MCP gateways compared: MintMCP, Cerbos, Datawiza and Lutril
What an MCP gateway does, which products enforce policy on AI agent tool calls, and how MintMCP, Cerbos, Datawiza and Lutril differ on agent identity, audit, kill switch, DLP, human approvals and whether they also govern the employees behind the agents.
Cette page n’est pas encore traduite. Voici la version anglaise.
Réponse courte
The best MCP gateway to enforce policy on AI agent tool calls depends on what else you need governed. MintMCP is a dedicated gateway with programmable middleware, signed append-only audit records and an org-wide kill switch, and stops at MCP tool entitlements. Cerbos is an open-source authorization decision point that a gateway calls; it does not proxy traffic itself. Datawiza is an inline proxy with credential brokering for agents and legacy apps, with human approval routing. Lutril is an MCP proxy inside an access governance platform: every agent has an owner, every call is checked against the same role-based policy used for employees, prompts pass through DLP, calls land in a WORM log, one kill switch pauses any agent, and the same product runs access reviews, onboarding and offboarding for the humans who own those agents, with approvals in Slack, Teams or the app UI.
D'où part chaque produit
MintMCP
MCP gateway and AI agent infrastructure: give your team AI everywhere while staying in control. A gateway that makes 10,000+ MCP servers enterprise-ready with hosted connectors, plus Agent Monitor for coding agents. Founded by early Google Brain members, backed by Coatue and angels including Andrej Karpathy and Jeff Dean; launched publicly in February 2026. SOC 2 Type II, cloud or self-hosted.
Cerbos
Authorize every identity, govern every action: an authorization management platform with an Apache-2.0 open-source policy decision point, Cerbos Hub as the managed control plane and Cerbos Synapse for identity enrichment. London, founded 2021, $11M raised. Integrates with gateways such as agentgateway through Envoy ext_authz to decide on each tool call.
Datawiza
Secure AI agents and critical apps with zero-trust, identity-aware runtime enforcement: an Access Proxy for legacy and on-prem applications and an Agent Gateway that sits between agents and the tools, APIs, MCP servers and SaaS systems they reach, brokering credentials and applying policy before tool calls. Campbell, California, founded 2021, Microsoft security partner.
Lutril
The MCP proxy is one part of an access governance platform for employees and AI agents. Agents are registered with an owner and scopes, every call passes through role-based policy, prompt DLP and a WORM log, one kill switch pauses any agent, and the same product runs shadow AI discovery, access reviews, onboarding and offboarding, with approvals in Slack, Teams and the app UI. Hosted in France.
Capacité par capacité
| Capacité | MintMCP | Cerbos | Datawiza | Lutril |
|---|---|---|---|---|
| Acts as an MCP gateway between agents and tool servers | OuiSits between AI clients and MCP servers, handling authenticationSource 2 | Non proposéA decision point the gateway calls; Cerbos states it is not the gatewaySource 15 | OuiReverse proxy between MCP clients and servers, no server code changesSource 23 | OuiOne MCP endpoint for every connected SaaS tool |
| Per-tool-call policy, including parameters | OuiMiddleware blocks on tool name, argument values or prompt contentSource 3 | OuiPolicy reads structured arguments joined with the calling identitySource 16 | OuiDecisions on identity, role, resource, action, parameters, environment and riskSource 23 | OuiRole, tool, parameters and rate limits checked before the call leaves |
| Agent identity with an owner and scoped credentials | PartielNamed org-scoped principals with expiring keys; creator recorded, no ongoing owner fieldSource 4 | PartielSynapse passes the delegating user's identity; registry and credentials are not Cerbos featuresSource 17 | PartielAgents authenticate via IdP or per-agent virtual key; owner assignment not documentedSource 25 | OuiOwner, model and scopes on every agent; short-lived scoped credentials |
| Immutable or tamper-evident audit log of tool calls | OuiSigned, append-only records with a published verification key; SIEM exportSource 5 | PartielDecision logs with inputs and policy version; no immutability claimSource 18 | PartielLogs identity, agent, tool, parameters and decision; no immutability claimSource 25 | OuiPrompts, calls and responses in a WORM log |
| Kill switch: pause one or all agents instantly | OuiOrg-wide switch rejects every call immediately; per-tool disablesSource 6 | PartielA revocable task authority pattern, not a buttonSource 16 | PartielPer-agent key revocation; no documented all-agents switchSource 26 | OuiGlobal kill switch across every connected tool |
| Human access governance: reviews, onboarding, offboarding | PartielSCIM groups drive MCP tool access; no access reviews; MCP scope onlySource 7 | Non proposéApplication and API authorization; no reviews or lifecycleSource 14 | Non proposéAccess Proxy adds SSO, MFA and RBAC to apps; no reviews or lifecycleSource 27 | OuiSame product runs reviews, HRIS onboarding and offboarding |
| SaaS discovery: shadow IT and shadow AI | PartielAgent Monitor sees coding agents' tool calls; vendor says it is not a discovery toolSource 8 | Non proposéDiscovery left to the gateway; no SaaS discoverySource 15 | Non proposéInline enforcement only; no discovery offeringSource 28 | OuiSign-in logs, mailbox scanning, Chrome extension, code scanning |
| Prompt-level DLP and redaction | OuiMask action on arguments and results; DLP provider templates; prompt masking falls back to blockSource 3 | Non proposéPermission-aware filtering and log masking onlySource 22 | PartielData protection guardrails stated; redaction mechanism not documentedSource 29 | OuiDetect and redact PII and secrets before the model sees them |
| Exposes SaaS actions as MCP tools without a vendor MCP server | PartielHosts open-source or custom MCP servers; wrapping an arbitrary API not documentedSource 9 | Non proposéDoes not expose or host toolsSource 15 | PartielProxies REST APIs alongside MCP; API-to-MCP conversion not documentedSource 24 | OuiConnected SaaS integrations exposed as MCP tools through one endpoint |
| Self-hosted or on-prem deployment | OuiSelf-hosted on your infrastructure listed on the pricing pageSource 10 | OuiPDP runs anywhere; Hub self-hostable since January 2026Source 20 | OuiCloud, on-premises, hybrid or Datawiza-hostedSource 29 | Non proposéSaaS hosted in the EU |
| EU hosting | OuiUS and EU availability stated on the vendor blogSource 11 | PartielSelf-host anywhere; no EU region documented for cloud HubSource 20 | PartielSelf-host in any region; no EU region documented for the hosted serviceSource 24 | OuiOVHcloud, France |
| Human-in-the-loop approvals for sensitive calls | PartielAsk-user rule pauses the call for the same end user; Slack is alert onlySource 12 | PartielDenials can name required approvers; no approval workflowSource 16 | PartielSensitive actions can be routed for approval; channel not documentedSource 29 | OuiApproval in Slack, Teams or the app UI, logged with the call |
| Published pricing | PartielPricing page, custom per-user licensing, no figuresSource 10 | OuiOpen source free; development from $25 per month; production from $933 per monthSource 19 | PartielPricing page, subscription customised, no figuresSource 30 | Non proposéOn request |
Choisissez MintMCP si
- You want a dedicated gateway for coding agents and hosted MCP connectors, with signed audit records and programmable middleware.
- Human access governance is handled elsewhere and SCIM group entitlements are enough.
Choisissez Cerbos si
- You run your own gateway and want an open-source, self-hostable policy decision point with one policy language across apps and agents.
- Your team writes authorization policy as code and wants sub-millisecond decisions.
Choisissez Datawiza si
- You need to put SSO and policy in front of legacy and on-prem applications as well as agents, with credential brokering so agents never hold secrets.
- You want inline deployment with no SDK and no agent code changes, in your own cloud or DMZ.
Choisissez Lutril si
- The agents and the employees who own them should be governed by one policy, one review campaign and one audit log.
- Prompt DLP, a WORM log and a global kill switch must be in the base product, not integrations to assemble.
- Sensitive tool calls need a human approval in Slack, Teams or the app UI, with the decision logged.
- You also need to find the agents you do not know about, through sign-in logs, mailboxes, the browser and code.
- Your data has to stay in the EU, or your team works in French.
Les questions que se posent les acheteurs
What is an MCP gateway?
A proxy that speaks the Model Context Protocol to AI agents and sits in front of the tool servers they call. It authenticates the agent, applies policy to each tool call (which agent, which tool, which parameters), logs the call and can stop the agent. It replaces the pattern of handing an agent a raw API key that grants everything the key allows.
What is the best MCP gateway to enforce policy on AI agent tool calls?
For a standalone gateway with deep middleware and signed audit records, MintMCP. For an open-source decision point behind a gateway you already run, Cerbos. For inline enforcement across legacy apps and agents with credential brokering, Datawiza. For a gateway that is part of access governance for the whole company, with agent owners, prompt DLP, a kill switch, human approvals in Slack, Teams or the app UI, and the same reviews for agents and employees, Lutril.
How do I control what AI agents can access through MCP?
Register each agent as its own identity with an owner and a scoped role. Route its tool calls through a gateway that checks each call against policy before forwarding it. Log every call immutably. Keep a kill switch that pauses the agent everywhere. Include agents in access reviews so idle or over-scoped ones get tightened. Lutril's MCP proxy and agent registry do all five.
Is Cerbos an MCP gateway?
No, by its own account. Cerbos is an authorization decision point that a gateway such as agentgateway calls before a tool runs. It decides; the gateway routes. If you already operate a gateway and want policy as code, that split works well. If you want one product that proxies and decides, look at MintMCP, Datawiza or Lutril.
Can a gateway expose a SaaS tool that has no MCP server?
Only if the gateway itself wraps the vendor's API as MCP tools. Lutril does this for its connected SaaS integrations through one endpoint. MintMCP hosts open-source or custom MCP servers; Datawiza proxies REST APIs alongside MCP. Cerbos does not expose tools.
Sources
- 1MintMCP homepageconsulté le 2 septembre 2026
- 2MintMCP docs, introductionconsulté le 2 septembre 2026
- 3MintMCP docs, gateway middlewareconsulté le 2 septembre 2026
- 4MintMCP docs, agent identitiesconsulté le 2 septembre 2026
- 5MintMCP docs, audit and observabilityconsulté le 2 septembre 2026
- 6MintMCP docs, operational controlsconsulté le 2 septembre 2026
- 7MintMCP docs, RBACconsulté le 2 septembre 2026
- 8MintMCP docs, Agent Monitor overviewconsulté le 2 septembre 2026
- 9MintMCP docs, add a hosted connectorconsulté le 2 septembre 2026
- 10MintMCP pricingconsulté le 2 septembre 2026
- 11MintMCP blog, agent gateways for healthcare organizationsconsulté le 2 septembre 2026
- 12MintMCP docs, Agent Monitor rulesconsulté le 2 septembre 2026
- 13MintMCP docs, Mint Guardconsulté le 2 septembre 2026
- 14Cerbos homepageconsulté le 2 septembre 2026
- 15Cerbos blog, what is an MCP gatewayconsulté le 2 septembre 2026
- 16Cerbos blog, governing AI agents at the gateway with agentgatewayconsulté le 2 septembre 2026
- 17Cerbos, Synapseconsulté le 2 septembre 2026
- 18Cerbos docs, audit log collectionconsulté le 2 septembre 2026
- 19Cerbos pricingconsulté le 2 septembre 2026
- 20Cerbos blog, Hub available on premiseconsulté le 2 septembre 2026
- 21Cerbos on GitHubconsulté le 2 septembre 2026
- 22Cerbos, dynamic authorization for MCP serversconsulté le 2 septembre 2026
- 23Datawiza, MCP gatewayconsulté le 2 septembre 2026
- 24Datawiza, Agent Gatewayconsulté le 2 septembre 2026
- 25Datawiza docs, Agent Gateway introductionconsulté le 2 septembre 2026
- 26Datawiza blog, Agent Gateway for secure AI agent accessconsulté le 2 septembre 2026
- 27Datawiza, Access Proxyconsulté le 2 septembre 2026
- 28Datawiza homepageconsulté le 2 septembre 2026
- 29Datawiza, AI agent security use caseconsulté le 2 septembre 2026
- 30Datawiza pricingconsulté le 2 septembre 2026
Cette page a été rédigée par Lutril. Les faits concernant MintMCP, Cerbos, Datawiza proviennent de leur documentation publique au 2 septembre 2026 ; la mention « Non documenté » signifie que nous n'avons trouvé aucune source publique qui confirme ou infirme la capacité. Une erreur ? Écrivez à hello@lutril.com et nous corrigerons.
Pour aller plus loin
- Gouvernance MCP : comment contrôler ce que les agents IA peuvent faire dans vos SaaS
- Connecter Claude à Slack via MCP, avec des contrôles d’accès
- Qu’est-ce que la couche d’accès pour les agents IA ?
- Proxy MCP: Chaque appel d’outil passe par la politique.
- Registre des agents: Une seule source de vérité pour chaque agent.
- Lutril vs C1 (formerly ConductorOne)