MCP Gateway vs Smithery

MCP Gateway 90

4.0.0-beta.3 on 6 October 2026, 27 days before the check, and commits on main to 26 October (30). 4.0.0-beta.1 and beta.2 on 25 September and beta.3 on 6 October, plus 3.5.1 on 4 September, inside 90 days (20). The newest outside issue (#3953, 19 October) got a maintainer reply the same day and a follow-up on 28 October, four issues are open, and outside pull requests from four contributors were merged, per AUTHORSHIP.md. Closed issues and pull requests couldn't be read (robots.txt), so not sampled further (17 of 25). In the official MCP registry as io.github.MikkoParkkola/mcp-gateway under a GitHub namespace, latest 3.5.1, the current stable release (15). Dependabot merges, cargo audit in CI and current tokio and jsonschema, less 2 because the npm wrapper installs a downloaded binary without checking its checksum (8 of 10). 30 + 20 + 17 + 15 + 8 = 90.

Smithery 43

The newest release found is @smithery/api 0.68.0 on 20 July 2026, 81 days before the check. The CLI's last release and last commit are 1.2.0 on 31 May 2026 (20). One release in the last 90 days (0). The CLI repository, now under arcadeai-labs, shows 51 open issues and no push since 31 May. The issues themselves were not read, and a Discord server is linked for support (6). One current official client, in TypeScript (10). Both repositories carry CI workflows, lockfiles and release automation (7).

MCP Gateway 80

Read with the API checklist, as the gateway is the security layer an operator puts in front of agents. Over HTTP, bearer tokens and API keys with per-key glob allow and deny lists, explicit admin keys, OIDC JWT and mTLS, with OAuth 2.1 to backends, per-issuer token storage and per-user isolation that fails closed. Authentication is off by default on the loopback HTTP port, where callers are anonymous non-admins, and a stdio caller is admin (24 of 30). Management tools need an admin credential since 3.5.0, per-key tool scopes give least privilege, and destructive meta-tools ask the human through elicitation, refused on the 2026-07-28 protocol when the client can't ask and allowed after a warning on older clients; the source calls the prompt a courtesy, with the admin requirement as the control (16 of 20). Backend tool descriptions are scanned for poisoning patterns before they reach the agent, capability files can be hash-pinned, and responses pass a pattern-based injection scanner and credential redactor (13 of 15). NDJSON audit log, per-key cost and usage accounting, Prometheus metrics and trace ids (13 of 15). SECURITY.md with private reporting, a 48-hour acknowledgement and a 7-day fix target; two advisories published with credit on 28 August 2026; cargo audit, secret scanning and cosign-signed images in CI; no bug bounty or security.txt, and the OWASP mapping is self-assessed (14 of 20). 24 + 16 + 13 + 13 + 14 = 80. The DNS-rebinding advisory is a negative event below.

Smithery 50

An API key has full namespace access. Service tokens are scoped by namespace, resource, operation and metadata, last 24 hours at most and can be narrowed, and team keys can be revoked. Token Scoping is in preview (26). Read-only and execute-only tokens are documented. No approval step for destructive tools was found (12). Connected servers return third-party content. A registry record carries security.scanPassed, and no prompt-injection guidance was found (4). Runtime logs by invocation exist for people who publish a server. No call log for connection users was found (5). The docs say stored credentials are encrypted and write-only. security.txt answered 404, and no certification, bounty or disclosure policy was found beyond a contact address (3).

MCP Gateway 87

Local-package reading, as for graphicle and claude-mem, since the owner runs it. Official packages on crates.io (cargo install mcp-gateway), a Homebrew tap, release binaries and ghcr.io, with Rust 1.95 and macOS, Linux and Windows builds stated (20). A public CI workflow runs clippy with warnings as errors, the full test suite, fmt, cargo audit, secret scans and Helm smoke tests on pushes and pull requests, and the last eight runs on main passed by 26 October 2026 (25). Four open issues on GitHub on 2 November 2026, one a labelled bug filed by the maintainer, and the newest outside issue was answered the day it was opened. Closed issues couldn't be read (robots.txt), so the record is partial (18 of 25). Keep a Changelog with BREAKING entries and migration notes for 3.0 and 4.0 and an UPGRADING-4.0.md, but 3.3.0, which relicensed the code, has no changelog section, and 4.0.0 is dated 19 September there while only betas exist (9 of 15). Stable is 3.5.1, after two earlier majors; 4.0.0 is in beta (15). 20 + 25 + 18 + 9 + 15 = 87.

Smithery 60

Read with the hosted lines. status.smithery.ai on Better Stack lists the site, the API and the gateway (20). Each shows 100 per cent uptime over 90 days. The page's incident list is a script-drawn tab and was not read, so 25 of 30 (25). No rate limits were found in the docs index or the API description (0). The API description declares no 429. The TypeScript client retries 408, 409, 429 and 5xx twice with backoff, and the PUT endpoints are described as idempotent upserts. No retry guidance for tool calls was found (8). No SLA was found (0). The connection API carries no beta label, while Token Scoping and the typed SDKs are marked preview and the client is at 0.68 (7).

MCP Gateway 30

Self-hosted rule, scored on the paid option because any company use needs a commercial licence, as gaia and screenpipe (also noncommercial licences) were read. No payment protocol (0). The standard commercial licence is a public flat EUR 500 a month per named project through GitHub Sponsors, plan-only pricing (10). Personal and noncommercial use is free with no card or account, but there is no free route or stated evaluation period for a company (10 of 20). It installs from Homebrew, crates.io or ghcr.io with no sign-up, and an agent with a shell can run the setup wizard, but buying the licence takes a person on GitHub Sponsors, as screenpipe's did (10 of 20). 0 + 10 + 10 + 10 = 30.

Smithery 10

No x402, MPP or L402 (0). The pricing page is drawn by script and was not read, so no price is scored. This is a limit of our reading and not a finding about the vendor (0). Arcade's announcement says sign-up is free. Whether a card is needed was not established, so half marks (10). A person signs in through a browser to get an API key or to log the CLI in (0).

MCP Gateway 77

MCP context cost. Nine to 17 meta-tools, 11 in the default admin set, whatever the number of backends, so 15 for 11 to 30 tools, plus 10 back for Code Mode's two tools, exposed_meta_tools and surfaced tools (25). The project's own live run of 4 September 2026 found the meta path used 1.2 to 16.1 per cent more input tokens and one extra turn on every task, which the README states; the context saving is a schema-size saving, so less 5 (20 of 25). gateway_search_tools and gateway_search take limit, gateway_search has L0, L1 and L2 detail tiers, gateway_list_tools filters by server and role, and backend responses can be shaped with transform chains (17 of 20). Did-you-mean on tool names, LLM-readable output-schema failures, circuit-breaker and disabled status in gateway_list_servers, and rate-limited calls excluded from the kill budgets (16 of 20). Meta-tools carry readOnlyHint, destructiveHint, idempotentHint and openWorldHint; destructive meta-tools ask through elicitation, which the source calls a courtesy rather than a control; an idempotency guard exists per ADR-012 (16 of 20). One required argument for search and two for invoke; Rust only, no SDK applies, and setup takes a wizard and a config file (8 of 15). 20 + 17 + 16 + 16 + 8 = 77.

Smithery 65

Graded as an API. Registry lists take fields, the CLI has tool find and tool get, and one call lists tools across a namespace. The namespace MCP endpoint loads every connection's tools, so context grows with the number of connections (15). page and pageSize up to 100, cursor and limit on connections, and metadata filters (16). Errors carry error and message, and a connection that needs action returns auth_required or input_required with setupUrl and the missing fields (15). Upserts are idempotent and the client retries safely. Tool calls take no idempotency key, and whether upstream MCP annotations are passed through was not established (10). A namespace and connection ID are created when omitted. One official client language, TypeScript, plus the CLI (9).

MCP Gateway 60

PolyForm Noncommercial 1.0.0, source-available and not OSI, with affirmative SPDX headers on every first-party file and LICENSES.md, NOTICE.md and COMMERCIAL.md that agree with each other and say what the earlier MIT grants still cover. Read as gaia's PolyForm source was (20 of 30). Self-hosted, so data stays where the owner runs it; secrets go to the OS keychain, files holding them are 0600 on Unix, and SECURITY.md states the Windows gap. There is no privacy statement (20 of 30). Deprecation notices with versions for the MIT 3.0.0 to 3.2.1 releases on crates.io and npm, upgrade guides for 3.0 and 4.0 and a stated support window of the latest release only, but the 3.3.0 relicence has no changelog entry, and AUTHORSHIP.md says the licensing scheme still awaits an IP lawyer's sign-off (9 of 20). No telemetry, analytics or update check found in the source; Prometheus metrics stay local behind a feature flag, and the plugin marketplace host is contacted only by plugin commands. The docs state nothing either way (15 of 20). 20 + 20 + 9 + 15 = 64.

Smithery 49

The editorial half. The hosted service is closed and no terms of service were found. The CLI is AGPL-3.0, the client Apache-2.0 and the credential layer MIT (12). The privacy notice of 20 June 2025 gives no retention periods, says customer content is used to improve products, describes targeted advertising, and links a Data Policy that answers 404. A data processing agreement is available on request (8). Deprecated operations are marked in the API description with their replacements, with no dates and no policy (5). Stripe is the only processor named, and no hosting location or sub-processor list was found (2).