The useful question for an enterprise in a regulated industry is whose report covers the system you will actually run. On October 11, 2026, AWS listed Amazon Bedrock AgentCore in its SOC, HIPAA-eligible and FedRAMP scopes. Non-hyperscaler vendors such as Kong, Zuplo, Composio, MintMCP and TrueFoundry list SOC 2 Type II for at least some of their own services, which is not the same as covering the gateway you would deploy, and none of the fifteen non-hyperscaler vendors we checked (listed below) names its MCP gateway in a FedRAMP authorization. ASCENDING's buyer's guide explains how to read an MCP gateway vendor's SOC 2 scope; this hub maps that method onto the market.
In a gateway deployment, every Model Context Protocol tool call passes through the MCP gateway, which authenticates the caller, applies tool-level policy, holds or exchanges the downstream credential and records the call. The gateway is the protocol-specific flavor of the agent gateway; the MCP specification defines only hosts, clients and servers, and mentions gateways as intermediaries that route and inspect requests. The MCP gateway definition covers the pattern. This hub is for the buyer who has to get one through a regulated security review.
Whose SOC 2 report covers the gateway
A SOC 2 report is an auditor's examination of controls for a defined system. It helps you only if your gateway sits inside that system, and who operates the gateway decides that. Three operating models cover the market.
Vendor-run SaaS. The vendor operates the gateway, so its report is your primary evidence, but only for the deployment option that report describes. Zuplo, Composio and MintMCP run managed MCP gateways and list SOC 2 Type II; Composio and MintMCP also offer VPC or self-hosted options, where the gateway runs in your environment instead. Some products split the model: Kong's SOC 2 Type II report names Kong AI Gateway, but AI Gateway 2.x runs only in hybrid mode, with a Konnect-managed control plane and data-plane nodes you operate, so the part that handles tool calls sits in your scope. TrueFoundry's security documentation states the rule outright: its certifications apply to its managed infrastructure, and a self-hosted deployment depends on your own controls.
Hyperscaler-managed. The cloud provider runs the gateway, and the evidence is the provider's audit scope. AWS lists Amazon Bedrock AgentCore on its SOC services-in-scope page (updated August 11, 2026). You still own the IAM configuration, the targets, log retention and every system the gateway calls.
Customer-hosted. You run the gateway software in your own cloud account, and your auditors assess it as part of your environment, on top of your cloud's in-scope services and your own controls. A vendor's report can still speak to how the software is built and supported. It does not attest to your installation.
Whichever model you buy, ask for the report itself and read it with your GRC team. Check that the system description names the MCP gateway, not only the company's core product; that the report type and period (Type 1 at a point in time, Type 2 over a period) covers the MCP feature in production; which exceptions and exclusions were carved out; which customer responsibilities land on you, usually IdP configuration and policy authoring; and whether a bridge letter covers the gap since the period ended.
US regulated industries: which gateways sit in which scope
Each fact below comes from the owner's own compliance page, read on October 11, 2026. The fifteen non-hyperscaler vendors we checked were Aembit, Cloudflare, Composio, Docker, IBM (ContextForge), Kong, Lasso, Lunar.dev (now part of Boomi), Maxim (Bifrost), MintMCP, Portkey (now part of Palo Alto Networks), Red Hat, Solo.io, TrueFoundry and Zuplo. These pages change often (AWS last revised its FedRAMP list on October 5), so re-check before a line goes into a risk memo. Treat this as a map for your own review, not a compliance determination.
- 01
Financial services
Vendor-risk reviews usually start with SOC 2 Type II and, where card data can reach a tool, PCI DSS. AWS lists Amazon Bedrock AgentCore in its PCI DSS scope as well as SOC. Kong's trust center lists a SOC 2 Type II report that names Kong AI Gateway, and a PCI DSS attestation for Konnect and Dedicated Cloud Gateways. Google lists Apigee and Gemini Enterprise Agent Platform in its SOC 1/2/3 and PCI DSS scope; Agent Gateway, a component of that platform, is not named separately, so confirm with Google that it is inside the boundary.
- 02
Healthcare and HIPAA
HIPAA has no certificate to check. The question is whether the operator is a business associate and signs a BAA for the service that touches ePHI. AWS lists Amazon Bedrock AgentCore as a HIPAA eligible service. Cloudflare signs BAAs with Enterprise customers and names Access, Gateway and Cloudflare One in scope, but not MCP server portals. Microsoft keeps its HIPAA BAA and SOC service lists in audit-scope appendices; check API Management and Foundry Agent Service there. The buyer's guide's HIPAA section covers tracing ePHI through gateway logs, traces and backups.
- 03
Public sector and FedRAMP
AWS lists Amazon Bedrock AgentCore as FedRAMP certified at Class C (formerly Moderate) in US East/West and Class D (formerly High) in GovCloud (US-West), where AgentCore launched on May 5, 2026. Cite that page, not the AgentCore FAQ, which still says AgentCore "is pursuing FedRAMP compliance". For DoD work, AgentCore is at IL2 in East/West; GovCloud IL2, IL4 and IL5 are still under independent assessment. Azure API Management is in FedRAMP High scope in Azure and Azure Government, at DoD IL2, IL4 and IL5 (workload isolation) in Azure Government, and at IL6 in Azure Government Secret; Foundry Agent Service does not appear on that list. None of the fifteen non-hyperscaler vendors names its MCP gateway in a FedRAMP authorization. Cloudflare for Government is FedRAMP High, but its in-scope list names Access, Gateway and Cloudflare Zero Trust, not MCP server portals; Boomi (Lunar.dev's parent) and Palo Alto Networks (Portkey's parent) hold FedRAMP authorizations whose published scope does not name the MCP gateway.
What an auditor asks the gateway to show
The operator's attestation covers the operator. Your auditor still samples the gateway itself, and the requests cluster on five points whichever shape you buy.
- Identity. Who made the call: the end user and the client or workload acting for them, resolved against your IdP rather than a gateway-local user table.
- Per-tool authorization. Allow and deny decisions at the tool level, including a direct call to a tool that was hidden from
tools/list. Filtering discovery is not enforcement. Retrieval counts too: a RAG pipeline exposed as an MCP tool falls under the same per-tool policy (see MCP vs RAG). - Audit trail. One record per call with subject, client, server, tool, decision, timestamp and correlation ID, exportable to your SIEM and free of bearer tokens. The protocol leaves this to implementers: MCP cannot enforce security principles at the protocol level, and clients SHOULD log tool usage for audit purposes.
- Credential handling. Which credential reaches each backend (a shared service account, a per-user OAuth grant or an exchanged token), and evidence that the gateway never forwards the client's token, which the authorization specification forbids.
- Residency and egress. Where tool payloads, logs, traces and backups go. A gateway inside an authorized boundary can still send payloads outside it: AWS notes that AgentCore Gateway in GovCloud sends tool-invocation payloads to whatever target URLs you configure.
Four gateway shapes on five attributes
The market sorts into four shapes, and our May edition got two things about them wrong. First, hyperscaler gateways are not in-cloud only: AgentCore Gateway has accepted external MCP servers as targets since its October 2025 GA and now fronts other agents and HTTP services through passthrough targets, Azure API Management fronts existing remote MCP servers, and Google's Agent Gateway reaches third-party MCP servers. What stays inside one cloud is the control plane: gateway configuration, policy and logs. Inbound identity can still come from your own IdP. Second, it left out two products that were already generally available: Azure API Management's MCP governance (GA November 2025) and MCP in Apigee (GA March 31, 2026). Since then, Google's Agent Gateway has reached general availability on June 18, 2026.
| Attribute | Hyperscaler-native (AgentCore Gateway, Azure API Management, MCP in Apigee) | Edge-native (Cloudflare MCP server portals) | Customer-hosted, vendor-backed (Jarvis Registry, our product) | Open-source projects you run (IBM ContextForge, agentgateway) |
|---|---|---|---|---|
| Deployment model | Managed service run by the cloud provider. API Management also offers a self-hosted gateway; MCP in Apigee runs on Google-managed infrastructure, or since Apigee hybrid 1.17.0 (September 14, 2026) in your own Kubernetes cluster. | SaaS run by Cloudflare in Cloudflare One (Zero Trust); generally available since September 24, 2026. | Software you operate in your own cloud account; Apache 2.0 on GitHub, listed on AWS Marketplace. | Software you operate and support: ContextForge (Apache 2.0, GA May 1, 2026) or agentgateway (Apache 2.0, a Linux Foundation project). |
| Identity and access control | Configured and logged in the provider's control plane; inbound tokens can come from your own IdP. AgentCore Gateway accepts IAM or JWTs from any identity provider, injects per-tool credentials outbound and, when a policy engine is attached, evaluates each call against Cedar policies; API Management validates JWTs from Entra ID or another IdP. | Access policies fed by your IdP decide which servers a user sees; upstream OAuth runs per user or on a shared admin credential; tools can be hidden or renamed. | RBAC scopes plus per-tool ACLs, private by default. Downstream OAuth credentials encrypted at rest and refreshed; per-user credentials supported; raw credentials never sent to the client. | ContextForge: JWT, OAuth 2.0, SSO and team-based RBAC. agentgateway: JWT, API keys, OAuth and CEL-based RBAC. |
| Audit logging | Policy in AgentCore logs every enforcement decision to CloudWatch; API Management's MCP tool observability went GA on June 9, 2026. | Portal logs record time, status, server, capability and duration; SIEM export through Logpush needs an Enterprise plan. | OpenTelemetry and Prometheus metrics for MCP activity, including latency. Per-call payload or policy-snapshot logging is not specified. | ContextForge: audit trails and OpenTelemetry tracing. agentgateway: OpenTelemetry metrics, logs and traces. Retention is yours to run. |
| Supported MCP transports | AgentCore MCP server targets are remote URLs on revisions 2025-03-26 to 2026-07-28 (AWS names revisions, not a transport; no stdio targets); API Management fronts existing servers over Streamable HTTP or SSE; Apigee's MCP endpoints do not support SSE streams. | Streamable HTTP, including stateless 2026-07-28 clients; SSE accepted upstream. Remote HTTP servers only, so no stdio. | Streamable HTTP (recommended) and SSE for server registration, per the registry documentation; stdio is not listed. | ContextForge: stdio, SSE, Streamable HTTP, HTTP and WebSocket. agentgateway: stdio, HTTP, SSE and Streamable HTTP. |
| Hosting | The provider's regions; AgentCore Gateway runs in 21 commercial regions plus AWS GovCloud (US-West). Targets can sit anywhere, so payloads can leave the region. | Cloudflare-hosted; upstream MCP servers stay where they already run. | Your Kubernetes cluster on Amazon EKS or Azure AKS, per the production deployment guide. | Wherever you run containers, Helm charts or a single binary. Upgrades and availability are yours. |
The last two columns overlap: Jarvis Registry is itself Apache 2.0, ContextForge is also a registry, and agentgateway has a paid edition in Solo Enterprise for agentgateway. The real difference is whose roadmap and support contract you depend on.
One transport caveat runs across the table. The HTTP+SSE transport from 2024-11-05 has been deprecated since 2025-03-26 and is now eligible for removal in a future revision, while Streamable HTTP can still answer a single request with an SSE stream. When a vendor lists "SSE", ask which of the two it means.
For a regulated buyer, the audit logging and hosting rows usually decide it: they map to the audit-trail and residency checks above, and they are where the four shapes differ most. ASCENDING's comparison of gateway and registry control points goes deeper on the customer-hosted column, and our scored ten-gateway audit ranks individual products.
Two tests to run in the trial
Attestation narrows the shortlist; these tests decide it. Run them with one read tool, one write tool and two test users, one of whom should be denied.
- 01
Auth conformance
Authorization is optional in MCP, but under the current authorization specification (revision 2026-07-28) a protected MCP server is an OAuth 2.1 resource server that MUST publish Protected Resource Metadata (RFC 9728) and accept only tokens issued for it. Clients have had to send RFC 8707 resource indicators since revision 2025-06-18, and PKCE since 2025-03-26. Ask the vendor to show a token minted for one server being rejected by another. Our MCP gateway auth patterns piece covers elicitation, refresh and resume.
- 02
Revocation mid-task
Remove the permitted user's access while their client still holds a valid token, then repeat the call. Measure how long the denial takes; cached policy, group claims and token lifetimes all delay it. If the vendor documents no propagation guarantee, your trial number is the only one you have.
Where Jarvis Registry fits
Disclosure first: Jarvis Registry is our product, built by ASCENDING, which publishes this site. ASCENDING's customer-hosted Jarvis MCP gateway is the example in the customer-hosted column. It runs in your own AWS or Azure environment and exposes one Registry Endpoint that lists only the MCP servers each user is permitted to access. Access combines RBAC scopes with per-tool resource ACLs, and resources stay private until shared. For OAuth-protected servers, downstream credentials are encrypted at rest and refreshed, per-user credentials are supported, and the calling client never receives the raw credential. Federation imports MCP servers and agents from AWS AgentCore, and agents only from Microsoft Foundry (formerly Azure AI Foundry).
What it does not give a regulated buyer is an attestation. ASCENDING publishes no SOC 2, HIPAA or FedRAMP attestation for Jarvis Registry, and the Jarvis documentation says deploying it does not automatically certify the customer. Your auditors assess it as part of your environment. The docs do not specify per-call payload or policy-snapshot logging, so decide where that record will come from, and ask ASCENDING to show exactly what is recorded before you commit. Stdio is not a listed transport, and the registration docs list SSE without saying which kind, so put the transport question above to ASCENDING too. In our own scored audit, Jarvis Registry ties for last of ten (10 of 20, with MintMCP) and scores 0 of 2 on compliance.
Correction: the May edition of this page overstated Jarvis Registry's federation, audit logging and pricing. This edition states only what the Jarvis documentation and ASCENDING's MCP gateway FAQ confirm. Jarvis is listed on AWS Marketplace, which publishes its current contract pricing.