Category 5 of 12 · Controls: The tool-call chokepoint

MCP and AI gateways

Gateways and proxies that sit between agents and the tools they call, enforcing authentication, allow lists, and inspection on Model Context Protocol and model traffic.

Mitigates: ASI02 Tool Misuse and Exploitation, ASI04 Agentic Supply Chain Vulnerabilities, ASI07 Insecure Inter-Agent Communication, LLM06 Excessive Agency · MITRE ATLAS AML.T0053

Vendors, by signal score

• #1
  Runlayer

  MCP gateway and agent platform: gives each agent its own account, issues on-behalf-of tokens that carry both the user and the agent, enforces per-tool policy, and exports every tool call to a SIEM.

  50
• #2
  Operant AI

  Runtime defense for AI applications and agents, including an MCP Gateway that catalogs MCP servers and tools, enforces trust zones and least-privilege tool permissions, and blocks untrusted servers and data flows inline.

  37
• #3
  PortkeyAcquired by Palo Alto Networks

  AI gateway with an MCP gateway for centralized authentication, per-server access control, credential brokering, and request logging. Acquired by Palo Alto Networks in 2026; its gateway now ships in Prisma AIRS.

  34

Ranked within this category only. How the score works.

Also covers this category

• AcuvityAcquired by Proofpoint

  AI security and governance across endpoints, browsers, MCP servers, and local AI tools: discovers AI usage, inspects interactions at runtime, and enforces policy at the MCP boundary. Acquired by Proofpoint in 2026.

  10
• Aembit

  Workload and agent IAM: verifies an agent's identity, binds it to the user it acts for, and issues just-in-time, short-lived credentials under access policy, including through an MCP Identity Gateway.

  50
• Arcade.dev

  Actions runtime for AI agents: handles OAuth and holds user tokens and secrets so agents can call tools on a user's behalf, with per-action authorization hooks and a catalog of MCP tools.

  54
• Aurascape

  AI usage control and agent governance: discovers public, embedded, and shadow AI apps and agents, protects sensitive data in prompts, governs coding assistants, and routes agent tool calls through a gateway that enforces policy before actions reach external systems.

  23
• CiscoPlatform suite

  Cisco AI Defense, which incorporates the Robust Intelligence acquisition, adds agent red teaming, runtime guardrails, and MCP server scanning; Duo registers agents as identities with human owners, and Secure Access enforces MCP policy. Cisco also acquired the NHI vendor Astrix Security.

  60
• Harmonic Security

  Data protection for employee AI use, using specialized language models to spot sensitive data in prompts, plus an MCP gateway that sets what actions agents may take and what data they may share with each tool.

  19
• Lasso Security

  GenAI and agent security platform with intent-based runtime guardrails, a CPU-only guardrail model (LEAP), agent discovery, and policy over which tools and resources an agent may use.

  39
• NatomaAcquired by Snowflake

  Managed MCP platform that connects AI clients to business applications through per-user connections, with per-tool access policies and a log of every tool call. Acquired by Snowflake in 2026.

  12
• Nightfall AI

  AI-native DLP that inspects data moving through AI agents, MCP servers, endpoints, and SaaS, with an MCP gateway that applies per-tool policy, logs every tool call with the SSO user, and lets admins revoke access.

  34
• Noma Security

  AI security platform that discovers agents, models, MCP servers, and skills across cloud, SaaS, and endpoints, keeps an approved-agent registry with per-tool access policies, and monitors agent sessions at runtime.

  29
• Palo Alto NetworksPlatform suite

  Prisma AIRS: AI runtime security, agent security, AI red teaming, model scanning, posture management, and an AI gateway, built partly from acquisitions of Protect AI, Koi (agentic endpoint security), and Portkey (now Prisma AIRS AI Gateway), with CyberArk as its identity security platform.

  65
• SGNLAcquired by CrowdStrike

  Continuous identity platform that evaluates policy in real time to grant or revoke access, including an MCP gateway that decides which tools an agent may call on a user's behalf. Acquired by CrowdStrike in 2026.

  22
• ZscalerPlatform suite

  Zscaler AI Protect extends the Zero Trust Exchange to AI: secure access to GenAI apps, AI asset discovery, and runtime guardrails, plus AI Red Teaming from the SPLX acquisition, an AI Broker with an agent registry for MCP and A2A traffic, and an AI Access Graph built on Symmetry Systems.

  70

Questions to ask a vendor

1. Does the gateway implement MCP OAuth conformance and block token passthrough?
2. Can it allow list servers and individual tools per agent?
3. Does it log every tool call with the identity chain?

Go deeper

• Secure an MCP server (guide)
• MCP server identity model
• AI gateways shortlist
• MCP frameworks shortlist

FAQ

Why put a gateway in front of MCP servers?

Every MCP server is a new way for an agent to act. A gateway gives one place to authenticate, restrict which tools each agent may call, and record what happened.

What is token passthrough and why is it banned?

Forwarding the client's token straight to a downstream API. The MCP authorization spec forbids it because the downstream service cannot tell the token was meant for someone else.