses Agent Identity, which gives each agent a SPIFFE ID for authentication, access control and auditing, with mTLS and DPoP enforced by Context-Aware Access; IAM access policies block all connections unless one grants access; egress destinations are also checked against an Agent Registry of approved endpoints; Semantic Governance policies in plain language constrain how agents use tools; custom authorization engines can decide through Service Extensions

Not mapped in our analysis: LLM05, LLM07. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in Agent & MCP security, ranked within the category by Coverage Score.

Cisco DefenseClaw

Cisco

Open sourceApache-2.0
  • CLI
  • Self-hosted

Scans skills and MCP servers, inspects agent tool calls and keeps an audit trail around AI coding agents.

Best for: Security teams that want scanning, guardrails and an audit trail around the coding agents developers already run, starting in observe mode before anything is blocked

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Docker MCP Gateway

Docker

Open sourceMIT
  • CLI
  • Self-hosted

Proxies AI clients to MCP servers it runs as isolated Docker containers, with tool filters and call logs.

Best for: Developers and platform teams that already use Docker and want MCP servers to run in containers behind one gateway with per-server tool selection

Coverage Score 72 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

agentgateway

agentgateway (a Series of LF Projects, LLC)

Open sourceApache-2.0
  • CLI
  • Self-hosted
  • Cloud-native

Open-source proxy that applies auth, CEL policy and guardrails to LLM, MCP and agent-to-agent traffic.

Best for: Platform teams that want one open-source gateway in front of MCP servers and LLM providers, with token validation, CEL rules per MCP method and pluggable guardrails

Coverage Score 69 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Agent Gateway FAQ

Which traffic does Agent Gateway cover?

The overview describes two paths: client-to-agent (ingress) for clients such as web applications, developer CLIs or external systems reaching hosted agents or MCP tools, and agent-to-anywhere (egress) for agents reaching outside servers, tools and APIs.

What happens to traffic with no policy?

The docs say all connections are blocked by default unless an explicit IAM policy grants access. Egress to a destination that is not registered needs an explicit IAM policy on that URL, or the request is denied.

Is Model Armor required?

No. The overview calls Model Armor optional. It also says Agent Gateway is currently available for agents running on Gemini Enterprise Agent Platform, with GKE, Cloud Run and cross-cloud support coming soon.

Key facts you can cite

We have no commercial relationship with Google Cloud.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.