MCP Gateway vs One

MCP Gateway 80

Read with the API checklist, as the gateway is the security layer an operator puts in front of agents. Over HTTP, bearer tokens and API keys with per-key glob allow and deny lists, explicit admin keys, OIDC JWT and mTLS, with OAuth 2.1 to backends, per-issuer token storage and per-user isolation that fails closed. Authentication is off by default on the loopback HTTP port, where callers are anonymous non-admins, and a stdio caller is admin (24 of 30). Management tools need an admin credential since 3.5.0, per-key tool scopes give least privilege, and destructive meta-tools ask the human through elicitation, refused on the 2026-07-28 protocol when the client can't ask and allowed after a warning on older clients; the source calls the prompt a courtesy, with the admin requirement as the control (16 of 20). Backend tool descriptions are scanned for poisoning patterns before they reach the agent, capability files can be hash-pinned, and responses pass a pattern-based injection scanner and credential redactor (13 of 15). NDJSON audit log, per-key cost and usage accounting, Prometheus metrics and trace ids (13 of 15). SECURITY.md with private reporting, a 48-hour acknowledgement and a 7-day fix target; two advisories published with credit on 28 August 2026; cargo audit, secret scanning and cosign-signed images in CI; no bug bounty or security.txt, and the OWASP mapping is self-assessed (14 of 20). 24 + 16 + 13 + 13 + 14 = 80. The DNS-rebinding advisory is a negative event below.

One 69

OAuth 2.1 authorisation code with PKCE, scopes, one-hour access tokens, and a grant that can be narrowed or revoked from the dashboard with effect on the next call (30). Read only, Read & write, Full access and per-action levels for each connection, plus a knowledge-only mode with no execution. execute_one_action is marked destructive so a client can ask first, and no server-side approval step was found (17). execute_one_action returns third-party content. Credentials are redacted from responses and sensitive headers stripped from the request echo, and no guidance on prompt injection was found (4). The dashboard logs agent, app, action and outcome per call, including refused calls, with retention of 14 to 90 days. No export or log API was confirmed (12). security@withone.ai is given for disclosure on the security page, and the MCP repository added a SECURITY.md (reports to support@withone.ai) on 20 October. security.txt returned 404, the SOC 2 audit is in progress, and no bounty or published advisories were found (6).

MCP Gateway 30

Self-hosted rule, scored on the paid option because any company use needs a commercial licence, as gaia and screenpipe (also noncommercial licences) were read. No payment protocol (0). The standard commercial licence is a public flat EUR 500 a month per named project through GitHub Sponsors, plan-only pricing (10). Personal and noncommercial use is free with no card or account, but there is no free route or stated evaluation period for a company (10 of 20). It installs from Homebrew, crates.io or ghcr.io with no sign-up, and an agent with a shell can run the setup wizard, but buying the licence takes a person on GitHub Sponsors, as screenpipe's did (10 of 20). 0 + 10 + 10 + 10 = 30.

One 35

No x402, MPP or L402 (0). Plan prices are public with their limits, $0, $29 and $199 a month, each with 1M requests a month, and since the 9 October check the pricing page prices requests past that, another 1M for $20 on Free and Starter and $0.00002 a request metered on Pro. Enterprise is on contract (20). The Free plan includes every platform and 1M requests a month. The pricing page doesn't say whether sign-up needs a card and we did not create an account, so 15 of 20 (15). A person must sign in through a browser to approve the grant or create an API key (0). 0 + 20 + 15 + 0 = 35.