MCP Gateway options compared: DIY vs hosted
The MCP Authorization specification requires OAuth 2.1, audience-bound tokens and a ban on token passthrough for any MCP server acting as a deputy to a third-party API (modelcontextprotocol.io/specification/2025-06-18/basic/authorization, read 2026-10-23); this page prices what meeting that bar yourself costs in engineering time with Envoy or the FastMCP framework against AdminKit's planned hosted gateway, without benchmarking named enterprise identity vendors.
What the spec actually requires
The MCP Authorization specification’s security considerations describe MCP servers that hold credentials for a third-party API as “deputies,” warning that “attackers can exploit MCP servers acting as intermediaries to third-party APIs, leading to confused deputy vulnerabilities.” Its fix has two concrete parts: servers “MUST only accept tokens specifically intended for themselves” (audience binding), and “MUST NOT pass through the token it received from the MCP client” to an upstream API. AdminKit’s guide to the confused-deputy problem covers both requirements in full with direct spec quotes.
DIY building blocks: what they do and don’t cover
Envoy is a real, CNCF-graduated open-source proxy with JWT validation and RBAC filters, widely used as an API gateway — but per its own homepage, read 2026-10-23, it describes general-purpose proxy capabilities (load balancing, TLS termination, authentication filters), not MCP-specific audience or token-passthrough checks; wiring those up for MCP is configuration and code you write yourself. FastMCP is a framework specifically for building MCP servers, clients and tools — per its own documentation, read 2026-10-23, enterprise-grade access control (SSO, tool-level RBAC) is described as part of a separate product, Horizon, rather than built into the core open-source framework’s documented feature set.
Both are legitimate starting points, and both require real engineering time to reach the spec’s audience-binding and no-passthrough bar: configuring a proxy’s JWT/RBAC filters to understand MCP’s audience claim specifically (Envoy), or adding OAuth enforcement either yourself or via an add-on product (FastMCP).
What AdminKit’s planned gateway is for
AdminKit’s MCP & Agent Gateway is planned to enforce audience-bound token validation and block passthrough centrally, as a hosted proxy in front of your MCP server, so individual deployments don’t each have to configure this from the spec text themselves. It is early access and not live yet — today, the free mcp-check tool can tell you whether your server is reachable and requires authentication, which is a useful starting signal but does not enforce anything on its own.
Trademarks belong to their respective owners; AdminKit is not affiliated.
| Feature | AdminKit | DIY with Envoy | DIY with FastMCP |
|---|---|---|---|
| Open source / self-hosted | — | ✓ | ✓ |
| MCP-aware audience-bound token validation out of the box | Planned — early access | Generic JWT/RBAC filters (own docs) | Not in core docs (own docs) |
| Blocks token passthrough to upstream APIs by default | Planned | — | — |
| Per-tool allowlist and audit log of every call | Planned | — | Via separate Horizon add-on (own docs) |
| Engineering effort to meet the MCP spec's auth requirements | None — hosted, early access | High: configure proxy + MCP-specific checks yourself | Medium–high: core framework plus your own auth, or an add-on |
AdminKit vs DIY with Envoy
Open source / self-hosted
MCP-aware audience-bound token validation out of the box
Blocks token passthrough to upstream APIs by default
Per-tool allowlist and audit log of every call
Engineering effort to meet the MCP spec's auth requirements
AdminKit vs DIY with FastMCP
Open source / self-hosted
MCP-aware audience-bound token validation out of the box
Blocks token passthrough to upstream APIs by default
Per-tool allowlist and audit log of every call
Engineering effort to meet the MCP spec's auth requirements
Frequently asked questions
Does the MCP spec actually require OAuth 2.1 and audience-bound tokens?
Yes. The MCP Authorization specification's security considerations state that MCP servers acting as intermediaries to third-party APIs must validate that an inbound token names them as the intended audience, and must not forward (pass through) a client's token to an upstream API unmodified. AdminKit's guide to the confused-deputy problem covers this in full with direct quotes from the spec.
Can I meet these requirements with Envoy or FastMCP today?
Both are real, open-source options, but neither implements MCP-specific audience validation out of the box per their own documentation. Envoy is a general-purpose proxy with JWT and RBAC filters you configure yourself; FastMCP is a framework for building MCP servers whose own documentation points to a separate enterprise add-on (Horizon) for SSO and tool-level access control rather than describing built-in OAuth enforcement in the core framework.
Is AdminKit's MCP Gateway live today?
No. It is early access / in development, per the product page. Today, AdminKit's free mcp-check tool can tell you whether your MCP server is reachable and requires authentication, but does not enforce anything.
Why doesn't this page compare named enterprise agent-identity vendors?
Because this page can only make a claim about a product if it can cite that product's own page for it, and a fair feature-by-feature benchmark against named enterprise vendors would need that level of sourcing for each one. Comparing against the two most common DIY building blocks (Envoy, FastMCP) instead keeps every claim traceable to a cited source.
Want AdminKit to watch this for you?
Free checks tell you the state today. Protective DNS and monitoring tell you when it changes.