The reference benchmark for MCP gateways.

mcp-gateway-bench replays a fixed corpus of MCP calls through each gateway behind a shared upstream, giving you reproducible, apples-to-apples evidence of what actually enforces identity, policy, and logging.

View the results View on GitHub Request Demo

Composite floor score and MUST vetoes by gateway — Composite scores cluster from 76.6 to 85.0. The auth model, proxy pattern, and hosting requirements are the real selection axes.

Why we built it

A protocol is not a product.

MCP is the consensus interface between AI agents and enterprise tools — but it says nothing about who can call which tool, who's audited, or how to manage hundreds of MCP servers. The gateway tier is a noisy market: OSS, closed-source SaaS, and "LLM gateways" that confusingly claim MCP support. Buyers had no apples-to-apples way to compare them.

Results

Latency varies more than the scoreboard does.

agentgateway is essentially transparent — it matches the direct-upstream baseline. Lunar MCPX and Brutor are close behind. Lens Nexus adds a moderate hop. Obot's per-server Kubernetes sidecar adds roughly 340 ms of cluster networking overhead.

p50 and p95 latency per gateway — Eight-case baseline corpus, client-side wall-clock per callTool. Direct-upstream baseline as the dashed reference line.

Per-gateway capability coverage matrix — Tier 2 — argument-level policy, response redaction, tool-poisoning sanitization — is empty across the board.

Selection framework

Match the gateway to your org, not the leaderboard.

Five candidates cluster in a 10-point band on composite score, so ranking by number doesn't drive the decision. Deployment shape — auth pattern, proxy style, hosting model, OSS vs commercial — does.

Decision framework matching organizational context to gateway choice

01
If External IdP issuing JWTs, OSS-only constraint, audit handled by adjacent infra (OPA sidecar, service mesh)
→ agentgateway
OSS Apache 2.0 · pure-proxy · Pattern B · ~3 ms p50
02
If Default tool-level policy enforcement out of the box, single-host deployment acceptable
→ Lunar MCPX
OSS MIT · aggregator · Pattern A · captures call args in audit
03
If Kubernetes-native, need the richest audit row, can accept the per-server sidecar latency tax
→ Obot
OSS Apache 2.0 · pure-proxy · Pattern A · Helm-deployed
04
If Need Pattern A and Pattern B simultaneously, application-level tenancy (users / org_members / projects), closed-source acceptable
→ Lens Nexus
closed-source · Pattern A + B · passive recovery · mitigate AUTH-19 audience gap
05
If Need Pattern A with first-class multi-tenancy, in-gateway rate limiting, and auto-recovery from upstream restarts, closed-source acceptable
→ Brutor
closed-source · per-server Pattern A · fewest MUST vetoes · add shim for outbound Accept header

For teams

Want to run this benchmark inside your own environment?

We help enterprise teams evaluate, deploy, and operate MCP gateways — matched to your auth model, audit needs, and latency budget. Tell us about your setup.