AI Defense Stack

Agent & MCP security

IBM ContextForge: open-source MCP and A2A gateway and registry

ContextForge is an open-source MCP and A2A gateway and registry from IBM. It is released under the Apache-2.0 license and is offered as: Self-hosted.

  • Last reviewed
Visit ContextForge (opens in a new tab) Documentation (opens in a new tab) Source code (opens in a new tab)
Open sourceApache-2.0 Layer 7: Agent and tool access

Best for

Platform teams that want to self-host one gateway and registry in front of many MCP servers, A2A agents and REST APIs

Consider instead if

  • You want a lighter MCP-only gateway with swappable security plugins. See Lasso MCP Gateway.

What ContextForge does

ContextForge is an open-source (Apache-2.0) gateway, registry and proxy from IBM. It sits in front of MCP servers, A2A agents and REST or gRPC APIs and exposes them through one endpoint. The docs describe federation of services, registries for tools, prompts and resources, authentication with JWT, OAuth and SSO, role-based access control, rate limits, and OpenTelemetry tracing with Prometheus metrics. A plugin framework adds hooks before and after tool, prompt, resource, HTTP and agent calls, and the plugin docs name a PII filter plugin. You run it yourself from PyPI, Docker, Docker Compose or a Helm chart on Kubernetes. It is a gateway you operate, the docs state no price, and SECURITY.md says it is provided as-is with no official support from IBM.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
IBM Source, checked October 21, 2026: github.com (opens in a new tab)
Status
Active Source, checked October 21, 2026: api.github.com (opens in a new tab)
Open source
Yes: Apache-2.0 Source, checked October 21, 2026: github.com (opens in a new tab)
Repository
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
GitHub stars
4,676 as of October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest push
October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release
October 20, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Deployment
Self-hosted Source, checked October 21, 2026: ibm.github.io (opens in a new tab)
Pricing model
Free Source, checked October 21, 2026: github.com (opens in a new tab)
Website
ibm.github.io Source, checked October 21, 2026: ibm.github.io (opens in a new tab)
Documentation
ibm.github.io Source, checked October 21, 2026: ibm.github.io (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
Not documented in the sources we checked
Security page
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
Attestations or disclosure
Vulnerabilities are reported to IBM PSIRT through HackerOne Source, checked October 21, 2026: github.com (opens in a new tab)

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where ContextForge fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that ContextForge covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L7 Agent access Agent and tool access Primary Limit which tools, MCP servers, data and credentials an agent can use, and require approval for risky actions. Follows its category, Agent & MCP security
L8 Monitoring Monitoring and response Also covers Documents audit logging of plugin executions and policy violations at the gateway. Documents audit logging of plugin executions and violations, with an example audit logger plugin

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to ContextForge, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM02 Sensitive Information Disclosure The plugin docs name a PII filter plugin that detects and masks personal data in gateway traffic. Plugin framework with hooks before and after tool, prompt, resource, HTTP and agent calls, including a PII filter plugin
LLM06 Excessive Agency Role-based access control and tool authorization on virtual servers limit which tools a client can reach. Documents role-based access control and authorizing tools in virtual servers, with JWT, OAuth and SSO sign-in

Not mapped in our analysis: LLM01, LLM05, LLM07. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in Agent & MCP security, ranked within the category by Coverage Score.

Cisco DefenseClaw

Cisco

Open sourceApache-2.0
  • CLI
  • Self-hosted

Scans skills and MCP servers, inspects agent tool calls and keeps an audit trail around AI coding agents.

Best for: Security teams that want scanning, guardrails and an audit trail around the coding agents developers already run, starting in observe mode before anything is blocked

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Docker MCP Gateway

Docker

Open sourceMIT
  • CLI
  • Self-hosted

Proxies AI clients to MCP servers it runs as isolated Docker containers, with tool filters and call logs.

Best for: Developers and platform teams that already use Docker and want MCP servers to run in containers behind one gateway with per-server tool selection

Coverage Score 72 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

agentgateway

agentgateway (a Series of LF Projects, LLC)

Open sourceApache-2.0
  • CLI
  • Self-hosted
  • Cloud-native

Open-source proxy that applies auth, CEL policy and guardrails to LLM, MCP and agent-to-agent traffic.

Best for: Platform teams that want one open-source gateway in front of MCP servers and LLM providers, with token validation, CEL rules per MCP method and pluggable guardrails

Coverage Score 69 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

ContextForge FAQ

Is ContextForge open source?

Yes. It is released under the Apache License 2.0, and the code is on GitHub at IBM/mcp-context-forge.

What does ContextForge put in front of?

The docs describe one endpoint in front of MCP servers, A2A agents and REST or gRPC APIs, with registries for tools, prompts and resources.

How do you run it?

The docs list a PyPI package, Docker and Podman images, Docker Compose, and Helm charts for Kubernetes and OpenShift. You operate it yourself.

Does IBM support ContextForge?

No. SECURITY.md says the project is provided as-is with no official support from IBM or its affiliates, is maintained by the community, and has no commercial support options. Security reports still go to IBM PSIRT.

Key facts you can cite

We have no commercial relationship with IBM.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.