MCP gateways compared: MintMCP, Cerbos, Datawiza and Lutril
What an MCP gateway does, which products enforce policy on AI agent tool calls, and how MintMCP, Cerbos, Datawiza and Lutril differ on agent identity, audit, kill switch, DLP, human approvals and whether they also govern the employees behind the agents.
Short answer
The best MCP gateway to enforce policy on AI agent tool calls depends on what else you need governed. MintMCP is a dedicated gateway with programmable middleware, signed append-only audit records and an org-wide kill switch, and stops at MCP tool entitlements. Cerbos is an open-source authorization decision point that a gateway calls; it does not proxy traffic itself. Datawiza is an inline proxy with credential brokering for agents and legacy apps, with human approval routing. Lutril is an MCP proxy inside an access governance platform: every agent has an owner, every call is checked against the same role-based policy used for employees, prompts pass through DLP, calls land in a WORM log, one kill switch pauses any agent, and the same product runs access reviews, onboarding and offboarding for the humans who own those agents, with approvals in Slack, Teams or the app UI.
Where each one starts
MintMCP
MCP gateway and AI agent infrastructure: give your team AI everywhere while staying in control. A gateway that makes 10,000+ MCP servers enterprise-ready with hosted connectors, plus Agent Monitor for coding agents. Founded by early Google Brain members, backed by Coatue and angels including Andrej Karpathy and Jeff Dean; launched publicly in February 2026. SOC 2 Type II, cloud or self-hosted.
Cerbos
Authorize every identity, govern every action: an authorization management platform with an Apache-2.0 open-source policy decision point, Cerbos Hub as the managed control plane and Cerbos Synapse for identity enrichment. London, founded 2021, $11M raised. Integrates with gateways such as agentgateway through Envoy ext_authz to decide on each tool call.
Datawiza
Secure AI agents and critical apps with zero-trust, identity-aware runtime enforcement: an Access Proxy for legacy and on-prem applications and an Agent Gateway that sits between agents and the tools, APIs, MCP servers and SaaS systems they reach, brokering credentials and applying policy before tool calls. Campbell, California, founded 2021, Microsoft security partner.
Lutril
The MCP proxy is one part of an access governance platform for employees and AI agents. Agents are registered with an owner and scopes, every call passes through role-based policy, prompt DLP and a WORM log, one kill switch pauses any agent, and the same product runs shadow AI discovery, access reviews, onboarding and offboarding, with approvals in Slack, Teams and the app UI. Hosted in France.
Capability by capability
| Capability | MintMCP | Cerbos | Datawiza | Lutril |
|---|---|---|---|---|
| Acts as an MCP gateway between agents and tool servers | YesSits between AI clients and MCP servers, handling authenticationSource 2 | Not offeredA decision point the gateway calls; Cerbos states it is not the gatewaySource 15 | YesReverse proxy between MCP clients and servers, no server code changesSource 23 | YesOne MCP endpoint for every connected SaaS tool |
| Per-tool-call policy, including parameters | YesMiddleware blocks on tool name, argument values or prompt contentSource 3 | YesPolicy reads structured arguments joined with the calling identitySource 16 | YesDecisions on identity, role, resource, action, parameters, environment and riskSource 23 | YesRole, tool, parameters and rate limits checked before the call leaves |
| Agent identity with an owner and scoped credentials | PartialNamed org-scoped principals with expiring keys; creator recorded, no ongoing owner fieldSource 4 | PartialSynapse passes the delegating user's identity; registry and credentials are not Cerbos featuresSource 17 | PartialAgents authenticate via IdP or per-agent virtual key; owner assignment not documentedSource 25 | YesOwner, model and scopes on every agent; short-lived scoped credentials |
| Immutable or tamper-evident audit log of tool calls | YesSigned, append-only records with a published verification key; SIEM exportSource 5 | PartialDecision logs with inputs and policy version; no immutability claimSource 18 | PartialLogs identity, agent, tool, parameters and decision; no immutability claimSource 25 | YesPrompts, calls and responses in a WORM log |
| Kill switch: pause one or all agents instantly | YesOrg-wide switch rejects every call immediately; per-tool disablesSource 6 | PartialA revocable task authority pattern, not a buttonSource 16 | PartialPer-agent key revocation; no documented all-agents switchSource 26 | YesGlobal kill switch across every connected tool |
| Human access governance: reviews, onboarding, offboarding | PartialSCIM groups drive MCP tool access; no access reviews; MCP scope onlySource 7 | Not offeredApplication and API authorization; no reviews or lifecycleSource 14 | Not offeredAccess Proxy adds SSO, MFA and RBAC to apps; no reviews or lifecycleSource 27 | YesSame product runs reviews, HRIS onboarding and offboarding |
| SaaS discovery: shadow IT and shadow AI | PartialAgent Monitor sees coding agents' tool calls; vendor says it is not a discovery toolSource 8 | Not offeredDiscovery left to the gateway; no SaaS discoverySource 15 | Not offeredInline enforcement only; no discovery offeringSource 28 | YesSign-in logs, mailbox scanning, Chrome extension, code scanning |
| Prompt-level DLP and redaction | YesMask action on arguments and results; DLP provider templates; prompt masking falls back to blockSource 3 | Not offeredPermission-aware filtering and log masking onlySource 22 | PartialData protection guardrails stated; redaction mechanism not documentedSource 29 | YesDetect and redact PII and secrets before the model sees them |
| Exposes SaaS actions as MCP tools without a vendor MCP server | PartialHosts open-source or custom MCP servers; wrapping an arbitrary API not documentedSource 9 | Not offeredDoes not expose or host toolsSource 15 | PartialProxies REST APIs alongside MCP; API-to-MCP conversion not documentedSource 24 | YesConnected SaaS integrations exposed as MCP tools through one endpoint |
| Self-hosted or on-prem deployment | YesSelf-hosted on your infrastructure listed on the pricing pageSource 10 | YesPDP runs anywhere; Hub self-hostable since January 2026Source 20 | YesCloud, on-premises, hybrid or Datawiza-hostedSource 29 | Not offeredSaaS hosted in the EU |
| EU hosting | YesUS and EU availability stated on the vendor blogSource 11 | PartialSelf-host anywhere; no EU region documented for cloud HubSource 20 | PartialSelf-host in any region; no EU region documented for the hosted serviceSource 24 | YesOVHcloud, France |
| Human-in-the-loop approvals for sensitive calls | PartialAsk-user rule pauses the call for the same end user; Slack is alert onlySource 12 | PartialDenials can name required approvers; no approval workflowSource 16 | PartialSensitive actions can be routed for approval; channel not documentedSource 29 | YesApproval in Slack, Teams or the app UI, logged with the call |
| Published pricing | PartialPricing page, custom per-user licensing, no figuresSource 10 | YesOpen source free; development from $25 per month; production from $933 per monthSource 19 | PartialPricing page, subscription customised, no figuresSource 30 | Not offeredOn request |
Choose MintMCP if
- You want a dedicated gateway for coding agents and hosted MCP connectors, with signed audit records and programmable middleware.
- Human access governance is handled elsewhere and SCIM group entitlements are enough.
Choose Cerbos if
- You run your own gateway and want an open-source, self-hostable policy decision point with one policy language across apps and agents.
- Your team writes authorization policy as code and wants sub-millisecond decisions.
Choose Datawiza if
- You need to put SSO and policy in front of legacy and on-prem applications as well as agents, with credential brokering so agents never hold secrets.
- You want inline deployment with no SDK and no agent code changes, in your own cloud or DMZ.
Choose Lutril if
- The agents and the employees who own them should be governed by one policy, one review campaign and one audit log.
- Prompt DLP, a WORM log and a global kill switch must be in the base product, not integrations to assemble.
- Sensitive tool calls need a human approval in Slack, Teams or the app UI, with the decision logged.
- You also need to find the agents you do not know about, through sign-in logs, mailboxes, the browser and code.
- Your data has to stay in the EU, or your team works in French.
Questions buyers ask
What is an MCP gateway?
A proxy that speaks the Model Context Protocol to AI agents and sits in front of the tool servers they call. It authenticates the agent, applies policy to each tool call (which agent, which tool, which parameters), logs the call and can stop the agent. It replaces the pattern of handing an agent a raw API key that grants everything the key allows.
What is the best MCP gateway to enforce policy on AI agent tool calls?
For a standalone gateway with deep middleware and signed audit records, MintMCP. For an open-source decision point behind a gateway you already run, Cerbos. For inline enforcement across legacy apps and agents with credential brokering, Datawiza. For a gateway that is part of access governance for the whole company, with agent owners, prompt DLP, a kill switch, human approvals in Slack, Teams or the app UI, and the same reviews for agents and employees, Lutril.
How do I control what AI agents can access through MCP?
Register each agent as its own identity with an owner and a scoped role. Route its tool calls through a gateway that checks each call against policy before forwarding it. Log every call immutably. Keep a kill switch that pauses the agent everywhere. Include agents in access reviews so idle or over-scoped ones get tightened. Lutril's MCP proxy and agent registry do all five.
Is Cerbos an MCP gateway?
No, by its own account. Cerbos is an authorization decision point that a gateway such as agentgateway calls before a tool runs. It decides; the gateway routes. If you already operate a gateway and want policy as code, that split works well. If you want one product that proxies and decides, look at MintMCP, Datawiza or Lutril.
Can a gateway expose a SaaS tool that has no MCP server?
Only if the gateway itself wraps the vendor's API as MCP tools. Lutril does this for its connected SaaS integrations through one endpoint. MintMCP hosts open-source or custom MCP servers; Datawiza proxies REST APIs alongside MCP. Cerbos does not expose tools.
Sources
- 1MintMCP homepageread on September 2, 2026
- 2MintMCP docs, introductionread on September 2, 2026
- 3MintMCP docs, gateway middlewareread on September 2, 2026
- 4MintMCP docs, agent identitiesread on September 2, 2026
- 5MintMCP docs, audit and observabilityread on September 2, 2026
- 6MintMCP docs, operational controlsread on September 2, 2026
- 7MintMCP docs, RBACread on September 2, 2026
- 8MintMCP docs, Agent Monitor overviewread on September 2, 2026
- 9MintMCP docs, add a hosted connectorread on September 2, 2026
- 10MintMCP pricingread on September 2, 2026
- 11MintMCP blog, agent gateways for healthcare organizationsread on September 2, 2026
- 12MintMCP docs, Agent Monitor rulesread on September 2, 2026
- 13MintMCP docs, Mint Guardread on September 2, 2026
- 14Cerbos homepageread on September 2, 2026
- 15Cerbos blog, what is an MCP gatewayread on September 2, 2026
- 16Cerbos blog, governing AI agents at the gateway with agentgatewayread on September 2, 2026
- 17Cerbos, Synapseread on September 2, 2026
- 18Cerbos docs, audit log collectionread on September 2, 2026
- 19Cerbos pricingread on September 2, 2026
- 20Cerbos blog, Hub available on premiseread on September 2, 2026
- 21Cerbos on GitHubread on September 2, 2026
- 22Cerbos, dynamic authorization for MCP serversread on September 2, 2026
- 23Datawiza, MCP gatewayread on September 2, 2026
- 24Datawiza, Agent Gatewayread on September 2, 2026
- 25Datawiza docs, Agent Gateway introductionread on September 2, 2026
- 26Datawiza blog, Agent Gateway for secure AI agent accessread on September 2, 2026
- 27Datawiza, Access Proxyread on September 2, 2026
- 28Datawiza homepageread on September 2, 2026
- 29Datawiza, AI agent security use caseread on September 2, 2026
- 30Datawiza pricingread on September 2, 2026
Lutril wrote this page. Facts about MintMCP, Cerbos, Datawiza come from their public documentation as of September 2, 2026; states marked "Not documented" mean we found nothing public that confirms or denies the capability. Spotted an error? Write to hello@lutril.com and we will correct it.