MCP Gateway Benchmark: Latency & Security of 6 Gateways
An MCP gateway sits between an AI agent and the tools it calls, and vendors position it as the security layer for that traffic. We benchmarked six MCP gateways against one instrumented backend on a single box, measuring added latency, per-tool authorization, content protection, and audit completeness.
MCP gateway benchmark results
A product appears against a control only if it ships one and that control ran, so nobody is scored zero for a feature they do not sell.
Two of the six measured gateways ran an injection detector in the configurations available to us. Cortx stopped all 60 injected instructions and TrueFoundry 55 of 60. Through the other four, an instruction planted in a tool response reached the client.
ContextForge ships 44 plugins.1 The three whose names contain “inject” add an HTTP header, a privacy notice, and a license header, and none of the rest detects injection.
Credential scanning is the better-served dimension. Five gateways stopped all three pattern-matchable formats. Cortx, Lasso and TrueFoundry redact the matched secret and return the rest of the response. ContextForge and Docker withhold the entire tool output, so the caller also loses the error message.
Three products ship their content controls switched off, which is the state most readers will find them in. ContextForge catches credentials once an operator enables its plugins. Cortx scans tool responses only after an organization admin turns that on.
Injected instructions in tool responses
The probe returns a tool response carrying an instruction addressed to the model in two forms: an item within a structured list and a sentence embedded in free text. A gateway that inspects tool output should strip or refuse it.
TrueFoundry blocks 27 of 30 on the list shape and 28 of 30 on the free-text shape, using its built-in prompt-injection detector at the default enforcing setting. The refusal names the rule that fired.
Five of 60 attempts still reached the client, and the default strategy lets a request through when the detector itself errors.
Cortx blocks 30 of 30 on both shapes with its indirect-injection detector in enforcing mode. In place of the tool output, the client receives a notice naming what the detector matched. Its settings also let a response through when a detector fails.
We tested both detectors on one instruction in two shapes. The result does not cover other instructions and does not rank the two products.
The probe measures whether the gateway removes the text. It does not test whether a model would follow the instruction.
Backend credentials in tool responses
The backend returns an error containing four credentials: a GitHub token, an AWS access key id, a JWT, and an arbitrary vendor string.
None of the tested scanners caught the arbitrary vendor string, because none carried a rule written for its shape. ContextForge and Docker stopped it only because they withheld the whole response after detecting the other three.
Docker’s secret scanning is on by default, and it is the only credential control in this table that an operator gets without configuring anything.
Per-tool authorization
The probe scopes a credential to exclude one tool, then calls that tool directly by name.
Four of the six enforce, and none of them return the withheld data. Docker’s open-source build runs without a caller credential, so it can hide a tool globally but cannot give two callers different tool sets. Lasso’s plugin surface is guardrails and tracing, with no authorization step at all.
Bifrost measures 840 microseconds with a scoped key and 866 with an unscoped one, a gap smaller than the variation between repetitions. Scoping a credential carried no latency penalty we could resolve.
Cortx and TrueFoundry name the restriction, Cortx returning “Tool not permitted for this session”. Bifrost and ContextForge report the tool as not found. Neither behavior is scored here.
Audit completeness
We read every audit surface we could identify. Most products split the record between a log and a database.
TrueFoundry and Cortx record authorization denials. TrueFoundry’s trace for the refused call carries the tool name, the caller’s email, the arguments, and the refusal text. Cortx’s record carries the tool name, the caller’s user ID, the arguments, and a DENIED outcome with the reason.
Bifrost and ContextForge both block an unauthorized call, and neither records it. Their stores held the same row count before and after the attempt.
ContextForge recorded no failed invocation in our deployment, and its 26-column audit_trails table stayed empty throughout.
Docker is the only self-hosted gateway that leaves any trace of a blocked call, and the trace reads as a success. The line carries the tool name and a plausible two-millisecond duration with no outcome field, so an operator scanning for security events would not find it.
Cortx records the tool arguments and the full response. Bifrost, Lasso and TrueFoundry do the same. Cortx’s gateway activity view shows only the latest 50 calls, but a second store still held our calls from six weeks earlier, with their arguments.
Added latency
Bifrost adds 840 microseconds per call, Docker 1,134, and ContextForge 23,058. ContextForge adds 27 times as much latency as Bifrost.
Bifrost’s own figure is under 100 microseconds per request, measured at 5,000 requests per second.2 Our test sent one request at a time and measured 840 microseconds. We did not test at 5,000 requests per second, so this result does not show the claim is wrong.
A gateway also slows traffic that never routes through it. While Docker or ContextForge was serving, calls made straight to the backend ran about 0.9 milliseconds slower, between 858 and 973 microseconds across the four timing tasks.
That effect would not apply to a gateway on its own host, so it is reported separately from the routed-call figures above.
Cost of governance
Two products could be measured with their content control off and on, changing one setting between the pairs.
ContextForge’s four detectors cost 3,198 microseconds, an 11.5% increase. Between-repetition standard deviations were 157 microseconds with them off and 73 with them on. This baseline is not comparable with the latency chart: the plugin framework and the tool count both differed, so only the change within the pair holds.
TrueFoundry’s two guardrails take it from 55.5 to 172.1 milliseconds, roughly triple. Its three repetitions measured 152.6, 163.4 and 200.3 milliseconds. With the detectors off, the between-repetition standard deviation was 1.5 milliseconds.
The two detector types cost different amounts. ContextForge’s pattern matching added 11.5%, while TrueFoundry’s injection and secret detection together roughly tripled the figure and varied from 152.6 to 200.3 milliseconds across repetitions, so a single run would not have shown that range.
What is an AI control plane?
We tested Cortx and TrueFoundry as hosted services. They are AI control planes: a hosted layer that holds the policy, the identity and the audit trail for an organization’s AI traffic, and routes tool calls through itself so one set of rules applies everywhere.
The gateway moves traffic. The control plane decides what is allowed and records what happened. Vendors sell the second as the reason to buy the first.
Both figures are dominated by network distance. Cortx adds 211.1 milliseconds and TrueFoundry 55.5 from the same box, and the round trip alone is about 100 milliseconds to Cortx’s region against 14.1 to TrueFoundry’s. Two crossings account for roughly 200 of Cortx’s 211 milliseconds. We never rank the two against each other.
A control plane claims one policy applies everywhere, so that is what we tested. Cortx ships response scanning for MCP tool calls off, and only an organization admin can switch it on. With scanning on, the injection detector in enforcing mode and a policy that enables two built-in categories at Block, Cortx withheld every response carrying the injected instruction and masked the three standard credential formats, returning the rest of the error text.
With the policy active and the organization switch off, every credential format and both instruction forms reached the client. Cortx catches injection with a separate detector rather than a policy category. The detector blocks only in its enforcing mode. In monitor mode, it flags the instruction and lets the response through.
A control plane can therefore show an active policy and still not scan the path you care about. Ask a vendor which setting puts its engine on the tool-response path and which mode its detectors run in. Cortx and TrueFoundry are two of the 12 control planes we scored on feature coverage; this benchmark measures what two of them actually do on the MCP path.
Add as preferred sourceWhat is an MCP gateway?
The Model Context Protocol enables an AI agent to discover and call tools that reside outside it, such as a database query service or an internal API. A gateway is a proxy that all those calls pass through, so an operator can point many agents to one address instead of wiring each agent to each tool.
A gateway centralizes four jobs across many agents and tools. It decides which caller may use which tool, inspects the tool’s output before the model reads it, records what happened, and routes traffic.
What the path does and does not cover
A gateway sees tool calls and tool responses. It does not see the model’s private reasoning or the full chat context, so this benchmark tests injection controls on tool responses only.
It also only protects traffic that goes through it. We left the backend directly reachable and did not score bypass resistance because that result would depend on deployment-network controls outside the gateway path.
MCP gateway benchmark methodology
Products: seven selected, six measured. Bifrost v1.6.10, Docker MCP Gateway v0.43.3, IBM ContextForge v1.0.7, Lasso Security v1.2.1 (self-hosted); Cortx v1.1, TrueFoundry Developer tier console 0.167.0 (hosted). Portkey produced no measurement. Its workspace sync reported success while our origin log recorded zero connections, and the free-tier account we tested lacked the key class an organization-level integration requires.
Measurement dates: Standalone MCP tools latency 2026-08-13, policy and audit sweep 2026-08-21, TrueFoundry hosted latency 2026-08-17, Cortx hosted latency 2026-08-19.
Environment: one 8-vCPU box, gateway and mock backend co-located, Caddy over TLS. Hosted gateways are accessed over the WAN, so their figures include network latency that this setup cannot cleanly separate from gateway processing. Cortx egresses from AWS us-east-1; TrueFoundry’s region was not independently identified.
Backend: one mock MCP server, 16 tools, deterministic per-tool delays, 4 of them pure echoes for timing. It leaks 4 credential formats on request (GitHub token, AWS key id, JWT, arbitrary vendor string), returns injected instructions in 2 shapes (structured list, free text), and logs every call. The three standard credential formats are synthetic, with lengths and structures that satisfy the format rules real secret scanners use.
Client: a deterministic MCP client with no language model. A model in the path would add seconds of variance to a microsecond measurement without changing what the gateway does.
Latency: median added latency at concurrency 1, the gateway-routed call minus a matched direct-to-backend call, with the two paths interleaved to reduce drift bias. Bifrost 5 repetitions, Docker and ContextForge 3, at 200 calls per task per repetition. Sequential sampling was rejected: it overstated Docker by 89% and Bifrost by 54%. Lasso runs over stdio rather than a socket, so it has no comparable figure.
Policy probes (n=30 each): an injected instruction on 2 shapes, a credential leak on 4 formats, and a call to a tool the credential is not scoped for. The direct-to-backend baseline returned every payload, so a zero through a gateway indicates the gateway acting, not a failed probe.
Configuration: every product measured with the strongest content controls available to us, keeping the shipped detector parameters. We wrote no pattern to match the test payload. When a product has a default and a governed configuration, we publish both. TrueFoundry, ContextForge and Cortx each shipped their content control off and were re-measured with it on, and all three logged enforcement on the tested path. On Cortx, its vendor xnode set the organization-level switch and the detector mode, which our account cannot change, and added standard vendor token formats, including GitHub’s, to our workspace’s pattern library.
Audit: We read every audit surface we identified, including stdout, database stores, activity logs, and hosted trace views. We checkpointed database stores before counting rows.
For model-level results, see the agentic LLM benchmark.
Cite this benchmark
Pick the format that matches where you're publishing. Pasting the link version into your CMS preserves the backlink.
@misc{kalelioglu2026,
author = {Kalelioğlu, Berk},
title = {{MCP Gateway Benchmark: Latency & Security of 6 Gateways}},
year = {2026},
month = oct,
howpublished = {\url{https://aimultiple.com/mcp-gateway}},
note = {AIMultiple. Retrieved October 5, 2026}
}Results and timestamps of 35 data points. Download the summary data shown in this article's charts and tables as a ZIP file containing 7 CSV files and a README.
Want the granular data behind it? Join Premium
Changelog
2 updatesAdded benchmark results section comparing six MCP gateways on latency and security
Added IBM ContextForge, Kong AI Gateway and MintMCP Gateway to the gateway coverage.
Reference Links
Be the first to comment
Your email address will not be published. All fields are required. Comments are left in their original language.