Security series · Part 5 of 6

MCP Security →

MCP Gateway Comparison (2026): Composio vs ACP vs DIY

David Crowe · April 1, 2026 · 7 min read

architecture mcp

Run agents? ACP lets you see, control, and price every tool call they make — free on-device install for Claude Code, Cursor, Codex, and OpenClaw, nothing leaves your machine:

curl -sf https://agenticcontrolplane.com/install.sh | bash -s -- --local

Getting started → · or use the free cloud console → · free for individuals

You have MCP servers. They expose tools to your LLM. They work in development.

Now you need to put them in production, and there’s a gap between “works on my laptop” and “ready for real users.” The gap is identity, access control, audit logging, rate limiting, PII detection, and multi-tenant isolation.

An MCP gateway sits in that gap. It intercepts tool calls between MCP clients and MCP servers and applies those controls before the call reaches your backend.

Three real options: build it yourself with open-source MCP servers, use Composio’s managed integration platform, or use ACP (Agentic Control Plane) as a governance layer.

Option 1: Self-Hosted (DIY)

The open-source MCP ecosystem is large — thousands of MCP servers on GitHub covering databases, CRMs, file systems. You pick the ones you need, deploy them on your own infrastructure, and wire them into your agent framework.

What you get: Full control. You own the code, the deployment, the data flow. You can modify any server to fit your requirements. No vendor dependency, no usage fees.

What you build yourself: Everything else.

A raw MCP server has no concept of user identity. It doesn’t know who’s calling it. No access control — every caller gets the same capabilities. No audit trail beyond whatever logging you add. No rate limits unless you implement them. No PII detection. No multi-tenant isolation.

Realistic timeline: days to weeks for a basic governance layer, longer for production-grade. You’ll handle JWT validation, policy enforcement, content scanning, structured logging, and per-user rate limiting across every MCP server you deploy. That’s not boilerplate.

The take: the initial build is the easy part. Keeping a custom governance layer secure, auditable, and compliant across 10+ MCP servers as the fleet grows is where it gets expensive. Right choice only if you genuinely need maximum control and have the security engineering capacity to pay that cost indefinitely.

Option 2: Composio

Composio is a developer-first integration platform: 850+ pre-built integrations behind a clean SDK. Connect your agent to Slack, GitHub, Salesforce, Google Workspace, and hundreds more in minutes.

The developer experience is good. Install the SDK, authenticate with OAuth, and your agent has working integrations immediately. The catalog is large — if your question is “do you support [specific SaaS tool],” they’ve probably built the connector. The SDK supports LangChain, CrewAI, Autogen, and other frameworks.

What it isn’t: a governance layer. Composio solves the connection problem — getting your agent talking to external services — not the problem of controlling who can use those connections, what data flows through them, and producing a compliance-grade audit trail. Identity verification is API-key-based, not JWT-with-identity-provider. Multi-tenant isolation — different users getting different permissions on the same agent — isn’t the core use case. If 500 users each interact with agents that access sensitive data and each needs distinct access controls with identity-verified audit trails, you build that layer on top.

It’s also not open source, with no self-host option. Your tool calls route through Composio’s infrastructure. Fine for many use cases; a blocker for regulated industries or data sovereignty requirements.

The take: fastest path from “I want my agent to use Slack” to “my agent uses Slack.” If you’re buying integration speed and coverage, buy Composio. If you’re buying identity governance and compliance, it’s not their product.

Option 3: ACP (Agentic Control Plane)

ACP approaches the problem from the opposite end. Instead of starting with integrations and adding governance, it starts with governance and adds integrations.

The core is GatewayStack, an open-source (MIT) framework with modular governance components:

identifiabl — JWT verification against Auth0, Okta, Entra ID, Firebase, or any OIDC provider. Every tool call is bound to a verified user identity.
transformabl — PII detection and redaction. Scans tool inputs and outputs for sensitive data before it reaches your backend or returns to the model.
explicabl — Structured audit logging. Every tool call is logged with the verified user identity, the policy decision, the tool called, and the outcome.
limitabl — Per-user, per-agent rate limiting and budget caps. Prevents runaway agent loops and controls cost per user.
proxyabl — SSRF protection. Prevents tool calls from accessing internal network resources they shouldn’t reach.

There’s also ACP Cloud — a managed version at cloud.agenticcontrolplane.com — if you don’t want to run the infrastructure yourself.

Identity flows through every tool call. Audit trails are structured and attributable to individual users. PII detection runs at the request level. Rate limiting is per-user and per-agent, not platform-level. Multi-tenant isolation is a first-class feature. Open source: read the code, modify it, self-host it, or use the managed cloud.

The tradeoffs: the integration catalog is smaller — 25+ built-in connectors against Composio’s 850+. For a tool outside the catalog, the answer is “connect a custom MCP server,” not “pre-built.” And setup involves decisions about identity providers, policy configuration, and audit destinations that Composio abstracts away — intentional, because those decisions matter for production, but time-to-first-demo is longer than “install SDK, connect, go.”

The take: ACP is built for teams that need to answer “who accessed what, with what permissions, and is there a record?” Sensitive data, compliance requirements (SOC 2, HIPAA), multi-tenant platforms, enterprise customers asking about your governance posture — that’s the fit. If you need 850 integrations and governance isn’t a requirement, it’s more infrastructure than you need.

Comparison table

Feature	Self-Hosted	Composio	ACP
Integration count	Varies	850+	25+ built-in + custom
Identity verification	DIY	API keys	JWT + multi-IdP (Auth0, Okta, Entra, Firebase)
PII detection	No	No	Built-in (transformabl)
Audit trail	DIY	Basic	Full structured logging (explicabl)
Rate limiting	DIY	Platform-level	Per-user, per-agent (limitabl)
Open source	Depends	No	Yes (MIT, GatewayStack)
Self-host option	Yes	No	Yes
Multi-tenant	DIY	No	Yes
Agent-to-agent governance	No	No	Yes
MCP endpoint	Yes	Yes	Yes
SSRF protection	DIY	Unknown	Built-in (proxyabl)
Setup time	Hours/days	Minutes	Minutes

Every “DIY” in the self-hosted column is real engineering work. Some teams have the capacity for that. Most don’t.

When to use each

Self-Hosted — you need maximum control, you have the security engineering expertise to build and maintain a governance layer, and you’re willing to own the full stack. Works for internal tools where you control both agents and backends and don’t need to demonstrate compliance to external auditors.

Composio — you’re optimizing for velocity. Prototypes, MVPs, hackathon projects, internal developer tools where the goal is “make the agent do useful things quickly.” Governance requirements, if they emerge, get addressed later.

ACP — governance is a requirement. Agents accessing sensitive data, compliance obligations (SOC 2, HIPAA, ISO 27001), multi-tenant platforms where different users need different permissions, enterprise customers asking about your AI governance posture — or you want identity-verified audit trails from day one because retrofitting governance is painful.

The governance gap

Most solutions solve the connect problem: how do I get my agent talking to Slack, my database, my CRM.

The harder problem is govern. Who is making this tool call? Are they allowed to? Is sensitive data flowing through the request? Is there a record? Can I prove to an auditor that access controls were enforced?

This is the gap that shows up in enterprise deployments. The agent works. The integrations work. Then security review asks: “Show me the audit trail for this user’s agent activity last Tuesday.” The answer is either a structured log with identity attribution, or grep through CloudWatch hoping the timestamps line up.

Most MCP gateway options cover the connect side thoroughly. Fewer cover govern.

Can you combine them?

Yes. These options aren’t mutually exclusive.

ACP can sit in front of self-hosted MCP servers as a governance proxy. Deploy whatever open-source MCP servers you want; ACP handles identity verification, policy enforcement, PII detection, rate limiting, and audit logging for all of them. The MCP servers don’t change — ACP operates at the boundary.

You can also route Composio’s integrations through ACP. Composio handles the connection to 850+ services; ACP verifies who’s making each call, enforces per-user policies, scans for PII, and produces audit trails. Breadth from Composio, governance from ACP.

Same pattern as the rest of infrastructure. Your CDN doesn’t replace your firewall. Your API gateway doesn’t replace your IAM provider. The connect layer and the govern layer can come from different vendors.

Making the decision

Priority is integration breadth — maximum services connected with the least effort — Composio.

Priority is full control — own every component, modify anything, no vendor dependency — self-hosted. Bring your security engineering capacity.

Priority is governance and compliance — identity-verified access control, PII detection, structured audit trails, multi-tenant isolation, per-user rate limits — ACP, either as open-source GatewayStack or as a managed cloud service.

Most teams eventually need all three capabilities. Start with your most pressing constraint.

ACP Cloud free tier: 10,000 calls/month, 5 connectors, unlimited seats. No credit card required.

Try ACP Cloud free -> · GatewayStack on GitHub -> · Reference architecture ->

Share: Twitter LinkedIn