AgentWeb vs MCP Gateway

AgentWeb 25

Read as a closed hosted service. No dated API or server release was found; the runtime reports 0.10.21 with no date. The terms (7 October 2026), privacy policy (14 October) and llms.txt task guides (October) changed within 30 days, so 20 of 30 rather than 30. No changelog or dated release notes, so no count for the last 90 days (0). Support is by email with a promised 24-hour answer for security reviews, untested, and there's no community channel or public issue tracker (5 of 25). Not in the official MCP registry (a search for agentweb on 23 October found only other vendors' servers), and no official SDK (0). No public repository, CI or package to judge (0).

MCP Gateway 90

4.0.0-beta.3 on 6 October 2026, 27 days before the check, and commits on main to 26 October (30). 4.0.0-beta.1 and beta.2 on 25 September and beta.3 on 6 October, plus 3.5.1 on 4 September, inside 90 days (20). The newest outside issue (#3953, 19 October) got a maintainer reply the same day and a follow-up on 28 October, four issues are open, and outside pull requests from four contributors were merged, per AUTHORSHIP.md. Closed issues and pull requests couldn't be read (robots.txt), so not sampled further (17 of 25). In the official MCP registry as io.github.MikkoParkkola/mcp-gateway under a GitHub namespace, latest 3.5.1, the current stable release (15). Dependabot merges, cargo audit in CI and current tokio and jsonschema, less 2 because the npm wrapper installs a downloaded binary without checking its checksum (8 of 10). 30 + 20 + 17 + 15 + 8 = 90.

AgentWeb 47

An aw_ bearer key, or OAuth 2.1 with PKCE and dynamic client registration on the MCP origin with one scope, mcp. The OpenAPI file names four key scopes but no public page shows how to create a scoped key, revoke one or rotate it (15 of 30). The terms describe an approval mode and an autonomous mode, with separate approval for payments, legal filings and security changes, PAYMENT_DECLINED for over-cap payments, and spending refused when acting for another workspace member. No read-only key, and run can send messages or orders in one call (12 of 20). read_page and site actions return third-party content and no guidance on treating it as untrusted was found. The server's own 401 answer tells agents to keep tokens and config out of what they tell the user and to retry silently (3 of 15). A receipt on every action, per-session receipts in the dashboard, 7-day redacted traces and approval records per the privacy policy (12 of 15). A security page describes the credential vault and promises answers to reviews within 24 hours. No security.txt (404 on both hosts), no bug bounty, no advisories, SOC 2 in progress (5 of 20).

MCP Gateway 80

Read with the API checklist, as the gateway is the security layer an operator puts in front of agents. Over HTTP, bearer tokens and API keys with per-key glob allow and deny lists, explicit admin keys, OIDC JWT and mTLS, with OAuth 2.1 to backends, per-issuer token storage and per-user isolation that fails closed. Authentication is off by default on the loopback HTTP port, where callers are anonymous non-admins, and a stdio caller is admin (24 of 30). Management tools need an admin credential since 3.5.0, per-key tool scopes give least privilege, and destructive meta-tools ask the human through elicitation, refused on the 2026-07-28 protocol when the client can't ask and allowed after a warning on older clients; the source calls the prompt a courtesy, with the admin requirement as the control (16 of 20). Backend tool descriptions are scanned for poisoning patterns before they reach the agent, capability files can be hash-pinned, and responses pass a pattern-based injection scanner and credential redactor (13 of 15). NDJSON audit log, per-key cost and usage accounting, Prometheus metrics and trace ids (13 of 15). SECURITY.md with private reporting, a 48-hour acknowledgement and a 7-day fix target; two advisories published with credit on 28 August 2026; cargo audit, secret scanning and cosign-signed images in CI; no bug bounty or security.txt, and the OWASP mapping is self-assessed (14 of 20). 24 + 16 + 13 + 13 + 14 = 80. The DNS-rebinding advisory is a negative event below.

AgentWeb 60

Graded with the hosted lines, on the remote MCP server and REST runtime. AgentWeb's own status page at /status shows API & MCP, web app, billing and docs as components with daily uptime from probes every five minutes in two regions (20). It shows only 14 days, all at 100 per cent from 10 to 23 October 2026, with no incident log, so the 90-day record can't be read. Judgement call, 10 of 30 for a short clean window rather than 5 for none. No rate limit is published with numbers; the only figure is an example error string in the OpenAPI file, "Max 60 requests per hour" (5 of 15). 429 carries Retry-After per the docs and the OpenAPI file, REST execute takes an Idempotency-Key so a retry is charged once, and checkout outcomes say whether a step is safe_to_retry (15). The Enterprise plan lists a performance SLA with no figure (5). Nothing is labelled beta, but the API is 0.9.0, the runtime 0.10.21 and 1,713 of 1,792 maps are at 0.1.0, 31 marked partial (5 of 10).

MCP Gateway 87

Local-package reading, as for graphicle and claude-mem, since the owner runs it. Official packages on crates.io (cargo install mcp-gateway), a Homebrew tap, release binaries and ghcr.io, with Rust 1.95 and macOS, Linux and Windows builds stated (20). A public CI workflow runs clippy with warnings as errors, the full test suite, fmt, cargo audit, secret scans and Helm smoke tests on pushes and pull requests, and the last eight runs on main passed by 26 October 2026 (25). Four open issues on GitHub on 2 November 2026, one a labelled bug filed by the maintainer, and the newest outside issue was answered the day it was opened. Closed issues couldn't be read (robots.txt), so the record is partial (18 of 25). Keep a Changelog with BREAKING entries and migration notes for 3.0 and 4.0 and an UPGRADING-4.0.md, but 3.3.0, which relicensed the code, has no changelog section, and 4.0.0 is dated 19 September there while only betas exist (9 of 15). Stable is 3.5.1, after two earlier majors; 4.0.0 is in beta (15). 20 + 25 + 18 + 9 + 15 = 87.

AgentWeb 40

No x402, MPP or L402 (0). $0.05 per completed action published without a login, also in the public billing catalogue as 5 cents (20). Accounts are free and page reads are free for 20 an hour, but no action runs until credits are bought, so 10 of 20. An agent can start sign-up through MCP tools or REST and receive the key by polling after a person signs in once, or by an emailed code. Credits can only be bought by a person through Dodo's hosted checkout; an agent's key is refused (10 of 20).

MCP Gateway 30

Self-hosted rule, scored on the paid option because any company use needs a commercial licence, as gaia and screenpipe (also noncommercial licences) were read. No payment protocol (0). The standard commercial licence is a public flat EUR 500 a month per named project through GitHub Sponsors, plan-only pricing (10). Personal and noncommercial use is free with no card or account, but there is no free route or stated evaluation period for a company (10 of 20). It installs from Homebrew, crates.io or ghcr.io with no sign-up, and an agent with a shell can run the setup wizard, but buying the licence takes a person on GitHub Sponsors, as screenpipe's did (10 of 20). 0 + 10 + 10 + 10 = 30.

AgentWeb 51

The editorial half. A closed service under dated terms naming Agent Web Labs, Inc. and Delaware law, though the page's HTML and rendered text give different update dates (20 July and 7 October 2026) (15). The privacy policy is specific about what it collects, says prompts, transcripts, parameters and results may go to PostHog with session replay and be used to improve the service, and promises no sale. It gives no retention periods, deletion is by email, and no DPA was found. The security page's cookieless analytics agrees with the policy's local-storage PostHog identifier (10 of 30). No deprecation policy; the terms give notice of material changes where the law requires (2 of 20). Sub-processors are named with their roles (Supabase, Cloudflare, Vercel, PostHog, Resend, Beehiiv, TypeSafe, Dodo Payments), with processing in the United States and other countries and no region stated (12 of 20).

MCP Gateway 60

PolyForm Noncommercial 1.0.0, source-available and not OSI, with affirmative SPDX headers on every first-party file and LICENSES.md, NOTICE.md and COMMERCIAL.md that agree with each other and say what the earlier MIT grants still cover. Read as gaia's PolyForm source was (20 of 30). Self-hosted, so data stays where the owner runs it; secrets go to the OS keychain, files holding them are 0600 on Unix, and SECURITY.md states the Windows gap. There is no privacy statement (20 of 30). Deprecation notices with versions for the MIT 3.0.0 to 3.2.1 releases on crates.io and npm, upgrade guides for 3.0 and 4.0 and a stated support window of the latest release only, but the 3.3.0 relicence has no changelog entry, and AUTHORSHIP.md says the licensing scheme still awaits an IP lawyer's sign-off (9 of 20). No telemetry, analytics or update check found in the source; Prometheus metrics stay local behind a feature flag, and the plugin marketplace host is contacted only by plugin commands. The docs state nothing either way (15 of 20). 20 + 20 + 9 + 15 = 64.