Last updated October 14, 2026. Product claims, MCP protocol revisions, and list prices were checked against each vendor’s primary docs and pricing pages on that date.
Kong vs AWS AgentCore vs Docker is the MCP gateway comparison platform teams reach when tool traffic must sit on infrastructure they already trust: an API gateway they run, a managed AWS control plane, or container isolation on developer machines.
This post compares Kong AI Gateway’s MCP server layer, Amazon Bedrock AgentCore Gateway, and Docker MCP Gateway as three different answers to the same problem: one governed entry point between agents and tools. Placement is unpaid, per our editorial standards and disclosure policy.
It sits under the MCP and agent protocols hub and the MCP category, next to the AgentOps tools map, the AI Gateways category, and the ToFu MCP security study. We compare deployment model, MCP protocol coverage, identity and ACLs, pricing shapes, and when each wins.
TL;DR
- Kong AI Gateway wins when MCP should inherit the same auth, rate limits, ACLs, and observability you already apply to HTTP APIs. AI MCP Server modes cover conversion, passthrough, and aggregation; client revisions include 2025-03-26 through 2026-07-28 on AI Gateway 2.1+. On Konnect Plus, AI Gateway meters distinct proxied models at $100/mo each (cap five); MCP and model traffic on Gateway Services is included with no separate MCP surcharge per Kong’s usage metrics glossary. Enterprise is custom.
- AWS AgentCore Gateway wins for Bedrock-native agents that need a managed MCP aggregation plane with JWT or IAM inbound auth, credential providers outbound, and MCP/HTTP/inference targets. List price is consumption-based: $0.005 per 1,000 API invocations (ListTools, InvokeTool, Ping), $0.025 per 1,000 Search API calls, and $0.02 per 100 tools indexed per month, per AWS pricing.
- Docker MCP Gateway wins for scoped POCs and local profiles: open-source gateway, Desktop Toolkit with 300+ catalog servers, container isolation, and credential injection. Docs mark MCP Gateway under Docker AI Governance as invite-only through Docker Sales for the governed enterprise packaging.
- Protocol filter: Kong and AgentCore both document client-facing support for the 2026-07-28 stateless MCP revision alongside earlier revisions. Docker’s public docs emphasize orchestration and catalogs rather than a published multi-revision matrix.
- Ops filter: already on Kong Enterprise or Konnect? Prefer Kong. Already shipping agents on Bedrock? Prefer AgentCore. Validating one or two servers this quarter? Prefer Docker, then exit to a governance gateway.
- Security note: every path still needs tool allowlists, outbound credential vaulting, and supply-chain checks; the {il(TOFU, ‘ToFu study’)} found 253 verified bugs across 118 MCP servers.
Kong vs AgentCore vs Docker: The Short Answer
Pick Kong when MCP is another policy surface on the API plane you already staff. Pick AgentCore Gateway when agents, tools, and identity should stay inside an AWS account with managed aggregation. Pick Docker when a team needs isolated containerized servers and a catalog-backed profile before a governed rollout.
| Kong AI Gateway | AWS AgentCore Gateway | Docker MCP Gateway | |
|---|---|---|---|
| Center of gravity | API/AI gateway policies applied to MCP | Managed MCP aggregation on Bedrock | Container orchestration + catalog for MCP servers |
| Typical deploy | Konnect control plane or Gateway Enterprise plugins | Fully managed AWS service | Docker Desktop Toolkit, or CLI plugin on Engine |
| MCP revisions (client) | 2025-03-26, 2025-06-18, 2025-11-25, 2026-07-28 (v2.1+) | 2025-03-26, 2025-06-18, 2025-11-25, 2026-07-28 | Not published as a multi-revision matrix in public docs |
| Inbound identity | AI Auth Strategies (key-auth / OIDC), Consumer ACLs | OAuth JWT, IAM SigV4, authenticate-only, or none (dev) | Per-server credentials / OAuth via Toolkit; Desktop-centric |
| Tool sources | REST conversion, passthrough MCP, listener aggregation | Lambda, API Gateway, OpenAPI, Smithy, MCP servers, connectors | Catalog images, remote servers, profiles |
| Entry list price (Oct 2026) | Konnect Plus: $100/mo per distinct proxied model (max 5); Enterprise custom | $0.005 / 1k Gateway API invocations; Search and indexing separate | $0 OSS / Desktop; AI Governance packaging invite-only |
| Best fit | Kong shops governing MCP + APIs together | Bedrock agents and AWS-native tools | Scoped POC and local multi-client profiles |
How We Compared These Three MCP Gateways
We read each vendor’s product page, pricing page, and the primary MCP gateway docs on October 14, 2026, and captured the pages we cite. The lens is operational: who runs the control plane, which MCP revisions clients can speak, how identity attaches, and what the published fee shape is before custom Enterprise quotes.
- Primary sources only: claims come from Kong AI Gateway, AI MCP Server docs, AgentCore Gateway docs, AgentCore pricing, and Docker MCP Gateway docs.
- No paid bake-off: we did not load-test p99 overhead or judge tool quality, so there are no star ratings.
- Estimates are labeled: any fee examples use published list prices and stated allowances.
- Related reading: for AgentOps placement see AgentOps tools and AI Gateways; for observability neighbors see observability tools, open source LLM observability, and Langfuse vs LangSmith vs Braintrust.
What an MCP Gateway Must Do in 2026
An MCP gateway is the policy and routing plane between MCP clients and one or more MCP servers or converted APIs. Clients should see one endpoint; the gateway handles discovery, auth, aggregation, and audit so agents do not talk to every tool backend with a private credential.
The 2026-07-28 MCP revision is the largest protocol change since launch: it removes the initialize handshake and Mcp-Session-Id, so each request carries MCP-Protocol-Version and related metadata. Gateways that advertise multiple revisions let older and newer clients share one route. That is why revision matrices matter as much as feature checklists.
Security pressure is rising in parallel. The ToFu MCP tool security study fuzzed hundreds of servers and verified hundreds of bugs, which is why allowlists, outbound credential vaulting, and supply-chain provenance belong on the same shortlist as routing features.
Kong AI Gateway: MCP on the API Plane You Already Run
Kong treats MCP as API-level traffic on Kong AI Gateway. AI MCP Server entities (or the AI MCP Proxy plugin on self-hosted Gateway) convert REST APIs into tools, proxy existing MCP servers, or aggregate tools behind one listener. The same rate limits, logging, and auth strategies you apply to HTTP routes can cover MCP clients.
Server modes and protocol coverage
Docs describe five patterns: passthrough-listener for an existing MCP upstream, conversion-listener and conversion-only for OpenAPI-to-tool mapping, listener aggregation across named sources, and upstream-server for feeding that pool. Client-facing revisions include 2025-03-26, 2025-06-18, 2025-11-25, and 2026-07-28 on AI Gateway 2.1+, with allowed_versions to narrow what a server accepts.
Kong is strongest when MCP tools are mostly internal APIs already behind Konnect or Gateway Enterprise. Per-tool ACLs on AI Consumers, protected resource metadata for OAuth discovery, and MCP observability metrics reuse the platform team’s existing operating model.
# Example: narrow accepted MCP revisions on a Kong AI MCP Server (illustrative)
config:
server:
allowed_versions:
- "2025-11-25"
- "2026-07-28"
Pricing shape
On Konnect Plus, AI Gateway meters distinct proxied models at $100 per month each (max five). Enterprise is custom with volume discounts and no model limit, per Kong pricing. Kong’s usage metrics glossary states that use of Gateway Services with Models or MCP servers is included at no additional charge, while non-model/MCP API request traffic remains separately chargeable.
Fully self-hosted AI Gateway packaging sits under Gateway Enterprise commercial terms. Treat published Plus model metering as the public list price for pilots, and ask sales for MCP-heavy Enterprise quotes.
AWS AgentCore Gateway: Managed MCP Aggregation on Bedrock
Amazon Bedrock AgentCore Gateway is a managed entry point that aggregates MCP targets into one virtual MCP server while also supporting HTTP and inference targets. Inbound auth can be OAuth JWT, IAM SigV4, authenticate-only, or none for development. Outbound calls use execution roles or credential providers for API keys and OAuth.
Targets, revisions, and operations
Core concepts docs split targets into MCP (aggregation), HTTP (passthrough), and inference (model routing). MCP target types include Lambda, API Gateway stages, OpenAPI, Smithy, remote MCP servers, built-in templates, and connectors, per core concepts. Supported MCP versions include 2026-07-28, 2025-11-25, 2025-06-18, and 2025-03-26; AWS documents enabling 2026-07-28 via UpdateGateway on the gateway’s supportedVersions list without recreating targets, per the July 2026 protocol blog.
AgentCore Gateway is the default when agents already run on Bedrock and tools should stay inside AWS identity boundaries. Semantic tool search, capability sync, and CloudWatch-facing operations fit platform teams that standardize on AWS rather than operating a separate API gateway dataplane for MCP.
Pricing shape
AgentCore Gateway list pricing is consumption-based: $0.005 per 1,000 API invocations. Search API calls are $0.025 per 1,000 and tool indexing is $0.02 per 100 tools per month, plus standard data transfer and VPC egress processing where applicable, per AgentCore pricing. Identity token or API key requests for non-AWS resources list separately when used outside Runtime or Gateway bundling.
Docker MCP Gateway: Catalog-Backed Container Isolation
Docker MCP Gateway is an open-source orchestrator that sits between MCP clients and servers. Clients connect to the gateway; the gateway starts servers as isolated containers, injects credentials, applies resource limits, and routes tool calls. On Docker Desktop with MCP Toolkit active, the gateway can run in the background without a separate install.
Catalog, profiles, and governance packaging
The Docker MCP Catalog packages 300+ verified servers as versioned images with provenance. Profiles group servers for projects; clients such as Claude Code, Cursor, and Zed connect through the gateway. The Toolkit and CLI document docker mcp gateway run and Dynamic MCP discovery inside a curated catalog. Docs note that MCP Gateway as part of Docker AI Governance is invite-only through Docker Sales.
Use Docker when a single team is validating one or two servers before a governed rollout, not as the long-term directory RBAC and SIEM answer. Build allowlists and structured audit in front, or define exit criteria into Kong or AgentCore early.
Side-by-Side: Deployment, Identity, and Fee Shape
| Dimension | Kong | AgentCore Gateway | Docker |
|---|---|---|---|
| Who runs the plane | You (dataplane) + Konnect/Enterprise control | AWS managed service | Developer laptop or self-run CLI plugin |
| Aggregation | listener + sources / upstream-server | Native MCP target aggregation | Profile of catalog/remote servers |
| REST to MCP | conversion-listener / conversion-only | OpenAPI / Smithy / Lambda targets | Not the primary path; run a server image |
| ACL granularity | Default + per-tool AI Consumer ACLs | Gateway authorizer + target credentials | Profile membership + per-server secrets |
| Observability | MCP metrics + AI logging policies | CloudWatch / AgentCore observability suite | Built-in logging and call tracing on gateway |
| Fee driver | Model proxy meters + API requests; MCP included on Gateway Services with models/MCP | Per Gateway invocation / Search / indexing | OSS/Desktop free; enterprise governance invite-only |
Budget tip: model tokens, gateway meters, and tool backend costs are three separate lines. Kong’s Plus model meter is not a token markup. AgentCore Gateway meters invocations, not LLM tokens. Docker’s open-source path has $0 license until you buy a governed packaging.
When Each Gateway Wins
Choose Kong when
- API reuse: Kong already fronts your internal APIs and LLM routes, and MCP should inherit the same Consumer, OIDC, and rate-limit posture.
- Conversion + aggregation: You need OpenAPI-to-tool conversion plus aggregation of third-party MCP servers on one listener.
- One dataplane: Platform SREs already operate Gateway Enterprise or Konnect and refuse a second dataplane for tools.
Choose AgentCore Gateway when
- Bedrock runtime: Agents run on Bedrock AgentCore Runtime or other AWS-managed agent hosts.
- AWS identity boundary: Inbound JWT/IAM and outbound credential providers must stay inside AWS account boundaries.
- Managed ops: You want consumption pricing without staffing a Kong or Docker control plane for MCP.
Choose Docker when
- Fast POC: A squad needs a catalog-backed POC with isolated containers this sprint.
- Shared profiles: Multiple local clients should share one profile instead of per-app server configs.
- On-ramp: You will redefine production authz later on Kong or AgentCore, with Docker as the on-ramp.
Migration Paths Between the Three
Most teams do not jump straight to a forever choice. A common path is Docker Toolkit for local discovery, then AgentCore Gateway if the production runtime is Bedrock, or Kong if the production edge is already Konnect. Keep tool names and OAuth scopes stable across the move so agents do not need a second prompt rewrite.
Whatever you pick, keep internal links between the MCP hub and AgentOps gateways so buyers can compare LLM routing and MCP tool routing as related control planes: MCP protocols, AI Gateways, and AgentOps tools.
Related Guides
- MCP and agent protocols hub
- MCP category
- AgentOps tools map
- AI Gateways category
- ToFu MCP tool security bugs
- Best AI agent observability tools
- Open source LLM observability
- Langfuse vs LangSmith vs Braintrust
- Langfuse alternatives
- Arize Phoenix vs Langfuse vs Helicone
- Braintrust vs Maxim vs Galileo
- AI agent evaluation tools
- LangSmith alternatives
- LangSmith vs Langfuse vs Braintrust pricing
- AI agent frameworks
- Editorial standards · Disclosure · Contact
Frequently Asked Questions
What is the difference between Kong and AgentCore for MCP?
Kong applies API-gateway policies to MCP on infrastructure you operate or run through Konnect, including conversion and aggregation modes. AgentCore Gateway is a managed AWS service that aggregates MCP targets with JWT or IAM inbound auth and AWS credential providers outbound. Choose Kong when Kong already fronts APIs; choose AgentCore when Bedrock is the agent runtime.
Does Docker MCP Gateway replace Kong or AgentCore in production?
Usually not. Docker MCP Gateway and Toolkit excel at catalog-backed, container-isolated local and POC profiles with low setup cost. Docker docs mark governed AI Governance packaging as invite-only. Most enterprises still exit to Kong or AgentCore once directory identity, SIEM-grade audit, and multi-team ACLs become mandatory.
Which gateways support the MCP 2026-07-28 revision?
Kong AI Gateway documents client revisions 2025-03-26 through 2026-07-28 on AI Gateway 2.1+, with allowed_versions controls. AgentCore Gateway documents the same four revisions and enabling 2026-07-28 via UpdateGateway. Docker’s public gateway docs emphasize orchestration and do not publish an equivalent multi-revision matrix.
How do Kong and AgentCore charge for MCP traffic?
Kong Konnect Plus meters distinct proxied models at $100 per month each with a five-model cap; Kong’s glossary says Gateway Services used with models or MCP servers have no extra MCP surcharge, while other API requests still bill. AgentCore Gateway lists $0.005 per 1,000 invocations plus Search and tool-indexing fees on the AWS pricing page.
When should a team shortlist all three versus only one?
Shortlist all three when your platform is undecided between API-gateway reuse, AWS-native managed services, and a container POC on-ramp. Collapse to one when either Kong or Bedrock is already mandatory, or when the only near-term goal is a two-week Toolkit spike. Revisit after identity and audit requirements harden.