Most teams facing this problem pick 1 of 4 options. Here is where each 1 actually lands, including the cases where the gateway is the wrong answer.
| Capability | This gateway | Build it yourself | Generic API gateway | Single guardrails vendor |
|---|---|---|---|---|
| Prompt injection and jailbreak filtering | Yes | You build and maintain the ruleset | No | Yes |
| Choice of guardrail provider | Five, concurrently | Whatever you integrate | No | One, theirs |
| Understands MCP as a protocol | tools/list, tools/call, resources | You parse it yourself | No | No |
| Per-tool permissions and rate limits | Yes | Custom per server | Per route only | No |
| Cryptographic agent identity | SPIFFE, DID, X.509 | Rarely worth building | mTLS only | No |
| OAuth 2.1 with Dynamic Client Registration | Yes | Weeks of work | Usually pass-through | No |
| PII redaction with round-trip unmasking | Yes | You build both directions | No | Redaction, often one-way |
| Token accounting and hard budget caps | Per team and per key | You build it | No | No |
| Shadow-AI discovery from live traffic | Yes | No | No | No |
| Tests your own controls against OWASP | 85 cases, 14 categories | No | No | Their controls, not yours |
| Audit evidence for a compliance framework | Structured events | You design the schema | HTTP logs only | Their console |
| Runs entirely on your network | Yes | Yes | Yes | Usually SaaS |
| Your prompts leave your perimeter | Only to your providers | Only to your providers | Only to your providers | To them as well |
| Cost | Free | Engineering time, forever | Licence plus build | Per request |
| Time to something working | About an hour | Quarters | Days, partial coverage | Days |
The right call when your requirements are genuinely unusual, or when the integration is 3 lines of middleware for 1 provider and 1 app.
It stops being the right call at the second protocol. MCP tool scoping, OAuth Dynamic Client Registration, round-trip redaction, and agent identity are each a project. Together they are a team, and they are a team working on something that is not your product.
Excellent at what it was built for: routing, TLS, per-route rate limits, and auth at the edge. If you already run one, keep running it.
It does not read the body as a conversation. It cannot tell a tool call from a completion, score a prompt for injection, mask a customer record on the way out, or notice that an MCP server quietly changed what its tools do. Those are different problems that happen to travel over HTTP.
Often very good at the detection itself, with a research team behind the models and an operations team keeping it up.
The limits are scope and posture. It usually covers content safety rather than identity, tool authorization, budgets, and inventory. It is usually SaaS, so your prompts go to a second party. And it cannot test itself, which is why the gateway can also point its evaluation suite at your provider.
It is a better use of your time to find this out now than 3 weeks in.
If procurement needs a support SLA, a signed contract, and the supplier's own SOC 2 report, this does not clear that bar. It is maintained by 1 person and shipped as-is.
One provider, 1 application, no MCP, no agents, and no team boundaries to enforce. A budget alert on the provider console and a careful code review may be all you actually need.
Self-hosted means you own the process, the upgrades, and the database. If nobody is going to own that, a managed service will serve you better even at a higher price.
An hour in monitor-only mode against 1 proxy will tell you more than any comparison table.
