- Home
- AI agents
- Tools, MCP and agent-to-agent
- MCP gateways and registries
Build · Tools, MCP and agent-to-agent
What is an MCP gateway, and why does it need a registry?
An MCP gateway is a proxy between AI agents and the MCP servers they call. It checks which agent is calling, allows only approved servers and tools, applies policy, swaps in the credential for the target system and logs every call. An MCP registry is the catalogue of approved servers that the gateway reads as its allow list.
In this guide: 83 pages
Key takeaways
- A gateway gives you one place to enforce rules on tool calls. Without one, each agent keeps its own server list and credentials, and an audit means collecting logs from every agent.
- The registry records what is allowed and the gateway enforces it. Point the gateway at the registry so that a server without an approved record cannot be reached.
- The official MCP Registry is a public catalogue, in preview since 8 Sep 2025, and it lists no private servers. Enterprises run a private sub-registry such as Azure API Center, AWS Agent Registry or Google Agent Registry.
- Each cloud now has a managed gateway: Azure API Management and Foundry Toolbox, AgentCore Gateway, and Google Agent Gateway. Check which parts of MCP each one passes through; API Management handles tools only.
What is the difference between an MCP gateway and an MCP server?
An MCP server wraps one system and describes its tools; an MCP gateway sits in front of many servers and decides which agent may call which tool, with which credential. Agents connect to the gateway as if it were one large server, and the gateway forwards each call it allows.
Gateways usually aggregate as well. AgentCore Gateway presents several targets as one virtual MCP server, and Foundry Toolbox puts MCP, OpenAPI and agent-to-agent tools behind a single MCP-compatible endpoint with tool search, so the model loads only the definitions it needs. Many also translate: Azure API Management and AgentCore Gateway turn an existing REST or OpenAPI definition into MCP tools, and the API itself stays as it was.
The 2026-07-28 specification made gateways easier to run. Every Streamable HTTP request now carries Mcp-Method and Mcp-Name headers, so a gateway or a web application firewall can route and filter a call without parsing the JSON body. Because the core protocol is now stateless, any gateway instance behind a plain load balancer can handle any request, with no session affinity to manage.
Three components that get confused, compared on the questions that matter for a design review.
| Question | MCP server | MCP gateway | API gateway |
|---|---|---|---|
| What it fronts | One system, such as a database or a SaaS API | Many MCP servers, and APIs turned into tools | REST or gRPC APIs for any caller |
| Who calls it | An MCP client, usually inside an agent | Agents and MCP clients, which see one endpoint | Applications and services |
| What it decides | What the tool does when called | Which agent may call which tool, with which credential | Which caller may reach which API, and how often |
| Understands tool calls | Yes, for its own tools | Yes; routes on the Mcp-Method and Mcp-Name headers | Only with an MCP feature, as Azure API Management and Kong have |
| Examples | GitHub, Azure and AWS MCP servers | AgentCore Gateway, Google Agent Gateway, Foundry Toolbox, Docker MCP Gateway | Azure API Management, Kong Gateway |
What does an MCP gateway check on each tool call?
Before the server runs, a gateway should settle four questions: which agent is calling, whether this server and tool are on the allow list for that agent, whether policy allows these arguments, and which credential goes to the target system. Then it records the call.
- Authenticate the agent. Inbound, the gateway accepts an OAuth token or a cloud identity: AgentCore Gateway takes OAuth or IAM SigV4, and API Management validates an Entra token in a policy. The token should identify the agent itself, so the log can name who called.
- Check the allow list. Configure the gateway to take its allow list from the private registry, through a native integration where the products offer one or a sync on every approval, so servers and tools without an approved record are refused. Pin the tool list too: AgentCore Gateway can serve a static tool schema, and Anthropic’s mcp-client-2026-09-15 header records each server’s tools so a server cannot change them mid-conversation; a changed schema still needs a fresh review.
- Apply policy to the arguments. AgentCore Policy evaluates Cedar rules on each tool call (GA 3 Mar 2026). Google added semantic governance policies on tool calls (preview, 29 Jun 2026) and Model Armor scanning on Agent Gateway (24 Jun 2026). API Management applies its usual policies, such as rate limits and IP filters.
- Swap the credential. Outbound, the gateway sends the credential the target system expects and keeps the agent’s inbound token to itself. AgentCore Gateway supports OAuth two-legged, three-legged and token exchange, IAM SigV4 and API keys. The MCP authorization specification forbids token passthrough, and the gateway is the natural place to enforce that rule.
- Log the call. Write one record per call with the agent, the user it acts for, the tool, the arguments, the result and the latency, and send it to your tracing system. OWASP’s MCP Top 10, still in beta, lists missing audit and telemetry as MCP08.
Approval for write tools can live at the gateway or in the agent. Foundry’s MCP tool has a require_approval setting, and OpenAI’s remote MCP tool requires approval by default. We place the approval step where the approver can see the conversation, usually the agent’s own channel, and use the gateway to make sure an unattended agent is never offered a write tool at all.
What is an MCP registry, and why run a private one?
An MCP registry is a catalogue of MCP servers with the metadata a client needs to find and connect to them. The official MCP Registry lists public servers. A private registry lists the servers your company has approved, and it becomes the gateway’s allow list.
The official registry launched in preview on 8 Sep 2025, after a grassroots effort led by PulseMCP and Block, and it is still in preview: its documentation warns that breaking changes or data resets may happen before general availability, and its repository reports an API freeze at v0.1 since 24 Oct 2025. It stores metadata only, one server.json per server and never code. Namespaces are verified through GitHub, DNS or HTTP challenges, and security scanning is left to package registries and downstream aggregators. Private servers are out of scope.
The registry also publishes an OpenAPI specification that anyone can implement, and private sub-registries are built on it. A sub-registry pulls the public entries you approve, adds your internal servers and serves the same API, so clients such as VS Code and GitHub Copilot read it the way they read the public one. Azure API Center does this today: it registers remote and local servers, syncs from API Management or Git, and exposes a registry endpoint in the v0.1 format.
On AWS and Google, the MCP registry and the agent registry are one product. AWS Agent Registry holds agents, MCP servers, skills and gateways, returns only approved revisions through its discovery APIs and its own MCP endpoint, and opens a new draft when someone edits an approved record. Google Agent Registry catalogues agents, MCP servers and tools, endpoints and skills, and Agent Gateway enforces it at run time. The guide’s page on agent registries covers the agent side of those products.
Which MCP gateway should you use?
Use the gateway that sits where your agents already run. Before you commit, check which parts of the MCP specification it supports and whether it can read your registry. A common end state is one managed gateway per cloud and one registry that feeds all of them.
MCP gateways on 2 Nov 2026, with the status each vendor page showed that day.
| Gateway | What it does | Status and limits |
|---|---|---|
| Azure API Management | Turns any managed REST API into an MCP server or proxies an existing one; applies its policies, such as Entra token validation, rate limits, IP filters and caching | GA 18 Nov 2025 on classic and v2 tiers and the self-hosted gateway; tools only, no resources or prompts; not available in workspaces |
| Foundry Toolbox | Puts MCP, OpenAPI, agent-to-agent and search tools behind one MCP-compatible endpoint with central auth, tool search and versioning | The page, dated 26 Oct 2026, gives no overall GA or preview label; skills and MCP tasks inside a toolbox are preview |
| Amazon Bedrock AgentCore Gateway | Turns OpenAPI, Smithy and Lambda targets into MCP tools; joins MCP servers into one virtual server; semantic tool search; passthrough for A2A traffic | GA 13 Oct 2025; accepts MCP 2026-07-28, 2025-11-25, 2025-06-18 and 2025-03-26 |
| Google Agent Gateway | Governs agent-to-tool traffic in Gemini Enterprise Agent Platform and enforces Agent Registry | GA 18 Jun 2026; Model Armor on the gateway from 24 Jun 2026; IAM Unified Access Policies for MCP servers GA 31 Aug 2026 |
| Docker MCP Gateway | Runs each MCP server in its own container, joins them behind one endpoint and injects secrets | Open source; the docs now place it in the invite-only Docker AI Governance offering, and it also ships in the Desktop MCP Toolkit |
| Kong AI MCP Proxy plugin | Converts REST APIs to MCP tools or proxies MCP servers | Kong Gateway 3.12 and later, AI Gateway Enterprise only |
| Cloudflare MCP server portals | Puts several MCP servers behind one endpoint with Access logging and optional data loss prevention | Docs updated 2 Nov 2026 carry no preview or GA label |
Two open-source gateways, agentgateway and Agent Router, are hosted projects of the Agentic AI Foundation, the Linux Foundation fund that also hosts MCP. If an agent only calls one or two servers that your own team runs, a gateway can be more machinery than the job needs: keep the allow list and the logging in the agent’s runtime, and add a gateway when a second team or a vendor server arrives.
How do Microsoft, AWS and Google implement it?
Where the gateway and the registry live on each cloud, with statuses as the vendor pages showed on 2 Nov 2026.
Capability, Microsoft, AWS, Google
| Capability | Microsoft | AWS | |
|---|---|---|---|
| Managed MCP gateway | Azure API Management (GA 18 Nov 2025) for APIs and existing servers; Foundry Toolbox for agent tools behind one endpoint | AgentCore Gateway (GA 13 Oct 2025), one virtual MCP server per gateway with inbound and outbound auth | Agent Gateway (GA 18 Jun 2026) for agent-to-tool traffic in Agent Platform |
| Private MCP registry | Azure API Center with a v0.1 registry endpoint that VS Code and GitHub Copilot read; it also feeds Foundry tool catalogues | AWS Agent Registry (GA 31 Aug 2026) holds MCP servers next to agents and exposes an MCP endpoint | Agent Registry (GA 18 Jun 2026) holds MCP servers and tools, enforced through Agent Gateway |
| Policy on tool calls | API Management policies; require_approval per MCP tool in Foundry | AgentCore Policy, Cedar rules on each call (GA 3 Mar 2026) | IAM Unified Access Policies for MCP servers (GA 31 Aug 2026); semantic governance policies (preview since 29 Jun 2026) |
| Identity checked on the way in | Entra tokens validated by API Management; Foundry MCP tool supports key, Entra identity, Entra user delegation and OAuth identity passthrough | OAuth or IAM SigV4 inbound; outbound OAuth, token exchange, SigV4 or API keys | IAM allow and deny policies on managed MCP servers; Model Armor scanning of MCP calls |
Outside the clouds, OpenAI’s Secure MCP Tunnel (19 May 2026, for enterprise customers) and Anthropic’s MCP tunnels (research preview since 19 May 2026) let hosted models reach MCP servers inside a private network.
Frequently asked questions
Is an MCP gateway the same as an AI gateway?
They overlap. An AI gateway usually fronts model endpoints for routing, quotas and token spend, while an MCP gateway fronts tools. AgentCore Gateway now covers both, with model inference routing and passthrough for A2A traffic next to its MCP targets, so one gateway can carry an agent’s tool, model and agent-to-agent calls.
Can we use the official MCP Registry as our allow list?
No. It is a public catalogue in preview that lists no private servers and leaves security scanning to others. Use it as an upstream source: pull the public servers you approve into a private registry, add your internal servers, and point the gateway at the private one.
Does a gateway stop tool poisoning?
It reduces the risk. A gateway that pins tool lists and serves only reviewed descriptions stops a server from changing a tool after approval, the attack Invariant Labs called a rug pull. Hidden instructions inside an approved description still get through, so review descriptions whenever a server is added or changed and treat them as untrusted input, as Microsoft’s Foundry guidance advises.
Do MCP gateways pass through resources and prompts as well as tools?
Some do not. Azure API Management exposes MCP tools only, with no resources or prompts, and Anthropic’s MCP connector, a client feature, is also tools only. Before an agent depends on resources or prompts, read the gateway’s documentation and test that path end to end.
More in Tools, MCP and agent-to-agent
Sources
Each source was read on 2 November 2026. The date shown is the date on the page, or the page’s ms.date for Microsoft Learn; an undated page shows the date it was read.
- Transports, specification 2026-07-28
- Authorization, specification 2026-07-28
- Introducing the MCP Registry (preview)
- About the MCP Registry
- MCP Registry repository
- Expose a REST API as an MCP server in Azure API Management
- Azure update AZ527626: MCP support in API Management generally available
- Register and discover MCP servers in Azure API Center
- Foundry Toolbox overview
- Model Context Protocol tool in Foundry Agent Service
- Amazon Bedrock AgentCore Gateway
- MCP server targets for AgentCore Gateway
- Policy for Amazon Bedrock AgentCore is now generally available
- AWS Agent Registry now generally available
- AWS Agent Registry record lifecycle
- Gemini Enterprise Agent Platform release notes
- Agent Registry overview
- MCP servers overview (Google Cloud)
- MCP Gateway
- AI MCP Proxy plugin
- MCP server portals
- Projects
- OWASP MCP Top 10 (beta)
- MCP security notification: tool poisoning attacks
- MCP connector
- Claude Platform release notes
- Connectors and MCP guide
- OpenAI API changelog
Planning an AI program?
Talk to the team that builds it and runs it after launch.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner