MCP Gateway vs SandBase

MCP Gateway 80

Read with the API checklist, as the gateway is the security layer an operator puts in front of agents. Over HTTP, bearer tokens and API keys with per-key glob allow and deny lists, explicit admin keys, OIDC JWT and mTLS, with OAuth 2.1 to backends, per-issuer token storage and per-user isolation that fails closed. Authentication is off by default on the loopback HTTP port, where callers are anonymous non-admins, and a stdio caller is admin (24 of 30). Management tools need an admin credential since 3.5.0, per-key tool scopes give least privilege, and destructive meta-tools ask the human through elicitation, refused on the 2026-07-28 protocol when the client can't ask and allowed after a warning on older clients; the source calls the prompt a courtesy, with the admin requirement as the control (16 of 20). Backend tool descriptions are scanned for poisoning patterns before they reach the agent, capability files can be hash-pinned, and responses pass a pattern-based injection scanner and credential redactor (13 of 15). NDJSON audit log, per-key cost and usage accounting, Prometheus metrics and trace ids (13 of 15). SECURITY.md with private reporting, a 48-hour acknowledgement and a 7-day fix target; two advisories published with credit on 28 August 2026; cargo audit, secret scanning and cosign-signed images in CI; no bug bounty or security.txt, and the OWASP mapping is self-assessed (14 of 20). 24 + 16 + 13 + 13 + 14 = 80. The DNS-rebinding advisory is a negative event below.

SandBase 45

Standard keys (sk- and 64 hex characters) act for one organisation with no user-selectable scopes, can carry an expiry and a spending limit, are shown once and are revoked permanently in the console. CLI Login keys from the browser approval (device secret plus PKCE S256) are scoped to mcp:invoke and answer 403 insufficient_scope outside it. No OAuth for the MCP server and no API for managing keys. Above plain revocable keys, below OpenRouter's 25 with OAuth PKCE and a management API (22). The OpenAPI file's generateContent operation 'also accepts x-goog-api-key and the key query parameter for Google SDK compatibility', noting headers are safer, and all four Gemini operations list a GoogleQueryApiKey scheme, read on 8 November 2026. A secret in a URL query string is a documented option, so 10 off (12 of 30). Per-key spending limits and expiry, the organisation's funding boundary and a monthly limit on auto top-up bound spend, and an agent can't lift a key's limit by topping up. No read-only key, per-period budget, per-run cap, allowlist of tools or providers or approval step before a paid run. Monid earned 16 with per-period budgets, a per-run cap and read-only scopes, which SandBase lacks (12 of 20). Runs return scraped pages and social posts from third parties, and neither the skill nor the docs read say to treat them as untrusted. Monid took 3 with none (3 of 15). Request history lists each request's status and cost, sandbase_runs and account history return runs with cost, GET /v1/tasks/{task_id}/cost gives a task's cost, and billing records export as CSV. No key-level audit (created by, last used) was found. Monid earned 13 with key usage records (12 of 15). security.txt answered a client error. SECURITY.md in sandbaseai/sandbase names the SDKs, examples, catalogue and API as in scope for GitHub private vulnerability reporting with acknowledgement within 3 business days, and the CLI repository has its own. No bug bounty or certification found. Paid earned 6 for a reporting address without security.txt (6 of 20). 12+12+3+12+6 = 45.

MCP Gateway 87

Local-package reading, as for graphicle and claude-mem, since the owner runs it. Official packages on crates.io (cargo install mcp-gateway), a Homebrew tap, release binaries and ghcr.io, with Rust 1.95 and macOS, Linux and Windows builds stated (20). A public CI workflow runs clippy with warnings as errors, the full test suite, fmt, cargo audit, secret scans and Helm smoke tests on pushes and pull requests, and the last eight runs on main passed by 26 October 2026 (25). Four open issues on GitHub on 2 November 2026, one a labelled bug filed by the maintainer, and the newest outside issue was answered the day it was opened. Closed issues couldn't be read (robots.txt), so the record is partial (18 of 25). Keep a Changelog with BREAKING entries and migration notes for 3.0 and 4.0 and an UPGRADING-4.0.md, but 3.3.0, which relicensed the code, has no changelog section, and 4.0.0 is dated 19 September there while only betas exist (9 of 15). Stable is 3.5.1, after two earlier majors; 4.0.0 is in beta (15). 20 + 25 + 18 + 9 + 15 = 87.

SandBase 63

Hosted lines, graded on the HTTP API and the remote MCP server at api.sandbase.ai/v1/mcp, the surfaces an agent calls. status.sandbase.ai is a live Better Stack page with a 90-day view of the website, the API, the docs and the blog, and no component for the MCP path or sandbox.sandbase.ai. Monid earned 15 for a live Better Stack page that didn't monitor its MCP host (15 of 20). Read on 8 November 2026, it showed all services operational, the API at 99.957 per cent over 30 days and 99.983 per cent over 90, and 'No incidents reported' for September, October and November 2026. That is under 20 minutes of API downtime in the last 30 days and no outage of an hour, so minor incidents at most (20). The rate-limits page says requests a minute are assigned per organisation over a one-minute sliding window, shared by its keys, with a video concurrency limit, and publishes no numbers. Paid and Monid earned 7 for limits described without numbers (7 of 15). A 429 carries {"error":"organization rate limit exceeded"}, Retry-After is 'not guaranteed' and honoured when present, and the docs give exponential backoff with jitter and say not to retry a state-changing request without documented idempotency. Idempotency-Key is taken on Agents writes, session events and cancel, not on POST /v1/run, which spends money. Monid earned 11 on the same pattern (11 of 15). No SLA, and the terms promise no uptime, response time or availability (0). No beta or preview label on the API or the MCP server (10). 15+20+7+11+0+10 = 63.

MCP Gateway 90

4.0.0-beta.3 on 6 October 2026, 27 days before the check, and commits on main to 26 October (30). 4.0.0-beta.1 and beta.2 on 25 September and beta.3 on 6 October, plus 3.5.1 on 4 September, inside 90 days (20). The newest outside issue (#3953, 19 October) got a maintainer reply the same day and a follow-up on 28 October, four issues are open, and outside pull requests from four contributors were merged, per AUTHORSHIP.md. Closed issues and pull requests couldn't be read (robots.txt), so not sampled further (17 of 25). In the official MCP registry as io.github.MikkoParkkola/mcp-gateway under a GitHub namespace, latest 3.5.1, the current stable release (15). Dependabot merges, cargo audit in CI and current tokio and jsonschema, less 2 because the npm wrapper installs a downloaded binary without checking its checksum (8 of 10). 30 + 20 + 17 + 15 + 8 = 90.

SandBase 68

Read for a hosted service with an open CLI and SDKs. sandbaseai/cli tagged v0.3.9 on 7 November 2026, npm @sandbaseai/cli 0.3.8 was published on 25 October, and the catalogue repository refreshed on 8 November (30). Tags v0.1.14 to v0.1.17 on 15 and 19 August, v0.3.0 to v0.3.6 on 11 and 12 October, v0.3.8 on 24 October and v0.3.9 on 7 November (20). The platform is closed and GitHub's API refused the graders, so issue queues are unread and the 0 to 15 scale for closed services applies. No public changelog for the API or MCP server, support by GitHub Discussions, issue forms and Discord (untested), and every merged pull request came from a sandbaseai branch, with commits from two people under three account names. Paid earned 5 with a support channel and no changelog, and Monid 6 with merged outside pull requests (5 of 15). The official MCP registry couldn't be read (the fetch needed an approval that didn't come), so presence there scores absent although server.json declares io.github.sandbaseai/cli. Official SDKs in Python, TypeScript and Go exist only in the GitHub repository at 0.1.0, a week old, and the TypeScript README says to copy the file until the npm package is published (5 of 15). CI runs lint, tests, a build and a package audit that rejects lifecycle scripts, with a lockfile and three runtime dependencies, and npm publishing is configured with provenance. CI results weren't read (8 of 10). 30+20+5+5+8 = 68.

MCP Gateway 60

PolyForm Noncommercial 1.0.0, source-available and not OSI, with affirmative SPDX headers on every first-party file and LICENSES.md, NOTICE.md and COMMERCIAL.md that agree with each other and say what the earlier MIT grants still cover. Read as gaia's PolyForm source was (20 of 30). Self-hosted, so data stays where the owner runs it; secrets go to the OS keychain, files holding them are 0600 on Unix, and SECURITY.md states the Windows gap. There is no privacy statement (20 of 30). Deprecation notices with versions for the MIT 3.0.0 to 3.2.1 releases on crates.io and npm, upgrade guides for 3.0 and 4.0 and a stated support window of the latest release only, but the 3.3.0 relicence has no changelog entry, and AUTHORSHIP.md says the licensing scheme still awaits an IP lawyer's sign-off (9 of 20). No telemetry, analytics or update check found in the source; Prometheus metrics stay local behind a feature flag, and the plugin marketplace host is contacted only by plugin commands. The docs state nothing either way (15 of 20). 20 + 20 + 9 + 15 = 64.

SandBase 48

The editorial half. The catalogue service, routing, billing, API, MCP server, Agents runtime and sandboxes are closed; the CLI, bridge, skill, catalogue, examples and SDKs are Apache-2.0. The terms (14 October 2026) name AXIOMCLOUD PTE. LTD. under Singapore law and cover agents, scraping APIs, provider licences and billing, with no registration number or address on any page read. Paid, Nevermined and Monid earned 17 for closed platforms with open SDKs (17 of 30). The privacy policy (30 October 2026) names the company, lists the customer content it handles and says the information an operation needs goes to the selected provider. It states no retention periods ('We do not claim a universal retention duration'), says only that it 'does not grant SandBase an unrestricted right' to use private content, and asserts no transfer mechanism. It agrees with the terms but leaves retention and training open. OpenRouter earned 15 where the policies settled storage, and Monid 5 where they were silent on run data (12 of 30). No deprecation policy or dated notices. The terms promise notice of material changes and say that beta parts of the service 'may change, have quotas or be discontinued', and the pricing page promises notice before sandbox pricing changes (3 of 20). The policy names Cloudflare, Google and GitHub sign-in, Stripe, Airwallex, Google Analytics 4 and PostHog (United States), but not the hosting provider, other data locations or the model and data providers. Monid earned 6 and Nevermined 14 (9 of 20). 17+12+3+9 = 41. The provenance half is computed from the provenance block.

MCP Gateway 30

Self-hosted rule, scored on the paid option because any company use needs a commercial licence, as gaia and screenpipe (also noncommercial licences) were read. No payment protocol (0). The standard commercial licence is a public flat EUR 500 a month per named project through GitHub Sponsors, plan-only pricing (10). Personal and noncommercial use is free with no card or account, but there is no free route or stated evaluation period for a company (10 of 20). It installs from Homebrew, crates.io or ghcr.io with no sign-up, and an agent with a shell can run the setup wizard, but buying the licence takes a person on GitHub Sponsors, as screenpipe's did (10 of 20). 0 + 10 + 10 + 10 = 30.

SandBase 40

No x402, MPP or L402 on the home page, pricing, billing, llms.txt or the OpenAPI paths; the balance is funded through Stripe or Airwallex checkout (0). Prices per million tokens, per image, per seconds of video or per call on public pages without a login, such as anthropic/claude-sonnet-5.5 at $1.70 in and $8.50 out per million tokens, and inspect returns each price before a run (20). Every organisation gets 100 free calls a day on eligible data APIs, which a zero-balance organisation can still use per the skill, and Start is $0. No card requirement was found on the pricing page or the billing guide, which asks for a saved card only for auto top-up. Nevermined earned 20 for a free plan with no card requirement found (20). A person approves a browser sign-in, through the CLI's flow or the console, before any key exists, and no keyless or programmatic route was found (0). 0+20+20+0 = 40.