MCP governance tools decide which Model Context Protocol servers, tools and models a team’s agents may use, and they record what those agents called. Gateways do it on the network path, and coding tools do it in the client’s managed settings. A third group of MCP servers governs the content they serve. Trail, the memory and context layer for enterprise AI agents, is one of those: agents read approved, cited rules from it over MCP.

What is MCP governance?

It is the set of controls a company puts around MCP. They decide which servers may run, which tools an agent may call and who may call them. They also cover which models sit behind the agents and where each call is logged. The protocol itself supplies only part of this.

The specification answers who may call a server with OAuth, and makes it optional. “Authorization is OPTIONAL for MCP implementations,” says the 2026-07-28 version modelcontextprotocol.io. When an HTTP server uses it, “A protected MCP server acts as an OAuth 2.1 resource server”. Such a server must check that each token was issued for it, and it “MUST NOT accept or transit any other tokens”. The security guidance calls token passthrough “explicitly forbidden in the authorization specification” modelcontextprotocol.io. The spec tells local servers over STDIO not to follow it and to read credentials from the environment instead.

The official MCP Registry does not approve anything for you. It is “currently in preview”, it “does not support private servers”, and its metadata is “deliberately unopinionated” modelcontextprotocol.io. For internal servers it says “we recommend that you host your own private MCP registry”. An enterprise allow-list, per-team scope and audit log therefore need a registry, gateway or client policy of your own. Trail’s MCP server explainer covers the protocol itself.

How do 12 MCP governance tools compare?

They split by where the control runs: on a gateway every call passes through, inside the AI client, or in the server that answers.

Twelve MCP governance tools, from each vendor's own pages
ToolKindServer and tool allow-listModel policyPer-team scopeLogsWhat to check
Trail Governed MCP server for business rulesNot a gateway; agents read approved rules from its MCP serverNone; Trail does not route model trafficRole-based access to rulesFull read and approval audit logDoes not decide which servers or models a team may use; paid plans from $20k a yeartrailhq.com
Kong AI Gateway API and AI gatewayACLs on MCP tools at a default level and per toolModel access and token budgets scoped by team through consumer groupsConsumer groups, mapped from OAuth token claimsAI audit logs; every allowed or denied attempt recordedMCP Proxy and MCP OAuth2 plugins are AI Gateway Enterprise onlydeveloper.konghq.com
AWS AgentCore Gateway Managed agent gatewayCedar policies checked before each tool call; Agent Registry with an approval workflowRoutes inference across several model providersPolicies match the principal, the tool and its inputsAuthentication events, tool invocations and access patterns via AgentCore ObservabilityPolicy covers only traffic through AgentCore Gatewaysdocs.aws.amazon.com
Microsoft API gateway and agent platformAzure API Management exposes and governs MCP servers; Copilot Studio data policies block connectors and their MCP toolsThe API Management AI gateway manages model APIs from several providers; no model allow-list on the MCP pages (checked 2026-10-30)Copilot Studio data policies apply per environmentAzure Monitor for gateway activityAPI Management policies apply to every tool in a server at oncelearn.microsoft.com
Cloudflare MCP server portals Zero Trust portalCurated tools per portal; a server shows only to users who match an Allow policyNot part of MCP server portals; no model allow-list found (checked 2026-10-30)Per portal and per Access policyAccess logs each tool request; Logpush export on Enterprise plansBlocked users can reach a server by its direct URL unless Access is its OAuth providerdevelopers.cloudflare.com
Docker Catalog, toolkit and gatewayCustom catalogs of approved servers; Cedar MCP access policies for Docker SandboxesNot found on its pages (checked 2026-10-30)Organization policiesLogging and call tracing in the MCP Gateway; governance audit records you can exportOrganization governance is a separate paid subscription; direct connections from a sandbox are outside MCP policydocs.docker.com
GitHub Copilot Coding assistant policiesAllowlist and denylist in managed-settings.json, matched by name, URL or commandOwners turn models on or off for Business and Enterprise seatsPer organization, or per enterprise team with server-managed settingsEnterprise audit log of Copilot settings and agent activity, kept 180 daysThe custom-registry method can be bypassed by editing config filesdocs.github.com
Claude Code Coding agent managed settingsmanaged-mcp.json for a fixed set, or allowedMcpServers and deniedMcpServersavailableModels and deniedModelsPer identity-provider group through a self-hosted Claude apps gateway; the claude.ai console sets one policy for allOpenTelemetry export can record the MCP servers and tools usedCovers Claude Code; claude.ai connectors are added by organization ownerscode.claude.com
Cursor Coding agent admin (Enterprise)MCP allowlist, with tool controls and network policy per serverTeam baseline, with more models for Organization GroupsTeam, plus groups for modelsEnterprise audit logs of sign-ins and admin actions, with SIEM streamingGroup settings can only widen model accesscursor.com
Mintive (formerly MintMCP) MCP and LLM gatewayApproved servers in role-based bundles; tool-level switchesAllowed models and budgets for each teamPer team and role; groups come from SSOAudit log export to a SIEM or over OTLP, per its homepagePricing by quote only; group-based policies need SSOmintive.com
Obot Open source MCP and LLM gatewayServer and tool access by user or identity-provider group; request filtersModel Access Policies per userUser or identity-provider groupMCP and LLM requests and responses, token use and estimated costSelf-hosted or Obot Cloud; we did not compare its editionsdocs.obot.ai
Runlayer MCP and LLM control planeAccess rules for a whole server or for specific toolsLLM calls pass the same gateway; no model allow-list found (checked 2026-10-30)Rules per user, SSO group, role or agent accountAudit log of tool calls, policy changes and approvalsNo price on the pages we readdocs.runlayer.com

Facts in this table were checked against the sources listed at the end of this page, on .

Which tools set per-team policies on which AI models and MCP servers are allowed?

GitHub Copilot, Cursor Enterprise, Kong, Mintive and Obot set both model and MCP server policies below the company level. Claude Code does the same per identity-provider group when a self-hosted gateway delivers its settings, and AWS scopes tool access by principal.

GitHub Copilot has a policy that “defines whether MCP servers can run at all across Copilot clients” docs.github.com. Owners can “enable or disable access to AI models for members with a Copilot Enterprise or Copilot Business seat” docs.github.com. For the registry policy, GitHub says “if your teams have different needs, you should configure separate policies for each organization” docs.github.com. With a server-managed settings file, enterprise teams can also override keys such as model, allowedMcpServers and deniedMcpServers docs.github.com.

Cursor sets a team baseline for models and an MCP allowlist on Enterprise plans. Organization Groups can add models for a cohort, and “Groups are for widening access, not tightening it below an allow from the team or another group” cursor.com. Cursor advises putting the strictest defaults on the team.

Mintive, formerly MintMCP, covers both lists in one product. “The LLM gateway sets allowed models and budgets for each team,” it says. Admins “Approve the servers your team can use and shut the rest down, then group them into role-based bundles” mintive.com. Its docs add that “Separate policies let teams run with their own budgets and model restrictions”, with groups taken from SSO mintive.com. Obot is open source. Admins can “Control server and tool access by user or identity-provider group” and “Restrict the models visible and callable by each user through Model Access Policies” docs.obot.ai.

Which gateways put a policy on every MCP call?

Kong, AWS, Microsoft, Cloudflare and Docker all sit between the client and the server. They differ in how fine the policy gets and in what traffic they can see.

Kong AI Gateway

Kong lets you “Define a single endpoint for any traffic type: LLM, MCP, or A2A” developer.konghq.com. Its AI MCP Proxy plugin sets ACLs “at both the default level (applying to all tools) and per-tool level (for fine-grained exceptions)”. developer.konghq.com The MCP OAuth2 plugin checks that tokens “are issued specifically for the target MCP server”, as the spec requires, and maps token claims to consumer groups developer.konghq.com. For models, consumer groups “Scope model access and token budgets by team or department” developer.konghq.com. Both MCP plugins are “only available as part of our AI Gateway Enterprise offering”.

AWS AgentCore Gateway

AgentCore Gateway fronts tools, other agents and models, and “routes inference requests across multiple model providers through a unified, model-based routing endpoint” docs.aws.amazon.com. AgentCore Policy “evaluates each request against defined policies in the policy engine before allowing tool access”, and “Policies are constructed using Cedar language” docs.aws.amazon.com. Its Agent Registry adds “an approval workflow” for MCP servers docs.aws.amazon.com.

Azure API Management and Copilot Studio

Azure API Management “provides centralized control over MCP server authentication, authorization, and monitoring”. It turns REST APIs into MCP servers or fronts existing remote ones, with rate limits, JWT checks and IP filtering learn.microsoft.com. Tool-level control is coarse: “Currently, policies apply to all API operations exposed as tools in the MCP server.” In Copilot Studio, data policies attach to environments, and “Blocking Power Platform connectors also blocks access to tools in connected MCP servers” learn.microsoft.com. Agent 365, licensed per user, controls which “tools or MCP servers agents can use” microsoft.com.

Cloudflare MCP server portals

An MCP server portal “centralizes multiple Model Context Protocol (MCP) servers” onto one endpoint behind Cloudflare Access. Admins pick the tools and prompts each portal exposes, and a server appears only “for users who match an Allow policy”. Cloudflare warns: “Blocked users can still connect to the server (and bypass your Access policies) by using its direct URL.” Its fix is to make Access the server’s OAuth provider developers.cloudflare.com.

Docker

In Docker’s MCP Catalog, “Organizations can create custom catalogs with approved servers for their teams” docs.docker.com. The open source MCP Gateway runs each server in a container and “includes built-in logging and call-tracing capabilities” docs.docker.com. For Docker Sandboxes, “MCP policies are organization policies written in Cedar”. Direct connections stay outside them: “They don’t govern an MCP server that an agent or MCP client configures and connects to directly from inside the sandbox” docs.docker.com.

Which products govern MCP across several AI clients?

Mintive, Obot and Runlayer sell one control plane for MCP servers and model traffic across clients such as Claude, ChatGPT and Cursor. They overlap with the gateways.

Mintive adds “Tool-level switches” that “turn off destructive actions” and can “Export the audit log to your SIEM or stream it via OTLP” mintive.com. Its homepage lists “SOC 2 Type II audited”; ask for the report before relying on it, as covered in agent governance platforms with SOC 2 and ISO controls. Obot can “Inspect, reject, or modify MCP requests and responses with MCP or webhook filters” docs.obot.ai. It can run “in your own cloud or on-prem” obot.ai. Runlayer says it can “Govern every MCP and LLM call through one gateway”. It can also “require human approval for anything risky” and “Continuously discover shadow AI activity across every endpoint, client, and agent” runlayer.com. Its docs add access rules per SSO group docs.runlayer.com. When to pause an agent for a person is covered in human in the loop for AI agents.

How do coding tools restrict MCP servers and models?

GitHub Copilot, Claude Code and Cursor enforce allow-lists inside the client through managed settings, which covers developers but not agents that run elsewhere.

GitHub recommends its managed settings file over a custom registry. Registry matching is “based on name or ID only”, and “Users can bypass the restriction by editing configuration files” docs.github.com. The organization policy “does not control access and permissions for the GitHub MCP server in third-party host applications (like Cursor, Windsurf or Claude)” docs.github.com.

Claude Code starts open: “By default, anyone running Claude Code can connect any MCP server they choose.” Admins can restrict servers “from deploying a fixed approved set to disabling MCP entirely”. With OpenTelemetry export, “Claude Code can record which MCP servers and tools users invoke” code.claude.com. The availableModels and deniedModels settings restrict which models people can pick code.claude.com. The claude.ai console “can’t target a group yet”, but “a self-hosted Claude apps gateway delivers managed settings per IdP group” code.claude.com. On claude.ai Team and Enterprise plans, owners add custom connectors and members connect them one by one support.claude.com.

How do you govern MCP servers in an enterprise?

Keep one approved list, enforce it on a gateway and in each client, and log every call. Then close the bypasses the vendors document. The order is ours.

Seven steps to govern MCP servers, and where each is enforced

Step list
  1. Find what already runsInventory the servers in client configs and on endpoints. Claude Code can export the servers used, and Runlayer sells shadow-AI discovery.
  2. Keep one approved listUse a private registry, a Docker custom catalog or AWS Agent Registry. The public MCP Registry holds no private servers.
  3. Require OAuth on remote serversServers must check that each token was issued for them. Kong's MCP OAuth2 plugin checks this at the gateway.
  4. Scope by teamMap identity-provider groups to server and model lists, using the per-team scope column in the table.
  5. Set tool-level rulesTurn off destructive tools and require approval for risky calls. Azure API Management applies one policy to every tool in a server.
  6. Log every call to your SIEMRecord who called which tool on which server, and stream it to your SIEM.
  7. Close the bypassesPair the gateway with client allow-lists. A direct URL (Cloudflare), an edited config file (GitHub) or a direct sandbox connection (Docker) skips one layer.

For guardrails beyond MCP, such as checks on model input and output, see AI agent guardrails. Governance software that inventories models and agents for risk teams is compared in AI governance tools.

What Trail adds behind an MCP gateway

Trail is an MCP server, so a gateway governs it like any other. It is not a gateway or registry and does not decide which MCP servers or models a team may use. Use a gateway or client policy for that job.

Trail governs the content an agent receives. Agents reach the Rule Engine through “a native Model Context Protocol server, native retrievers, or plain REST and GraphQL”. Each rule carries “A named approver, with a timestamp”. “Every read, approval and version is logged, so what an agent applied on a given day can be reconstructed” trailhq.com. A query over MCP returns “a short, ordered set of rules”, each cited to its source and scored trailhq.com. MCP access is on every plan, and paid plans start at $20k a year trailhq.com. Trail’s post on how to build an MCP server in four passes covers the server side.

Which MCP governance claims could we not confirm?

  • Prices for Kong AI Gateway Enterprise, Cursor Enterprise, Docker’s organization governance and Runlayer; Mintive offers quotes only.
  • Which Cloudflare plans include MCP server portals; only Logpush export is stated as Enterprise only.
  • A model allow-list in Cloudflare MCP server portals, Docker or Runlayer, or on Azure API Management’s MCP pages.
  • Mintive’s audit log export and “SOC 2 Type II audited” badge, which we saw only on its homepage.

How we chose these MCP governance tools

On 30 October 2026 we read each vendor’s own docs with curl and matched every quote against the fetched text. We picked vendors that publish MCP admin controls and dropped Lunar.dev and TrueFoundry, whose pages held no checkable claims. We did not test any product. Trail publishes this page.

Frequently asked questions

Top MCP governance tools?

Gateways: Kong AI Gateway, AWS AgentCore Gateway, Azure API Management, Cloudflare MCP server portals and Docker's MCP Gateway. Control planes built for MCP and models: Mintive (formerly MintMCP), Obot and Runlayer. Client allow-lists: GitHub Copilot, Claude Code and Cursor Enterprise. Most enterprises need a gateway plus client settings, because several vendors document a way around their own control.

Which tools set per-team policies on which AI models and MCP servers are allowed?

GitHub Copilot, Cursor Enterprise, Kong, Mintive and Obot set model and MCP server lists for teams, and Claude Code does it through a self-hosted gateway. GitHub lets enterprise teams override the model and MCP server keys in its managed settings. Cursor sets a team baseline and adds models for groups. Kong scopes model access by consumer group, Mintive gives each team its own allowed models and budget, and Obot restricts servers, tools and models by user or identity-provider group.

How do you govern MCP servers in an enterprise?

Keep an approved list in a private registry or gateway, require OAuth on every remote server, and enforce the list in both the gateway and the clients. Add tool-level rules for destructive actions, send a log of every call to your SIEM, and close the bypasses each vendor documents, such as direct server URLs.

Does the official MCP Registry vet the servers it lists?

It lists metadata and calls that metadata deliberately unopinionated, leaving curation to downstream aggregators. It is in preview and accepts only publicly accessible servers. For internal servers it recommends hosting your own private registry, which GitHub Copilot can point to.

Does MCP have built-in authorization?

The specification defines OAuth-based authorization for HTTP transports and marks it optional. When used, a server must check that each token was issued for it and must not pass other tokens through. Local servers over STDIO take credentials from the environment instead.

Which tool governs what an AI agent is told over MCP, not only which servers it can reach?

Trail serves approved business rules over its MCP server, each with a named approver and a citation, and logs every read. It does not choose which servers or models a team may use, so put it behind one of the gateways and allow-list it like any other server.

Sources checked

Show 51 sources