MCP Gateway vs Zapier MCP (agent actions)

MCP Gateway 87

Local-package reading, as for graphicle and claude-mem, since the owner runs it. Official packages on crates.io (cargo install mcp-gateway), a Homebrew tap, release binaries and ghcr.io, with Rust 1.95 and macOS, Linux and Windows builds stated (20). A public CI workflow runs clippy with warnings as errors, the full test suite, fmt, cargo audit, secret scans and Helm smoke tests on pushes and pull requests, and the last eight runs on main passed by 26 October 2026 (25). Four open issues on GitHub on 2 November 2026, one a labelled bug filed by the maintainer, and the newest outside issue was answered the day it was opened. Closed issues couldn't be read (robots.txt), so the record is partial (18 of 25). Keep a Changelog with BREAKING entries and migration notes for 3.0 and 4.0 and an UPGRADING-4.0.md, but 3.3.0, which relicensed the code, has no changelog section, and 4.0.0 is dated 19 September there while only betas exist (9 of 15). Stable is 3.5.1, after two earlier majors; 4.0.0 is in beta (15). 20 + 25 + 18 + 9 + 15 = 87.

Zapier MCP (agent actions) 48

Statuspage at status.zapier.com with an MCP component and an incident feed (20). No incident in the last 90 days names MCP, but Webhook Triggers and Zap Actions, including Searches & Writes, were disrupted for about 1 hour 35 minutes on 8 September 2026, 401s hit several products for about 1 hour 15 minutes on 13 July, and the feed lists 20 more app-specific incidents (10). No numeric rate limits, the docs say there's no per-session limit and the task allowance is the only cap (5). At the cap calls stop with an error, with no Retry-After or retry guidance (3). No SLA found (0). The MCP server is GA (registry 1.0.1 on 29 July 2026), the SDK is in open beta (10).

MCP Gateway 80

Read with the API checklist, as the gateway is the security layer an operator puts in front of agents. Over HTTP, bearer tokens and API keys with per-key glob allow and deny lists, explicit admin keys, OIDC JWT and mTLS, with OAuth 2.1 to backends, per-issuer token storage and per-user isolation that fails closed. Authentication is off by default on the loopback HTTP port, where callers are anonymous non-admins, and a stdio caller is admin (24 of 30). Management tools need an admin credential since 3.5.0, per-key tool scopes give least privilege, and destructive meta-tools ask the human through elicitation, refused on the 2026-07-28 protocol when the client can't ask and allowed after a warning on older clients; the source calls the prompt a courtesy, with the admin requirement as the control (16 of 20). Backend tool descriptions are scanned for poisoning patterns before they reach the agent, capability files can be hash-pinned, and responses pass a pattern-based injection scanner and credential redactor (13 of 15). NDJSON audit log, per-key cost and usage accounting, Prometheus metrics and trace ids (13 of 15). SECURITY.md with private reporting, a 48-hour acknowledgement and a 7-day fix target; two advisories published with credit on 28 August 2026; cargo audit, secret scanning and cosign-signed images in CI; no bug bounty or security.txt, and the OWASP mapping is self-assessed (14 of 20). 24 + 16 + 13 + 13 + 14 = 80. The DNS-rebinding advisory is a negative event below.

Zapier MCP (agent actions) 56

OAuth for listed clients, otherwise a long-lived connection token tied to one server, revoked by regenerating it. The docs document ?token= in the URL as a working option while preferring the header, so we deduct 10 (12). Account-level app and action restrictions apply, managed mode limits the agent to chosen actions, admins can switch MCP off per workspace and set task quotas, but there's no approval step for writes (15). Actions return email, CRM and document content with no prompt-injection guidance (3). User-level activity logs for every tool call in the History tab, which are deleted with the server (13). SOC 2 Type II and SOC 3 and a bug bounty on the security page, no platform named, no ISO 27001, and no security.txt per the 30 September check (13).

MCP Gateway 90

4.0.0-beta.3 on 6 October 2026, 27 days before the check, and commits on main to 26 October (30). 4.0.0-beta.1 and beta.2 on 25 September and beta.3 on 6 October, plus 3.5.1 on 4 September, inside 90 days (20). The newest outside issue (#3953, 19 October) got a maintainer reply the same day and a follow-up on 28 October, four issues are open, and outside pull requests from four contributors were merged, per AUTHORSHIP.md. Closed issues and pull requests couldn't be read (robots.txt), so not sampled further (17 of 25). In the official MCP registry as io.github.MikkoParkkola/mcp-gateway under a GitHub namespace, latest 3.5.1, the current stable release (15). Dependabot merges, cargo audit in CI and current tokio and jsonschema, less 2 because the npm wrapper installs a downloaded binary without checking its checksum (8 of 10). 30 + 20 + 17 + 15 + 8 = 90.

Zapier MCP (agent actions) 76

SDK release on 29 September 2026 per the 30 September check, at 0.113.0 for the TypeScript SDK and 0.85.0 for the CLI (30). The changelog lists versions 0.79.0 to 0.113.0 without dates, so we can't count releases in the last 90 days ourselves and gave partial credit (15). Closed service with an SDK changelog, support and a send_feedback tool in the server, and no public issue tracker (10). Registered as com.zapier/mcp 1.0.1 in the official MCP registry (15). The SDK packages are current on npm but still in beta (6).

MCP Gateway 60

PolyForm Noncommercial 1.0.0, source-available and not OSI, with affirmative SPDX headers on every first-party file and LICENSES.md, NOTICE.md and COMMERCIAL.md that agree with each other and say what the earlier MIT grants still cover. Read as gaia's PolyForm source was (20 of 30). Self-hosted, so data stays where the owner runs it; secrets go to the OS keychain, files holding them are 0600 on Unix, and SECURITY.md states the Windows gap. There is no privacy statement (20 of 30). Deprecation notices with versions for the MIT 3.0.0 to 3.2.1 releases on crates.io and npm, upgrade guides for 3.0 and 4.0 and a stated support window of the latest release only, but the 3.3.0 relicence has no changelog entry, and AUTHORSHIP.md says the licensing scheme still awaits an IP lawyer's sign-off (9 of 20). No telemetry, analytics or update check found in the source; Prometheus metrics stay local behind a feature flag, and the plugin marketplace host is contacted only by plugin commands. The docs state nothing either way (15 of 20). 20 + 20 + 9 + 15 = 64.

Zapier MCP (agent actions) 74

Closed service under Zapier's terms (15). Data stored in AWS us-east-1, configurable retention only on Enterprise, and only Enterprise is opted out of AI training by default, which leaves other plans' position unstated on the MCP security page (18). AI Actions and NLA retired with a pointer to MCP, the SDK attaches deprecation notices to tool results and has stated stability tiers (16). Data location stated, subprocessor list not checked in this run (12).

MCP Gateway 75

Every meta-tool declares a typed JSON Schema input with required fields, read from src/gateway/meta_mcp_tool_defs.rs, and server.json is published to the official registry. gateway_invoke passes backend arguments as an open object by design (22 of 25). llms.txt at the repository root, and Markdown docs in the tree (10). Descriptions say what each tool does and when (search first, then invoke; kill and revive say what they change for every session), and the initialize preamble names the discovery order. Backend tool descriptions come from the user's servers and aren't the gateway's (14 of 20). gateway_list_tools has an enum on role, gateway_search caps limit at 25 and detail is an enum, nonce has length bounds; limit on gateway_search_tools has no maximum (11 of 15). README, QUICKSTART, an annotated gateway-full.yaml and a troubleshooting section; errors are described in prose, with did-you-mean suggestions, and there is no error reference (8 of 15). Semver over the CLI and config file, stated in the README, and a long changelog, less for the missing 3.3.0 section and the misdated 1.0.0 and 2.0.0 entries (10 of 15). 22 + 10 + 14 + 11 + 8 + 10 = 75.

Zapier MCP (agent actions) 64

MCP tools carry JSON Schema by protocol, but the 16 meta-tools are server-side and action schemas are generated per app, so we couldn't read them (15). llms.txt with .md pages for every MCP doc (10). The docs say when to use the read and write execution tools, while action schemas are terse (12). Action input typing not visible to us (7). Troubleshooting guides cover MCP errors, with few worked examples of calls (10). Registry versions and an SDK changelog with stability tiers, but no dated changelog for the hosted MCP server itself (10).

MCP Gateway 77

MCP context cost. Nine to 17 meta-tools, 11 in the default admin set, whatever the number of backends, so 15 for 11 to 30 tools, plus 10 back for Code Mode's two tools, exposed_meta_tools and surfaced tools (25). The project's own live run of 4 September 2026 found the meta path used 1.2 to 16.1 per cent more input tokens and one extra turn on every task, which the README states; the context saving is a schema-size saving, so less 5 (20 of 25). gateway_search_tools and gateway_search take limit, gateway_search has L0, L1 and L2 detail tiers, gateway_list_tools filters by server and role, and backend responses can be shaped with transform chains (17 of 20). Did-you-mean on tool names, LLM-readable output-schema failures, circuit-breaker and disabled status in gateway_list_servers, and rate-limited calls excluded from the kill budgets (16 of 20). Meta-tools carry readOnlyHint, destructiveHint, idempotentHint and openWorldHint; destructive meta-tools ask through elicitation, which the source calls a courtesy rather than a control; an idempotency guard exists per ADR-012 (16 of 20). One required argument for search and two for invoke; Rust only, no SDK applies, and setup takes a wizard and a config file (8 of 15). 20 + 17 + 16 + 16 + 8 = 77.

Zapier MCP (agent actions) 67

16 fixed meta-tools in agentic mode, which discover, enable and run actions at runtime, or managed mode with only pre-selected actions (25). The SDK pages list results with cursors, but we found no output-size controls on MCP action results (12). Errors come from the app behind each action, and troubleshooting guides cover the common MCP failures (12). Reads and writes run through separate tools, but we found no annotations or idempotency guidance, and a batch of five rows is five separate calls (10). The SDK is TypeScript only and in beta (8).