Nine platforms for governing MCP servers in the enterprise

Installing an MCP server takes a couple of minutes and one line in a config file. That ease is exactly the problem Tech Insider describes in its roundup of the nine top MCP security platforms for 2026: security teams are finding "dozens or hundreds" of MCP servers running across their environments, and many of them were never approved.

The article, published this week, does not rank the tools or cite incident counts or CVEs. Anyone who has to decide on budget gets something more useful: a map of which problem each tool solves and, above all, what it leaves uncovered.

Six attack vectors that are no longer theoretical

Before getting to products, the piece lists the risks that justify this category:

Shadow MCP: servers that developers install locally without going through any control.
Tool poisoning: hidden instructions in a tool description that the model reads and obeys.
Supply chain changes: an already approved server that changes its behaviour after deployment.
Over-permissioned credentials, which open the door to confused deputy attacks.
Indirect prompt injection: retrieved content (an email, a web page, a ticket) that steers the agent off course.
Data exposure through tool responses.

Anyone who has connected Claude to a third-party server will recognise several of these. A tool description goes into the model's context as is, and almost nobody reviews it line by line when updating a package.

What each platform does

The list groups very different approaches:

Dash Security focuses on discovering and governing the whole "agentic estate": MCP servers, skills and plugins. It says it detects more than 60 unique AI platforms without installing agents, and promises to go from discovery to policy enforcement in a week.
Akto brings its API security experience to MCP, with shadow MCP detection, a testing library and anomaly monitoring.
Stacklok ToolHive, from the founders of Kubernetes, isolates each server in its own container, adds signing and provenance and offers a Kubernetes operator. It is open source with enterprise options.
Docker MCP Gateway packages servers as OCI containers, with a signed catalog built into Docker Desktop. According to the article, it performs best in environments that are already Docker-native.
Snyk, after acquiring Invariant Labs, provides MCP-Scan to detect dangerous tool descriptions and guardrails on agent behaviour.
Kong AI Gateway extends its API gateway to MCP traffic with authentication, rate limiting, logging and policies.
Descope focuses on identity: OAuth, agent identities and scoped, revocable access.
Obot is an open source, self-hosted gateway and catalog with container isolation.
* Microsoft MCP Gateway manages MCP traffic with Entra ID access control on Azure and AKS. It makes more sense the more Azure an organisation already uses.

The limits of gateways

The most relevant line in the piece is a warning: a gateway controls the traffic routed through it well, but it does not see locally installed servers and cannot always detect risks that emerge mid-session. That caveat matters to any team working with Claude Code or Claude Desktop, where many servers are launched over stdio on the developer's machine and never touch the corporate network.

That is why the article proposes five complementary layers: discovery, gateway and isolation, identity, pre-deployment testing and scanning, and runtime enforcement with intent drift detection. No product on the list covers all five equally well.

Who it is useful for

For a CISO or a platform lead, what counts is the fit with what already exists. If the company lives on Azure, Microsoft's gateway is the natural starting point; if it already uses Kong or Snyk, extending those tools is cheaper than adding a vendor. Small teams can start without licences using ToolHive or Obot.

Developers have controls that require no purchase at all: pinning server versions, reviewing tool descriptions on every update, giving each server minimal credentials and using hooks such as PreToolUse in Claude Code to block specific calls before they run.

At ElephantPink we build custom MCP servers and see every day how quickly connections pile up that nobody remembers approving. We agree with the article: inventory comes first, and buying a gateway without knowing which servers exist only gives a false sense of control.