MCP gateway RFP checklist: How enterprises evaluate vendors

TL;DR: Start your MCP gateway comparison with credential flow architecture and policy enforcement depth, not connector counts or pricing. Evaluate vendors on credential isolation, policy-as-code enforcement, compliance certifications, observability, exit strategy, total cost of ownership in engineer-weeks, and trigger/event support, and demand proof for each: data flow diagrams, SOC 2 Type II and ISO/IEC 27001:2022 certificates with stated audit scope, audit log samples including denied calls, and a documented exit path. Composio enforces credential isolation with AES-256 encryption and evaluates policy in the request path before the model.

An MCP gateway sits between your AI agents and every external app they touch. It is action infrastructure: the layer through which agents read, write, and trigger across 1,000+ enterprise tools at scale, not just a credential broker or an auth proxy. That layer also centralizes authentication, enforces access control, and records every action and denied action in one audit trail.

Composio gives your agents access to 50,000+ tools without adding a single one to your context window, keeping the context free for work rather than filled with endpoint documentation. Choosing one is an architecture decision that determines what your team maintains, what your security reviewers accept, and what your enterprise customers can verify. This guide gives you the evaluation dimensions, the specific questions to ask, and the documentation to demand before you sign.

Across 1M+ connected accounts and 300M+ tool calls per month, that infrastructure functions as one governed path to act: a single layer where credentials are resolved, policies are enforced, and every action is logged before it reaches any external system.

Key criteria for your MCP gateway comparison

Before the first demo, define the seven dimensions your MCP gateway vendor evaluation will score. Each maps to a question your CTO, CFO, or security reviewer will ask, and each has a documentation artifact that proves or disproves the vendor's claim.

1. Credential isolation: Where the vendor stores tokens, how the vendor encrypts them, and whether the vendor isolates them from the LLM context or your application code.

2. Policy enforcement: Whether the gateway evaluates access restrictions in the request path as code or leaves them to prompt instructions the model can reason around.

3. Compliance scope: Whether the vendor's certifications cover the gateway's credential handling and request path, not just the vendor's corporate systems.

4. Observability: Whether the vendor's audit log records denied calls, supports export, and gives you a complete chain of custody.

5. Exit strategy: Whether you can export credentials, logs, and configuration without proprietary formats creating lock-in.

6. Total cost of ownership: Subscription fee plus the engineering hours for OAuth maintenance, upstream API changes, and exit migration.

7. Trigger/event support: Whether the gateway supports inbound triggers and webhooks for event-driven agent workflows, and whether trigger coverage is consistent across connectors or varies by app.

Criteria for secure vendor oversight

Secure vendor oversight starts with architecture transparency, not marketing claims. The MCP specification defines a client-server architecture where a host application manages multiple clients, each with a 1:1 relationship to a particular server. A gateway collapses that sprawl into a centralized pattern, acting as a reverse proxy that connects multiple MCP servers and clients through one hub, and can even wrap legacy REST APIs as virtual MCP servers with authentication handled at the gateway layer.

That centralization is exactly why the evaluation matters: you are not buying a feature list, you are inheriting a security boundary and a maintenance obligation. The table below separates local dev tooling from enterprise control planes across the criteria that survive a security review.

Docker's MCP Gateway ships as part of Docker Desktop's MCP Toolkit and runs MCP servers as isolated containers with a local gateway handling server lifecycle, credential injection, and routing. This is a genuine strength for local development. For production agents serving enterprise customers, Composio provides vault-layer isolation with centralized audit logging and SOC 2 Type II and ISO/IEC 27001:2022 certifications your security reviewer can verify before signing.

Kong brings real API gateway heritage, letting you turn REST APIs into MCP servers and attach plugins for auth, rate limiting, and logging, and Composio covers the same routing need while adding a managed credential vault and policy evaluation before the model is involved. Speakeasy's gateway lets you generate MCP servers or connect existing ones with routing, authentication, and logging through a dashboard, and Composio pairs that connectivity with 1,000+ pre-built connectors so your team configures rather than generates.

Evaluating MCP gateway build vs. buy

One detailed cost breakdown puts a production-grade integration with a major SaaS platform at 94 to 186 engineering hours for the initial build, plus 25 to 50 hours a year in maintenance for that integration alone; a three-integration stack runs 83 to 137 hours per year combined. WorkOS estimates the total first-year cost of one OAuth integration at approximately $48,000 across build, maintenance, and customer success. A separate analysis from UX Continuum found that by year three, cumulative maintenance cost often exceeds the original build cost.

If you are building a single-integration product with no compliance requirements, building in-house can be the right call, and we say that directly. The buy trigger is a multi-integration, compliance-sensitive environment where every engineer-hour on auth is an hour not on product.

Mapping credential flows for secure vendor selection

Credential flow is the first thing your security reviewer will diagram, so make it the first thing you audit. Any vendor you are seriously choosing for an MCP gateway should produce a data flow diagram on request, not after a signed NDA and three follow-up calls.

Credential isolation and storage audit

Ask these questions in writing and require written answers:

• Where does the vendor store credentials, and does the vendor encrypt them at rest? With what algorithm?

• Does the vendor isolate credentials from the LLM context and from your application code?

• Can the vendor show you the data flow diagram for a single tool call, including where decryption happens?

• Who handles token refresh, and what happens when a refresh token expires?

Composio stores OAuth access and refresh tokens at rest with AES-256 encryption; the full key management architecture, including key management and envelope encryption details, is documented on the Composio blog for reviewers who need implementation-level detail. During execution, Composio decrypts the credential inside an isolated runtime that exists only for that call: the application never receives the token, the API never returns it, and the model never has it in context. Composio built that isolation into how the system works, not as a setting someone has to remember to switch on. Composio also handles token refresh automatically; the per-user OAuth documentation covers the full failure-state behavior including how connection status is managed when refresh attempts do not succeed. The failure mode you test for: a 2 a.m. broken OAuth flow pulling a senior engineer off roadmap work.

Required vendor security documentation

Your procurement requirements should include five artifacts before a pilot: a data flow diagram, encryption documentation, a subprocessor list, an incident response policy, and a penetration test summary. Composio's compliance and data handling guide documents retention and model training posture in the same place.

Verifying connector coverage and task logic

Connector count is the most abused number in this category. A gateway claiming 500 integrations with one generic passthrough endpoint per service gives your agent less real capability than 100 integrations with deep action coverage.

Defining connector read and write depth

Ask whether the vendor provides specific actions per connector or a generic endpoint, and whether the agent can read, write, and delete within scope. Composio ships 1,000+ managed app integrations covering the specific operations agents need in production, with 50,000+ tools in reach and zero in your context window, so the context stays free for work rather than filled with endpoint documentation. You can verify depth per connector before a call: the NetHunt CRM MCP integration for Mastra AI, the Nutshell integration for LlamaIndex, the Mixmax integration for LangChain, and the Paperform integration for OpenAI Agents SDK each document the exact actions each integration provides per framework.

Vendor responsibility for API changes

This is the failure mode question most evaluations skip: when an upstream API changes its authentication model or deprecates an endpoint, who fixes it, and under what SLA? With in-house OAuth, every upstream change lands directly on your engineering team's calendar. Composio's managed OAuth layer absorbs those changes, and the toolkits changelog API gives you a programmatic view of connector updates so your team sees changes as data rather than as broken production calls.

Verifying compliance for MCP gateway vendors

Compliance certifications only mean something when the audit scope covers the gateway's credential handling and request path. A SOC 2 report scoped to corporate IT systems tells you nothing about how the vendor manages your customers' tokens.

Assessing SOC 2 Type II and ISO 27001 audit scopes

Teach your team the verification procedure. Request the report and confirm a CPA-registered firm issued it, validate the auditor's credentials, and examine the controls the auditor actually tested. Pay attention to the auditor's opinion: an unqualified opinion means controls operated effectively during the review period, while a qualified opinion flags exceptions that warrant scrutiny.

Confirm the report's stated scope aligns with your use case of the vendor's services, and that it assesses both design and operating effectiveness over time under the AICPA Trust Services Criteria. For ISO/IEC 27001:2022, ask whether the vendor holds a current certificate, what the stated scope covers, and whether the vendor will provide the certificate itself. Composio holds both certifications and publishes them through our trust center, so your security reviewer works from documents rather than assurances.

Ready-to-sign security documentation

The procurement requirements beyond certifications: pre-filled SOC 2 and ISO 27001 artifacts, insurance certificates, DPA, MSA, and SLA. Composio's pre-filled compliance packs cover common frameworks, and most enterprise security questionnaires come back within a day because Composio assembles the evidence before the question arrives. If a vendor's answer to "can we see the pen test summary" is "after you sign," that is your answer.

Audit log requirements for MCP gateways

Ask whether the vendor's audit log records denied calls or only successful ones, whether you can export logs, and what the retention period is. Logs that record denied calls, not just successful ones, become compliance evidence rather than activity summaries. Composio's centralized audit logging records every tool call with user, team, tool, action, and outcome, and the logs API reference documents how to query them programmatically, including retrieving log details by ID and searching tool execution logs. Our dashboard log storage guide covers retention behavior.

Evaluating self-hosted vs. managed gateways

Some teams require EU managed cloud without self-hosting for data residency compliance. Composio offers self-hosting at the Enterprise tier, and where a team requires EU managed cloud without self-hosting, Composio is not the right fit. Composio states that directly rather than leaving teams to discover it in week three of a pilot.

Self-hosted vs. managed gateway tradeoffs

Quantifying ongoing maintenance costs

Ask what maintenance looks like after go-live: who applies security patches, who monitors for API changes, and who owns token refresh debugging. With a managed gateway, the vendor owns those answers. With self-hosting, your team does, and that answer needs a headcount line in your capacity plan, not just a line in the RFP.

Tracing requests and debugging live workflows

A gateway that cannot show you what happened in production is a liability at exactly the moment you need it most: when a customer reports an agent took an unexpected action.

Tracing and debugging request flows

Ask whether you can trace a request from agent invocation to tool call to response, and what debugging tooling ships with the platform. Composio's observability documentation covers centralized logging with user, team, tool, action, and outcome for every call, and the tool execution logs guide walks through filtering and inspection. Ask for API access to observability data so you can pipe gateway telemetry into your existing monitoring stack: per-call request tracing, denied-call logging with threshold alerts, and log export through API rather than manual downloads. Denied-call alerting matters because a spike in denied actions often signals a prompt injection attempt or a misconfigured policy, and you want that signal in your monitoring stack, not in a weekly log review.

Enforcing granular access and policy controls

This is the criterion where most MCP gateway selection criteria lists go soft. The question is not whether a vendor "supports guardrails." The question is where the vendor enforces the restriction.

Securing actions: Gateways vs. prompts

A prompt instruction and a policy-as-code control look identical until a user tries to override one. The prompt bends; the policy does not. Policy-as-code means the gateway evaluates access control rules in the request path before any tool executes, as distinct from soft guardrails expressed in system prompts that the model can reason around. When the restriction lives in the request path, the policy evaluator runs before the model receives the tool call response and does not parse prompt content.

Comparing automated security enforcement

Ask whether an admin can disable specific actions (delete, for example) for specific users or roles, and whether the gateway enforces that restriction in the request path or leaves it to the model. On Composio, policy-as-code validation evaluates whether the calling identity has permission under the current role and scope configuration, and only then does Proxy Execute decrypt the credential inside an isolated runtime and inject it into the outbound request. When an admin disables the delete action for a Slack integration, the agent cannot delete regardless of what the prompt says or what a user tries to inject.

How to audit request path controls

Ask the vendor to demonstrate the request path evaluation live, then test it yourself during the pilot: configure a deny policy, attempt the action through the agent, and confirm the denial appears in the audit log. A vendor that cannot demonstrate enforcement in a sandbox cannot credibly claim enforcement in production. Composio's security and compliance walkthrough shows how Composio presents this architecture to security reviewers.

Evaluating MCP gateway exit and migration strategies

Vendor lock-in risk is easiest to assess before you sign and hardest to fix after. Make the exit conversation part of the RFP, not a renewal-year surprise.

Audit requirements for data export

Ask whether you can export your credentials, audit logs, and configuration, in what format, and through what process. A vendor that exports logs only through a support ticket with a two-week turnaround is telling you something about how the relationship ends.

Exit plan requirements for MCP vendors

Ask about the contractual exit process, how long data export takes, and what happens to credentials after termination. Composio documents its limitations honestly and does not create lock-in through proprietary formats: your agent logic stays in your framework, and your audit history stays retrievable through the logs API rather than trapped in a console.

Hidden costs in MCP gateway vendor selection

The subscription fee is the smallest number in the decision. The real cost model has four components, and three of them are measured in engineering hours.

Evaluating MCP gateway pricing models

Ask whether pricing runs per tool call, per seat, or per connector, what overage charges look like, and whether hard caps exist. Composio's pricing starts with a free tier of 100K tool calls per month, hard-capped so there is no surprise bill, with Pro at $29 per month including usage credit that resets monthly. Confirm current tier limits on the pricing page during your evaluation, since tiers have been restructured over time. Composio holds a 4.9 out of 5 rating on G2 across verified reviews.

Quantifying in-house engineering hours

A case study with 11x documents approximately 380 engineering hours saved and $4.2M in enterprise deals closed after deploying Composio for Outlook, Salesforce, and Cal.com integrations. Those are the deals that were previously stalled on missing integrations. That is the build-vs-buy case in the unit your CFO needs: recovered sprint capacity, not a projected ROI multiplier.

Quantifying long term maintenance costs

At 25 to 50 maintenance hours per integration per year, a multi-integration roadmap accumulates hundreds of engineering hours annually across even a modest connector set, which represents substantial senior engineer time spent on plumbing that does not differentiate your product.

Identifying overlooked integration expenses

The costs that never appear in the vendor comparison spreadsheet: security questionnaire response time, audit log reconstruction during an enterprise review, credential enumeration when an engineer offboards, and token refresh debugging at 2 a.m. Composio's centralized vault makes credential enumeration straightforward during offboarding because all credentials live in one governed location rather than scattered across developer environments and CI/CD secrets.

Beyond the auth and governance layer, Composio's self-learning layer distills patterns from 300M+ monthly tool calls, making repeat tool calls 30% more accurate. In the build-vs-buy conversation, that compounds the engineering-hour argument: the managed layer gets more accurate without a sprint allocation, where an in-house build stays exactly as accurate as the last engineer who touched it.

Book a call to walk through your security requirements before the next enterprise review.

FAQs

What is the most important criterion when choosing an MCP gateway?

Credential isolation architecture. Verify where the vendor stores credentials, how the vendor encrypts them (strong encryption standards such as AES-256), and whether the vendor isolates them from LLM context and application code, because this criterion determines whether the gateway survives a security review.

How do I compare MCP gateway vendors objectively?

Use a criteria-based scorecard covering credential isolation, policy enforcement, compliance certifications, observability, exit strategy, total cost of ownership, and trigger/event support. Score each vendor on documented evidence such as data flow diagrams and audit reports, not marketing claims.

What compliance certifications should an MCP gateway have?

SOC 2 Type II and ISO/IEC 27001:2022 are certifications enterprise reviewers commonly require. Verify the vendor's audit scope covers the gateway's credential handling and request path, not just the vendor's corporate systems, and check for an unqualified auditor opinion.

How do I assess vendor lock-in risk for MCP gateways?

Ask about data export formats, exit processes, and compatibility with your agent framework. A vendor that cannot document a clean exit path, or that exports logs only through support tickets, creates lock-in risk.

What documentation should vendors provide during evaluation?

Request a data flow diagram, encryption documentation, a subprocessor list, an incident response policy, a penetration test summary, compliance certificates, and pre-filled security questionnaire responses before the pilot starts.

Key terms glossary

Credential isolation: Architecture where the vendor stores API tokens separately from application code and LLM context, and resolves them only inside an isolated runtime during tool execution.

Policy-as-code: Access restrictions that an administrator defines and the gateway evaluates in the request path as code, before the model participates in any decision.

Request path: The sequence of steps a tool call takes from agent invocation to external API response, including where the gateway evaluates policies and resolves credentials.

Token lifecycle: The full span of an OAuth token from issuance through refresh to revocation, including consent, storage, and scope management.

Audit trail: A complete log of every tool call including denied actions, providing chain of custody for compliance evidence.

SOC 2 Type II: An audit certification verifying that an auditor tested a vendor's security controls for both design and operating effectiveness over a period of time.

ISO/IEC 27001:2022: An international standard certifying that an auditor verified a vendor maintains a documented information security management system.

Build vs. buy: A decision framework comparing the engineering hours and maintenance burden of building infrastructure in-house against vendor cost.

Vendor lock-in: The degree to which a customer cannot migrate away from a vendor without significant cost, data loss, or rework.

MCP gateway: A managed layer between AI agents and external apps that handles credential resolution, OAuth management, and policy enforcement.