Top MCP Gateways: What Stops a Tool Call
Six MCP and agent-tool gateways. What actually sits in front of a tool call.
Authorization is OPTIONAL for MCP implementations. The 2025-11-25 spec writes it in those words. A tools/call can still leave the box with no token and no proxy in the path.
The category used to mean ‘add TLS on a REST route’. For MCP it is the thing in front of that call: a local scan, a prompt firewall, or a proxy.
TLS and a JWT on a REST route stay on API gateways.
How we evaluated
We read first-party docs, source, licenses, and release notes, and we treat a marketing page as a claim, not as proof two products do the same work. For MCP we cared about whether the product sits on tools/call, whether it only inspects descriptions or actually enforces, whether it runs locally or posts to a vendor API, and whether it assumes authorization the spec still marks optional.
| Tool | Best for | What to check |
|---|---|---|
| Sunglasses | A local input firewall you can pip install | MIT · local scan · optional PreToolUse hook |
| mcp-scan | A CLI that flags poisoned tool descriptions | Apache-2.0 · inspect-only · Snyk token |
| Lakera Guard | A Guard API that screens tool calls and descriptions | Commercial · Check Point · you call the API |
| Prompt Security | A cloud MCP gateway with shadow-server discovery | Commercial · SentinelOne · allow/block |
| HiddenLayer | Runtime inspection of agent tool use, including MCP | Commercial · SDK or gateway · enforce |
| MCP-Bastion | A local MCP proxy you point the client at | Custom license · you operate it · proxy |
Sunglasses
Best for a local input firewall you can pip install
Sunglasses is a local input filter. It scans prompts, files, and MCP tool metadata before that text becomes model context. No API key. No cloud call on the scan path.
Since v0.4 the package also ships an enforcing path: sunglasses init installs a Claude Code PreToolUse hook that can block outbound tool calls and pin MCP tool descriptors. The MCP server at python -m sunglasses.mcp only exposes scan tools. Registering it does not make the scan mandatory.
Key features:
- Local pattern scan public docs describe as 1407 patterns across 117 categories
- Stdio MCP server: scan_text, scan_file, scanner_info
- Claude Code PreToolUse hook, audit receipts, and tool-descriptor pinning
- pip install sunglasses, MIT, no telemetry on scanned content
Why we like it:
When the job is a filter on the laptop, this is the local row. The pattern catalog is public. You can read what it matches.
Limits:
The MCP install alone does not enforce. Coverage is the catalog they publish, not a lab score. It is a pattern filter, and they say so.
License or pricing: MIT.
mcp-scan
Best for a CLI that flags poisoned tool descriptions
mcp-scan is the scanner Invariant Labs shipped for tool poisoning, rug pulls, and toxic flows. The live repo is Snyk Agent Scan. invariantlabs-ai/mcp-scan redirects there. Apache-2.0. You need a Snyk account and a SNYK_TOKEN before a scan runs.
Scan mode starts the stdio servers in the config so it can fetch tool descriptions. That is execute, not a dry read of JSON. Analysis goes to the Agent Scan API. inspect lists components without that analysis.
Key features:
- Auto-discover Claude, Cursor, Windsurf, Gemini CLI, and other agent configs they list
- Prompt injection, tool poisoning, untrusted content, destructive capabilities
- inspect without analysis; scan with the Agent Scan API
- Tool pinning against rug pulls in the original MCP-Scan write-up
Why we like it:
If you want a report on the servers already in mcp.json, this is the known scanner. It named the attack class. It still scans descriptions.
Limits:
Requires SNYK_TOKEN. Tool names and descriptions leave the machine. Scanning executes configured stdio commands. Default scan does not sit on tools/call.
License or pricing: Apache-2.0. Snyk account required to scan.
Lakera Guard
Best for a Guard API that screens tool calls and descriptions
Lakera Guard is the category leader on this list. Docs now live under Check Point AI Agent Security. The MCP path on the public docs is a POST to the Guard API, often wrapped as a Python decorator on FastMCP tools, prompts, and resources.
Detectors always detect. They flag in Enforce mode. You choose block or log per project. The API screens tool calls, tool responses, and tool descriptions.
Key features:
- Guard API over tool calls, tool responses, and tool descriptions
- Off-Task Action detector and Tool Allow/Deny List
- SaaS or self-hosted
- Model-agnostic; 100+ languages on their docs
Why we like it:
When you already want a vendor prompt firewall and you will call an API on every agent step, this is the known Guard.
Limits:
It is an API you invoke. A transparent MCP proxy is a different product. Check Point closed the acquisition in late 2025. No public list price. Docs still mention a free account.
License or pricing: Commercial. No public list price.
Prompt Security
Best for a cloud MCP gateway with shadow-server discovery
Prompt Security’s MCP Gateway sits between AI apps and MCP servers. It discovers usage, scores servers (they say 13,000+ on GitHub), allows or blocks by user, server, or action, and keeps an audit log. Enforcement is a lightweight agent or a reverse proxy.
Prompt Security ships as a SentinelOne product. MCP is a surface on that platform, not a pip-install proxy.
Key features:
- Shadow MCP detection
- Risk scoring across MCP servers they index
- Allow/block policy by user, server, or action
- Searchable audit logs of every interaction they capture
Why we like it:
When the hole is unsanctioned MCP on laptops the SOC already covers, this is the gateway that names shadow servers.
Limits:
No public list price. You buy the platform. Grep the local stdio proxy elsewhere on this list.
License or pricing: Commercial. No public list price.
HiddenLayer
Best for runtime inspection of agent tool use, including MCP
HiddenLayer’s agentic module inspects prompts, MCP responses, and tool actions. The public Agents SDK wrapper scans MCP tool definitions at discovery and drops tools that violate policy. Fail-closed on that path.
Traffic inspection is LiteLLM proxy interception, SDK instrumentation, or gateway inspection. They sell visibility and enforcement. Classifiers sit outside the model they protect.
Key features:
- Indirect prompt injection detection in data, documents, and MCP responses
- Tool use and action inspection across APIs, MCP tools, and filesystem ops
- MCP tool definitions scanned at discovery in the Agents SDK wrapper
- Session reconstruct and hunt across tools and workflows
Why we like it:
When the buy is an AI runtime platform that already talks to agents, MCP is a surface on the public docs, not a bolt-on scan.
Limits:
Enterprise quote. You still instrument the SDK or the gateway. No public list price. A pip-install proxy is Sunglasses or Bastion.
License or pricing: Commercial. No public list price.
MCP-Bastion
Best for a local MCP proxy you point the client at
MCP-Bastion is middleware or serve --proxy. Clients talk to Bastion. Bastion forwards allowed traffic upstream. Same bastion.yaml. The user guide on GitHub Pages was updated 16 August 2026. The repo is live.
The Pages site still says MIT. The LICENSE file in the repo is a custom community and commercial license. Commercial use needs a paid license. We follow the file.
Key features:
- In-process middleware or HTTP proxy on tools, resources, and prompts
- Policy-as-code in bastion.yaml
- Tool metadata fingerprint and catalog pin against description drift
- PII redaction and an optional reversible vault
Why we like it:
When you need a process that actually terminates tools/call, this is the local proxy on the list. You can read the YAML.
Limits:
Custom license, not OSI MIT. Small project. Advanced pillars are opt-in. A cloud prompt firewall is Lakera or HiddenLayer.
License or pricing: Custom community license. Commercial use needs a separate paid license. No public list price.
How to choose an MCP gateway
Four questions before the quote. Names below are tools, not a scored bake-off.
| Critical question | Why it matters | What to evaluate | Red flag |
|---|---|---|---|
| Does it sit on tools/call, or only scan descriptions? | A report on mcp.json does not stop the next call. | mcp-scan inspects. Sunglasses can hook PreToolUse. MCP-Bastion proxies. Lakera and Prompt Security enforce when you put them on the path. | A scanner sold as a gateway. |
| Local process, or a vendor API we call? | That is the data-leaving-the-box fork, and the outage fork. | Sunglasses and MCP-Bastion run with you. Lakera Guard is an API. HiddenLayer and Prompt Security are platforms. | A local pitch that still posts descriptions to a cloud analyzer. |
| Fail open or fail closed if the scanner or API is down? | Optional auth in the spec already leaves a hole. A dead proxy should not add another. | Ask Sunglasses about the hook. Ask Lakera about Project mode. Ask MCP-Bastion about proxy death. | Silent pass-through on timeout. |
| Can a reviewer export the block? | A vendor chat is a poor record. | Prompt Security sells searchable logs. Sunglasses ships audit receipts. Bastion has an audit pillar. | No export path. |
What the internet thinks about MCP gateways
MCP threads treat tool descriptions as instructions the model will follow. A scan of yesterday’s schema misses a server that rewrote the docstring after you clicked allow.
Put something on tools/call. Scan the catalog first. Do not confuse this with a classic API gateway.
FAQs
Is mcp-scan still an Invariant Labs product?
The live GitHub repo is snyk/agent-scan. invariantlabs-ai/mcp-scan redirects there. Apache-2.0. A Snyk token is required to scan.
Does Sunglasses replace Lakera Guard?
No. Sunglasses is a local pattern filter. Lakera Guard is a vendor API. Sunglasses’ own compare page tells you to stack them.
Is MCP-Bastion MIT licensed?
The Pages site says MIT. The LICENSE file in the repo is a custom community license. Commercial use needs a separate paid license. We follow the file.
Is this a scored bake-off?
No. Order is editorial.
