PrivacyFence
Compare ยท MCP gateways
Most MCP gateways sit between many AI agents and many MCP servers, and give a platform team one place for sign-in, access rules, rate limits and logs. PrivacyFence is an MCP gateway with a narrower job: it governs its own connectors to business systems, and puts the person whose data it is in front of each sensitive read and write. The FAQ has the short version.
Checked against each project's documentation on 29 September 2026. The sources are at the end of this page.
Two jobs
Puts any MCP server behind one endpoint. It handles sign-in and roles, chooses which tools each team sees, limits rates, and sends logs to your monitoring. Several also scan traffic for personal data or secrets. It treats a tool as a name and a set of arguments, so it works with any server.
Brings its own connectors for Gmail, Drive, Slack, Salesforce, Jira, Confluence and more, and knows what each operation means. That is what lets it show a person the actual email, document or change before it happens. It is not a proxy for arbitrary MCP tools.
Side by side
| Typical MCP gateway | PrivacyFence | |
|---|---|---|
| Which tools | Any MCP server you register | Its own eleven connectors and their tools, each with a fixed gate |
| Built for | Platform and security teams running many agents and servers | The person whose mailbox or drive it is, with admins setting policy in an organization deployment |
| Sign-in | OAuth, SSO and role-based access | A local token and companion-app sign-in on a personal install; your OpenID Connect identity provider and OAuth 2.1 in an organization deployment |
| Human approval of a single call | Rare. Where offered, an approver role reviews the tool name and its arguments | Every gated call no always-allow rule covers, decided by the user on a card that shows the content or change in business terms |
| Reads reviewed before release | Not typical: a result passes through, possibly scanned | Yes: the result is held, previewed, and released only on approval |
| Personal data | Several redact or mask it automatically, for example with Microsoft Presidio or pattern plugins | A local pattern check that forces a review and a second confirmation, plus per-category redaction and blocking |
| Where it runs | Containers or Kubernetes you run, or a hosted service | An installer on each computer, or one Linux server |
| Audit | Central logs and traces, often exported to a SIEM | A chained per-person log of every decision; organization mode forwards it to syslog or an HTTP endpoint |
Examples
What each project's documentation describes. "Not described" means we did not find it there, not that it cannot be built.
| Gateway | Model | Personal data | Human approval of calls |
|---|---|---|---|
| Docker MCP Gateway | Open source; runs MCP servers in isolated containers, locally or self-hosted | Not described | Not described |
| IBM ContextForge | Open source, self-hosted; auth, roles, rate limits and a plugin system | A PII filter plugin that detects and masks it | Not described |
| Microsoft MCP Gateway | Open source (MIT), on Kubernetes; Entra ID sign-in, roles, routing | Not described | Not described |
| Lasso MCP Gateway | Open source (MIT), self-hosted; plugins and audit logging | Presidio-based detection and secret masking | Not described |
| agentgateway | Open source, Agentic AI Foundation (Linux Foundation), self-hosted; policy-based access and tool scoping | PII redaction | Not described |
| Cloudflare MCP server portals | Hosted by Cloudflare; sign-in, tool allowlists, logs | Data loss prevention rules | Not described |
| TrueFoundry AI Gateway | Commercial | Not described | Yes: gated calls are held for designated approvers, who see the tool, requester and arguments |
Which one
PrivacyFence governs only its own connectors, so tools from your other MCP servers keep going through whatever gateway you use for them.
Sources
Spotted something out of date? Write to [email protected] and it will be corrected.
Next
Follow one read and one write from the assistant to your decision, or compare PrivacyFence with Claude's own connectors.