# MCP gateways compared: Bifrost, ContextForge, Obot, Docker, Microsoft, Kuadrant, MCP Hangar

Source: https://mcp-hangar.io/compare

---

Open-source MCP gateways and MCP Hangar, compared row by row. Every cell was read in source at a pinned commit (Bifrost 21e2263, ContextForge 1f8b9bf, Obot d8e5db5, Docker MCP Gateway 7e0f342, Microsoft MCP Gateway cf9f5e9, Kuadrant MCP Gateway 98a4ccb, MCP Hangar 0c70812), last verified 2026-11-12. "no" means the vendor states it; "no evidence at <sha>" means the code at that commit was searched and nothing was found. MCP Hangar publishes this table and is one of the products in it.

| Row | Bifrost | ContextForge | Obot | Docker MCP Gateway | Microsoft MCP Gateway | Kuadrant MCP Gateway | MCP Hangar |
|---|---|---|---|---|---|---|---|
| **A. What gateway comparisons usually ask** | | | | | | | |
| License and open-core boundary | enterprise | yes | enterprise | enterprise | yes | yes | yes |
| Caller authentication | yes | yes | yes | partial | yes | partial | yes |
| Tool scoping | yes | yes | yes | partial | yes | partial | yes |
| Upstream credentials | yes | yes | yes | partial | partial | yes | partial |
| Argument and result inspection | partial | yes | yes | yes | partial | yes | partial |
| Audit of tool calls | partial | partial | partial | partial | partial | partial | partial |
| Deployment model | yes | yes | yes | partial | yes | yes | yes |
| **B. Tool contract and call path** | | | | | | | |
| Tool contract integrity | no evidence at 21e2263 | no evidence at 1f8b9bf | no evidence at d8e5db5 | no evidence at 7e0f342 | no evidence at cf9f5e9 | no evidence at 98a4ccb | yes |
| Drift detection | no evidence at 21e2263 | partial | no evidence at d8e5db5 | no evidence at 7e0f342 | no evidence at cf9f5e9 | partial | yes |
| Pin bound to upstream identity | no evidence at 21e2263 | no evidence at 1f8b9bf | no evidence at d8e5db5 | no evidence at 7e0f342 | no evidence at cf9f5e9 | no evidence at 98a4ccb | yes |
| Human approval gate | no evidence at 21e2263 | no evidence at 1f8b9bf | no evidence at d8e5db5 | no evidence at 7e0f342 | no evidence at cf9f5e9 | no evidence at 98a4ccb | yes |
| Egress and network enforcement | no evidence at 21e2263 | no evidence at 1f8b9bf | yes | partial | partial | no evidence at 98a4ccb | yes |
| **C. Rows Hangar loses** | | | | | | | |
| LLM gateway | yes | partial | yes | no evidence at 7e0f342 | no evidence at cf9f5e9 | no | no, by design |
| Desktop and device MCP inventory | enterprise | no evidence at 1f8b9bf | yes | partial | no evidence at cf9f5e9 | no evidence at 98a4ccb | partial |
| Sandboxed server runtime and catalog UI | partial | partial | yes | partial | partial | no evidence at 98a4ccb | partial |

#### Bifrost

License Apache-2.0. Verified 2026-11-12: maximhq/bifrost at 21e226373d94382a2d6740770828470d25fb0d91.

- License and open-core boundary: enterprise. Apache-2.0; guardrails, SSO/SCIM, RBAC, signed audit logs, clustering, token exchange, Edge are enterprise Evidence: <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/LICENSE#L1-L3>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/docs/enterprise/overview.mdx#L7-L7>, <https://www.getmaxim.ai/bifrost/pricing>
- Caller authentication: yes. Virtual-key headers; OAuth 2.1 AS on /mcp (DCR, PKCE S256, RFC 8707, RFC 9728, CIMD); user/SSO mode is enterprise Evidence: <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/transports/bifrost-http/handlers/mcpserver.go#L884-L1023>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/transports/bifrost-http/handlers/mcpoauth2issuance.go#L32-L80>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/transports/bifrost-http/handlers/mcpoauth2discovery.go#L40-L52>
- Tool scoping: yes. Per-virtual-key tool allow-lists enforced at tools/list and tools/call; Virtual MCPs serve tool subsets at /mcp/<slug> Evidence: <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/plugins/governance/main.go#L1767-L1786>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/transports/bifrost-http/handlers/mcpserver.go#L778-L806>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/docs/mcp/virtual-mcps.mdx#L9-L13>
- Upstream credentials: yes. Shared headers/OAuth and per-user OAuth/headers in OSS; RFC 8693 token exchange requires an enterprise SCIM IdP Evidence: <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/core/mcp/credstore/credstore.go#L48-L55>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/framework/oauth2/tokenexchange.go#L63-L69>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/docs/mcp/auth/token-exchange.mdx#L19-L19>
- Argument and result inspection: partial. OSS Go .so plugin hooks see tool args and results, no validator ships; regex/secrets/LLM/ML guardrails are enterprise Evidence: <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/docs/enterprise/guardrails.mdx#L191-L201>, <https://www.getmaxim.ai/bifrost/pricing>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/core/mcp/pluginpipeline.go#L39-L52>
- Audit of tool calls: partial. Structured MCP tool-call log in OSS; HMAC-signed audit log (enterprise) covers admin events; refusals name permit Evidence: <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/framework/logstore/tables.go#L1971-L2022>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/plugins/logging/main.go#L3792-L3810>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/docs/enterprise/audit-logs.mdx#L9-L11>
- Deployment model: yes. Binary via npx, Docker image, Helm chart (HPA, Postgres, multi-replica); no operator or CRDs; clustering is enterprise Evidence: <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/helm-charts/bifrost/Chart.yaml#L1-L5>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/transports/Dockerfile#L54-L120>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/docs/enterprise/clustering.mdx#L1-L9>
- Tool contract integrity: no evidence at 21e2263. SHA-256 over discovered tools dedups change callbacks; no approved digest checked at tools/call Evidence: <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/core/mcp/utils.go#L29-L45>
- Drift detection: no evidence at 21e2263. Re-lists tools on tools/list_changed and republishes /mcp; no compare-and-refuse/withhold/warn on changed definitions Evidence: <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/core/mcp/toolslistchanged.go#L99-L110>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/transports/bifrost-http/server/server.go#L3872-L3874>
- Pin bound to upstream identity: no evidence at 21e2263. No tool-definition pin found, so no upstream identity bound into one
- Human approval gate: no evidence at 21e2263. No gateway hold or timeout; agent mode returns non-auto tool calls to the app; elicitation is forwarded, not approval Evidence: <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/core/mcp/agent.go#L183-L190>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/docs/mcp/agent-mode.mdx#L25-L25>
- Egress and network enforcement: no evidence at 21e2263. No NetworkPolicy/egress CRD for MCP servers; SSRF guard on outbound URLs; stdio servers run as host subprocesses
- LLM gateway: yes. Multi-provider routing with fallbacks; per-virtual-key budgets, token and request rate limits Evidence: <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/plugins/governance/main.go#L987-L991>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/plugins/governance/store.go#L2278-L2282>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/core/bifrost.go#L5861-L5876>
- Desktop and device MCP inventory: enterprise. Bifrost Edge endpoint agent inventories MCP servers in desktop AI app configs; needs Enterprise with Edge entitlement Evidence: <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/docs/edge/mcp-governance.mdx#L18-L18>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/docs/edge/setup.mdx#L25-L25>
- Sandboxed server runtime and catalog UI: partial. Catalog: MCP library with browse/install UI; runtime: stdio servers as host subprocesses, no sandbox Evidence: <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/transports/bifrost-http/handlers/mcp.go#L109-L112>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/framework/configstore/tables/mcplibrary.go#L9-L24>, <https://github.com/maximhq/bifrost/blob/21e226373d94382a2d6740770828470d25fb0d91/core/mcp/clientmanager.go#L4075>

#### ContextForge

License Apache-2.0. Verified 2026-11-12: IBM/mcp-context-forge at 1f8b9bf0a265649d72b76205f50c9aa1a3d65a34.

- License and open-core boundary: yes. Apache-2.0; no paid or enterprise-gated security features found in repo or docs Evidence: <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/LICENSE#L1-L3>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/pyproject.toml#L59-L60>
- Caller authentication: yes. Gateway JWT, API tokens, SSO (OIDC, Keycloak, Entra, ADFS); OAuth resource server, RFC 9728 PRM, audience check Evidence: <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/transports/streamablehttp_transport.py#L6862-L6925>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/routers/well_known.py#L123-L137>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/auth.py#L1491-L1499>
- Tool scoping: yes. Virtual servers expose a tool subset, enforced at tools/call; tokens scoped to server_id; team visibility Evidence: <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/services/tool_service.py#L5355-L5374>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/middleware/token_scoping.py#L1414-L1421>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/db.py#L4469>
- Upstream credentials: yes. Shared (basic/bearer/headers/client_credentials); per-user OAuth auth-code and Vault creds; RFC 8693 exchange Evidence: <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/services/tool_service.py#L6229-L6290>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/services/token_exchange_actor.py#L1-L16>
- Argument and result inspection: yes. Args and results via tool_pre/post_invoke plugins (regex, lexicon, LLM Guard, Granite); opt-in; schema arg check Evidence: <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/services/tool_service.py#L5876-L5888>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/services/tool_service.py#L7214-L7222>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/docs/docs/manage/configuration-plugins.md#L23>
- Audit of tool calls: partial. Structured logs and tool.invoke spans with caller; plugin decision spans; no hash chain or signatures found Evidence: <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/services/tool_service.py#L5789-L5799>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/plugins/control_telemetry.py#L677-L688>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/config.py#L2418>
- Deployment model: yes. PyPI CLI, container image, docker-compose, Helm chart (2 replicas, HPA, Postgres, Redis); no own operator/CRDs Evidence: <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/Containerfile#L304>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/charts/mcp-stack/values.yaml#L71>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/pyproject.toml#L325>
- Tool contract integrity: no evidence at 1f8b9bf. No digest or pin over tool definitions; refresh compares fields and overwrites them (see drift) Evidence: <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/services/gateway_service.py#L7298-L7314>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/services/gateway_service.py#L7349-L7362>
- Drift detection: partial. list_changed and refresh overwrite changed definitions; CEL description policy re-run on fetch can disable a tool Evidence: <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/services/notification_service.py#L1254-L1261>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/services/gateway_service.py#L7339-L7362>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/services/tool_validation_policy.py#L210-L235>
- Pin bound to upstream identity: no evidence at 1f8b9bf. No tool definition pin found; stored tool rows are keyed by gateway_id and upstream tool name
- Human approval gate: no evidence at 1f8b9bf. No hold-for-approval on tools/call found; MCP elicitation pass-through and SSO signup approval are not this
- Egress and network enforcement: no evidence at 1f8b9bf. No egress enforcement for MCP servers found; Helm NetworkPolicies are ingress rules for Postgres/Redis/PgBouncer/MinIO
- LLM gateway: partial. OpenAI-compatible proxy to OpenAI/Azure/Anthropic/Bedrock/watsonx/Ollama; per-token request limits; no budgets Evidence: <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/routers/llm_proxy_router.py#L43-L60>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/llm_schemas.py#L33-L43>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/middleware/token_scoping.py#L651-L690>
- Desktop and device MCP inventory: no evidence at 1f8b9bf. No scanning of desktop MCP client configs or endpoint agent found
- Sandboxed server runtime and catalog UI: partial. Catalog: entries registered from the admin UI and API; no container or sandbox runtime found Evidence: <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/routers/catalog.py#L84-L88>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcpgateway/config.py#L1326-L1327>, <https://github.com/IBM/mcp-context-forge/blob/1f8b9bf0a265649d72b76205f50c9aa1a3d65a34/mcp-catalog.yml#L24-L26>

#### Obot

License MIT. Verified 2026-11-12: obot-platform/obot at d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1.

- License and open-core boundary: enterprise. MIT; Entra/Okta/OneLogin/JumpCloud/Keycloak/Auth0 SSO need a license key (free registration); >100 users/devices paid Evidence: <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/LICENSE#L1-L3>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/docs/docs/enterprise/overview.md#L15-L35>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/license/entitlements.go#L25-L44>
- Caller authentication: yes. OAuth 2.1 AS: DCR, PKCE, resource param, RFC 9728 metadata, CIMD, private_key_jwt; API keys; OIDC/OAuth SSO providers Evidence: <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/services/config.go#L1145-L1159>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/api/handlers/wellknown/handler.go#L19-L26>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/gateway/server/apikey_auth.go#L38-L64>
- Tool scoping: yes. vMCPs with per-component tool selection; per-user/group profiles grant tool subsets; API keys scoped to MCP server IDs Evidence: <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/mcp/vmcp.go#L189-L194>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/mcp/vmcp.go#L267-L279>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/gateway/server/apikey_auth.go#L99-L106>
- Upstream credentials: yes. Per-user upstream OAuth tokens; shared fixed config or user-supplied values per vMCP policy; no RFC 8693 found Evidence: <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/api/handlers/mcpgateway/handler.go#L345-L356>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/gateway/types/tokens.go#L56-L71>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/apiclient/types/vmcp.go#L10-L14>
- Argument and result inspection: yes. Filters on tools/call args and results: regex/secrets rules, LLM judge, third-party ML services, webhooks Evidence: <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/api/handlers/mcpgateway/handler.go#L475-L505>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/api/handlers/mcpgateway/handler.go#L536>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/docs/docs/functionality/filters.md#L76-L83>
- Audit of tool calls: partial. Structured MCP audit log with per-filter status and reason for blocked calls; no hash chain or signatures found Evidence: <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/gateway/types/mcpauditlog.go#L23-L73>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/gateway/types/mcpauditlog.go#L139-L147>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/api/handlers/mcpgateway/proxy_audit.go#L203-L212>
- Deployment model: yes. Docker image, Helm chart, multi-replica on external PostgreSQL; darwin/linux/windows binaries; no K8s operator Evidence: <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/Dockerfile#L61-L95>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/chart/values.yaml#L1-L3>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/docs/docs/operations/high-availability.md#L7-L9>
- Tool contract integrity: no evidence at d8e5db5. No digest over tool definitions found; stored tool description is marked display-only, live description is served Evidence: <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/apiclient/types/mcpserver.go#L183-L200>
- Drift detection: no evidence at d8e5db5. list_changed refreshes the tool catalog; catalog-entry snapshot digest flags server config updates, not tools Evidence: <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/vmcp/drift.go#L10-L21>
- Pin bound to upstream identity: no evidence at d8e5db5. No tool-definition pin found
- Human approval gate: no evidence at d8e5db5. No gateway hold of tools/call found; built-in Inspector chat client asks the user before each call (client-side) Evidence: <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/docs/docs/mcp-gateway/inspector.md#L81-L84>
- Egress and network enforcement: yes. Helm NetworkPolicy blocks private ranges; per-server domain allowlist resource enforced via Aviatrix; default allow Evidence: <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/chart/templates/networkpolicy.yaml#L1-L58>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/controller/handlers/mcpserver/mcpserver.go#L66-L123>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/docs/docs/configuration/mcp-server-egress-control.md#L52-L58>
- LLM gateway: yes. LLM proxy on Bifrost with provider routing, fallbacks, per-profile budgets on spend, tokens or requests per user Evidence: <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/gateway/server/router.go#L70-L75>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/gateway/server/llmproxy_engine.go#L658-L671>
- Desktop and device MCP inventory: yes. Obot Sentry agent (separate MIT repo) uploads scans of MCP servers, skills, clients; inventory views in server Evidence: <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/api/router/router.go#L620-L623>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/apiclient/types/devicescan.go#L9-L28>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/docs/docs/device-management/inventory.md#L5-L30>
- Sandboxed server runtime and catalog UI: yes. Runtime: Docker containers or K8s pods; catalog with browse UI and API Evidence: <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/mcp/manager.go#L149-L199>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/pkg/api/router/router.go#L163-L169>, <https://github.com/obot-platform/obot/blob/d8e5db5c87dc6f1471349a224d9f3e41bf2b3bb1/ui/user/src/routes/mcp-servers/%2Bpage.svelte#L180-L190>

#### Docker MCP Gateway

License MIT. Verified 2026-11-12: docker/mcp-gateway at 7e0f34277c91855ad861eeff536b4fdc77420593.

- License and open-core boundary: enterprise. MIT; policy evaluation, policy audit and group tool scoping need Docker AI Governance (via sales) Evidence: <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/LICENSE#L1>, <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/policy/policy.go#L103-L116>, <https://docs.docker.com/ai/mcp-catalog-and-toolkit/mcp-gateway/>
- Caller authentication: partial. One static Bearer token (MCP_GATEWAY_AUTH_TOKEN or generated) on SSE/streaming; stdio has none; no OAuth/JWT/SSO Evidence: <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/gateway/auth.go#L34-L87>, <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/gateway/transport.go#L51-L68>, <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/gateway/run.go#L494-L517>
- Tool scoping: partial. Gateway-wide tool lists via --tools, tools.yaml, profiles; no per-caller scoping; Desktop policy can deny tools Evidence: <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/gateway/capabilitites.go#L351-L379>, <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/gateway/configuration_workingset.go#L212-L225>, <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/gateway/configuration.go#L123-L153>
- Upstream credentials: partial. Shared per-server secrets and OAuth tokens (DCR) via Desktop or credential helper; no per-user tokens, no RFC 8693 Evidence: <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/mcp/remote.go#L94-L118>, <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/oauth/credhelper.go#L78-L90>, <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/gateway/clientpool.go#L378-L391>
- Argument and result inspection: yes. Args and text results: regex secret scanner (block-secrets, default on); before/after exec, docker, http interceptors Evidence: <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/interceptors/block_secrets.go#L14-L75>, <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/interceptors/interceptors.go#L21-L145>, <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/gateway/run.go#L313>
- Audit of tool calls: partial. log-calls writes text lines (tool, arg shape, time); structured policy events go to Desktop; no signing or hash chain Evidence: <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/interceptors/log_calls.go#L12-L48>, <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/gateway/policy_audit.go#L18-L30>, <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/policy/audit.go#L35-L80>
- Deployment model: partial. Docker CLI plugin binary, gateway Docker image and dind image, compose examples; no Helm, operator or shared-state HA Evidence: <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/Dockerfile#L128-L134>, <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/examples/minimal-compose/compose.yaml#L1-L7>
- Tool contract integrity: no evidence at 7e0f342. Image digests and signatures verified for mcp/ images; no digest over tool definitions found Evidence: <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/gateway/pull.go#L69-L94>
- Drift detection: no evidence at 7e0f342. tools/list_changed triggers a capability refresh; no comparison to known definitions found Evidence: <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/mcp/mcp_client.go#L34-L38>, <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/gateway/run.go#L559-L603>
- Pin bound to upstream identity: no evidence at 7e0f342. No tool definition pin found
- Human approval gate: no evidence at 7e0f342. No held tools/call pending human approval; MCP elicitation requests are forwarded to the client Evidence: <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/mcp/mcp_client.go#L59-L64>
- Egress and network enforcement: partial. Docker-level: disableNetwork runs --network none; --block-network with allowHosts adds proxy containers; no Kubernetes Evidence: <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/gateway/clientpool.go#L356-L364>, <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/gateway/clientpool.go#L535-L540>, <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/docs/security.md#L96-L99>
- LLM gateway: no evidence at 7e0f342. No LLM provider routing or budgets; OpenAI API is used for find-tools embeddings
- Desktop and device MCP inventory: partial. CLI reads local MCP client configs (Claude, Cursor, Codex, others) on one machine; no fleet inventory or endpoint agent Evidence: <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/client/config.yml#L1-L19>, <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/client/global.go#L95-L111>
- Sandboxed server runtime and catalog UI: partial. Runtime: each server in its own Docker container; catalog CLI in OSS, browse UI in Docker Desktop Evidence: <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/pkg/gateway/clientpool.go#L352-L364>, <https://github.com/docker/mcp-gateway/blob/7e0f34277c91855ad861eeff536b4fdc77420593/cmd/docker-mcp/commands/catalog.go#L18>, <https://docs.docker.com/ai/mcp-catalog-and-toolkit/toolkit/>

#### Microsoft MCP Gateway

License MIT. Verified 2026-11-12: microsoft/mcp-gateway at cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509.

- License and open-core boundary: yes. MIT; no paid or enterprise edition found in the repo or its docs Evidence: <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/LICENSE#L1-L3>
- Caller authentication: yes. Entra ID JWT bearer (resource server); RFC 9728 protected resource metadata; no API keys, no own AS or DCR Evidence: <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Service/src/Program.cs#L97-L118>, <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Service/src/McpSubPathAwareAuthenticationHandler.cs#L139-L154>, <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Service/src/Program.cs#L38-L51>
- Tool scoping: yes. /mcp router: per-tool requiredRoles (Entra roles)/creator/mcp.admin filter list and call; adapters gated per server Evidence: <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Management/src/Authorization/SimplePermissionProvider.cs#L52-L76>, <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Tools/src/Services/StorageToolDefinitionProvider.cs#L149-L163>, <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Tools/src/Services/HttpToolExecutor.cs#L72-L83>
- Upstream credentials: partial. Shared: env vars, one Azure workload identity, Key Vault headers in sample proxy; caller token dropped, id/roles sent Evidence: <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Service/src/HttpProxy.cs#L52-L84>, <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Management/src/Deployment/KubernetesAdapterDeploymentManager.cs#L52-L86>, <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/docs/entra-app-roles.md#L52>
- Argument and result inspection: partial. Args, deterministic: /mcp router checks Mcp-Param-* headers match body per inputSchema; no guardrails or result checks Evidence: <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Tools/src/Services/McpToolHeaderValidator.cs#L15-L19>, <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Tools/src/Services/HttpToolExecutor.cs#L93-L95>, <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Management/src/McpProtocolMiddleware.cs#L141-L158>
- Audit of tool calls: partial. ILogger lines for router tool calls and denials (App Insights on gateway service); not signed; no refusal-explain tool Evidence: <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Tools/src/Services/HttpToolExecutor.cs#L61-L83>, <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Service/src/Program.cs#L26-L27>
- Deployment model: yes. Docker images (ghcr), K8s manifests, Azure Bicep/ARM (AKS, Cosmos); Redis/Cosmos shared store; no Helm or operator Evidence: <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/.github/workflows/image.yml#L42-L46>, <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/deployment/k8s/cloud-deployment-template.yml#L140-L195>, <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/deployment/infra/azure-deployment.bicep#L164>
- Tool contract integrity: no evidence at cf9f5e9. No digest over tool definitions; router serves operator-registered definitions from the store as submitted Evidence: <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Tools/src/Services/StorageToolDefinitionProvider.cs#L127-L147>
- Drift detection: no evidence at cf9f5e9. No definition comparison; adapter tools/list and list_changed pass through; router reads store with 5-minute cache Evidence: <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Tools/src/Services/StorageToolDefinitionProvider.cs#L54-L79>
- Pin bound to upstream identity: no evidence at cf9f5e9. No tool-definition pin exists
- Human approval gate: no evidence at cf9f5e9. No human-in-the-loop hold of tools/call found
- Egress and network enforcement: partial. Static ingress NetworkPolicies in manifests (gateway pods reach adapter/tool pods); no egress rules, none per server Evidence: <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/deployment/k8s/cloud-deployment-template.yml#L197-L249>, <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Management/src/Deployment/KubernetesAdapterDeploymentManager.cs#L60-L119>
- LLM gateway: no evidence at cf9f5e9. No LLM traffic proxy; preview agent runner calls one Azure OpenAI/Foundry deployment as a client
- Desktop and device MCP inventory: no evidence at cf9f5e9. No desktop/device MCP config discovery or endpoint agent found
- Sandboxed server runtime and catalog UI: partial. Runtime: images deployed as K8s StatefulSets; portal registers images by name, no catalog Evidence: <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Service/src/Controllers/ManagementController.cs#L21-L29>, <https://github.com/microsoft/mcp-gateway/blob/cf9f5e9eff89276bc3fc42f0ae4d6109d70e5509/dotnet/Microsoft.McpGateway.Management/src/Deployment/KubernetesAdapterDeploymentManager.cs#L45-L86>

#### Kuadrant MCP Gateway

License Apache-2.0. Verified 2026-11-12: Kuadrant/mcp-gateway at 98a4ccb0450fb93cc35782d40c5e8294d5c34125.

- License and open-core boundary: yes. Apache-2.0; no gated security features found in the repo or its docs Evidence: <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/LICENSE#L1-L2>
- Caller authentication: partial. Serves RFC 9728 protected resource metadata; JWT/OIDC validation is a Kuadrant AuthPolicy from the guides, not shipped Evidence: <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/internal/broker/oauth_protected_resource_handler.go#L83-L109>, <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/internal/jwt/decode.go#L49-L52>, <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/docs/guides/authentication.md#L152-L188>
- Tool scoping: partial. tools/list filtered by signed x-mcp-authorized JWT and MCPVirtualServer; tools/call denial is an AuthPolicy CEL sample Evidence: <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/internal/broker/filtered_tools_handler.go#L107-L137>, <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/docs/design/security-architecture.md#L211>, <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/docs/guides/authorization.md#L74-L81>
- Upstream credentials: yes. Per-user token via URL elicitation (2025-11-25); client token passthrough, shared discovery creds; RFC 8693 by Authorino Evidence: <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/internal/routing/router_202511.go#L708-L720>, <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/api/v1/types.go#L86-L118>, <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/docs/design/security-architecture.md#L110>
- Argument and result inspection: yes. tools/call args and results checked by external NeMo Guardrails (rule or LLM rails); block or modify; fail-closed Evidence: <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/internal/routing/router_202511.go#L192-L196>, <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/internal/guardrails/checker.go#L49-L66>, <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/docs/design/guardrails/guardrails-design.md#L9>
- Audit of tool calls: partial. Structured audit=true log line per tools/call (user, tool, server, status); not signed; AuthPolicy denials not logged Evidence: <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/internal/mcp-router/ext_proc_adapter.go#L546-L557>, <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/docs/guides/auditing.md#L25-L28>
- Deployment model: yes. Docker image, Helm chart, CRDs + controller, OLM via Kuadrant Operator, Redis for multi-replica; standalone binary WIP Evidence: <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/charts/mcp-gateway/Chart.yaml#L1-L6>, <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/api/v1/mcpgatewayextension_types.go#L128-L133>, <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/docs/guides/binary-install.md#L1-L5>
- Tool contract integrity: no evidence at 98a4ccb. No digest or approved pin of tool definitions; last tools/list kept in memory and replaced on refresh Evidence: <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/internal/broker/upstream/manager.go#L1098-L1103>
- Drift detection: partial. Re-fetch and list_changed diff description and schemas; change logged at INFO, new definition served, no refuse or hold Evidence: <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/internal/broker/upstream/manager.go#L597-L632>, <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/internal/broker/upstream/manager.go#L1069-L1103>
- Pin bound to upstream identity: no evidence at 98a4ccb. No tool definition pin exists
- Human approval gate: no evidence at 98a4ccb. No hold-for-approval on tools/call; URL elicitation collects per-user tokens and upstream elicitation is relayed
- Egress and network enforcement: no evidence at 98a4ccb. Routes to MCP servers it does not run; generated NetworkPolicies cover controller and broker pods, egress open Evidence: <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/internal/controller/broker_router.go#L328-L376>
- LLM gateway: no. VISION non-goal: not replacing Envoy AI Gateway or its AI gateway capabilities; rate limits apply to MCP traffic Evidence: <https://github.com/Kuadrant/mcp-gateway/blob/98a4ccb0450fb93cc35782d40c5e8294d5c34125/VISION.md#L23-L25>
- Desktop and device MCP inventory: no evidence at 98a4ccb. No desktop or endpoint MCP config discovery found
- Sandboxed server runtime and catalog UI: no evidence at 98a4ccb. Does not launch MCP servers; discover_tools meta-tool lists registered tools, no install catalog

#### MCP Hangar

License MIT. Verified 2026-11-12: mcp-hangar/mcp-hangar at 0c70812bb5b47163f10caf32af65cf9d80f8ab40 (2.36.6); mcp-hangar/mcp-hangar-operator at 71afc22b1dacef76b03d5ed47bb45be5ac8216dc (operator 0.17.39); mcp-hangar/helm-charts at 8a0ffe7792c886c12f53db869cc734b22bf060af (charts 0.15.60 / 0.12.55).

- License and open-core boundary: yes. MIT (core and operator); HANGAR_LICENSE_KEY is deprecated with no effect; no enterprise directories in either repo Evidence: <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/LICENSE#L1>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/server/bootstrap/__init__.py#L625-L628>, <https://github.com/mcp-hangar/mcp-hangar-operator/blob/71afc22b1dacef76b03d5ed47bb45be5ac8216dc/LICENSE#L1>
- Caller authentication: yes. API keys; JWT via JWKS/OIDC discovery, multi-issuer, aud (RFC 8707); RFC 9728 metadata; resource server, no AS/DCR Evidence: <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/auth/bootstrap.py#L431-L512>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/server/lifecycle.py#L750-L768>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/server/lifecycle.py#L809-L812>
- Tool scoping: yes. allow/deny/approval lists per server, group, member and tenant; RBAC tool:invoke per role; front door lists per tenant Evidence: <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/domain/value_objects/tool_access_policy.py#L1-L22>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/server/tools/batch/__init__.py#L156-L176>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/server/tools/batch/executor.py#L2076-L2104>
- Upstream credentials: partial. Shared: static api_key, bearer or basic per remote server, env for local servers; no per-user OAuth or RFC 8693 found Evidence: <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/infrastructure/launchers/http.py#L150-L170>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/http_client.py#L640-L652>
- Argument and result inspection: partial. Args, deterministic: L7 secret regexes, size limit, tool/header rules; payload_size validator; no result checks found Evidence: <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/domain/model/mcp_server.py#L1868-L1897>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/server/tools/batch/executor.py#L1309-L1336>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/application/services/interceptor_registry.py#L33-L35>
- Audit of tool calls: partial. Structured event store, SIEM export (CEF, LEEF, syslog, JSONL, OTLP); not signed or hash-chained; why explains refusals Evidence: <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/server/bootstrap/event_handlers.py#L170-L203>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/server/cli/services/refusal_log.py#L23-L30>, <https://github.com/mcp-hangar/docs/blob/f1a878d5105bd03328c3b467487cf621902d83ee/operations/COMPLIANCE_POSTURE.md#L69>
- Deployment model: yes. pip CLI, Docker image, Helm charts for core (HPA, PDB, PostgreSQL) and operator (4 CRDs); replicas share a lease Evidence: <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/Dockerfile#L13>, <https://github.com/mcp-hangar/helm-charts/blob/8a0ffe7792c886c12f53db869cc734b22bf060af/mcp-hangar/values.yaml#L193-L200>, <https://github.com/mcp-hangar/mcp-hangar-operator/blob/71afc22b1dacef76b03d5ed47bb45be5ac8216dc/config/crd/bases/mcp-hangar.io_mcpservers.yaml#L3-L10>
- Tool contract integrity: yes. SHA-256 (JCS) of name, description, inputSchema, outputSchema; opt-in pins checked on every tools/call; block default Evidence: <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/domain/services/digest_computation.py#L27-L59>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/server/tools/batch/executor.py#L2160-L2262>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/server/config.py#L1050-L1105>
- Drift detection: yes. list_changed and re-list compare to pins: block withholds and refuses; warn/audit emit event; opt-in new_tools: withhold Evidence: <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/domain/model/mcp_server.py#L1593-L1602>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/application/read_models/tool_projection.py#L877-L908>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/pin_recheck.py#L1-L27>
- Pin bound to upstream identity: yes. Pin bound to upstream: remote origin or TLS key, image ref as written, or stdio command hash; pin --write records it Evidence: <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/domain/model/mcp_server.py#L606-L634>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/domain/services/digest_validator.py#L77-L78>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/server/cli/services/pinning.py#L294-L299>
- Human approval gate: yes. approval_list or L7 requireApproval holds tools/call; refused on timeout; boot refused by default if gate absent Evidence: <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/server/tools/batch/executor.py#L2394-L2413>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/approvals/service.py#L268-L281>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/server/bootstrap/reachability.py#L65-L96>
- Egress and network enforcement: yes. MCPEgressPolicy: NetworkPolicy or Cilium backstop, Vanilla denies hostnames; Audit default; namespace deny opt-in Evidence: <https://github.com/mcp-hangar/mcp-hangar-operator/blob/71afc22b1dacef76b03d5ed47bb45be5ac8216dc/pkg/networkpolicy/builder.go#L148-L189>, <https://github.com/mcp-hangar/mcp-hangar-operator/blob/71afc22b1dacef76b03d5ed47bb45be5ac8216dc/internal/controller/mcpegresspolicy_controller.go#L756-L760>, <https://github.com/mcp-hangar/mcp-hangar-operator/blob/71afc22b1dacef76b03d5ed47bb45be5ac8216dc/api/v1alpha2/mcpegresspolicy_types.go#L22-L32>
- LLM gateway: no, by design. README non-goal: no model routing, provider failover or token budgets; none found in code at 0c70812 Evidence: <https://github.com/mcp-hangar/mcp-hangar/blob/740397fc7c51e5dff733fae5d27a3ace1bca19fc/README.md#L202-L206>
- Desktop and device MCP inventory: partial. mcp-hangar init reads Claude Desktop, Claude Code and Cursor configs on one machine and imports them; no fleet agent Evidence: <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/server/cli/services/mcp_clients.py#L51-L68>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/server/cli/commands/init.py#L321-L347>
- Sandboxed server runtime and catalog UI: partial. Runtime: Docker/Podman (read-only, cap-drop) and operator Deployments; catalog: 4-entry CLI list, no UI Evidence: <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/infrastructure/launchers/factory.py#L84-L101>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/infrastructure/launchers/container.py#L308-L340>, <https://github.com/mcp-hangar/mcp-hangar/blob/0c70812bb5b47163f10caf32af65cf9d80f8ab40/src/mcp_hangar/server/cli/services/mcp_server_registry.py#L124-L158>

Cells: 105. Corrections: https://github.com/mcp-hangar/mcp-hangar-website/issues/new