AI · alternatives · 2026
24 alternatives to An MCP Gateway to block the lethal trifecta
Hi there, me and some friends were inspired by Simon Willison's recent post on the "lethal trifecta" (https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ ) and started building a gateway to defend against it. The idea: instead of connecting an LLM directly to multiple MCP servers, you point them all through a Gateway. The Gateway: - Connects to each MCP server and inspects their tools + requirements - Classifies tools along the "trifecta" axes (private data access, untrusted content, external comms) - When all three conditions are about to align in a…
An MCP Gateway is a security layer that sits between language models and multiple MCP servers. It inspects the tools available from each server and classifies them along three risk dimensions: private data access… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. Prices are shown for the 1 we have checked on their own sites, 1 of them free or with a free tier.
- 1
Many teams connecting LLMs to external tools eventually encounter the same architectural issue: as more tools and agents are added, the integration pattern becomes an N×M mesh of direct connections. Each agent implements its own auth, retries, rate limiting, and logging; each tool needs credentials distributed to multiple places and observability becomes fragmented. We built LLM gateway with this goal to provide a single place to manage authentication, authorization, routing, and observability for MCP servers, with a path toward a more general agent-gateway architecture in the future. The…
Dec 2025 · truefoundry.com · its alternatives →
- 2
Hi HN, Gabriel, Co-Founder at Permit.io. We're releasing Permit MCP Gateway today, an authorization proxy for MCP servers. TL;DR - we built an MCP Gateway that developers love and CISOs trust. Watch more[0] Now, after your little hate on using fancy copy on HN, to the real thing: MCP is in a strange place. Developers are debating whether it's overcomplicated compared to CLIs or skills files. Meanwhile, enterprises are adopting it by default because every agentic system that acts on your behalf, Cursor, Claude, Copilot, internal agents, needs a stable infrastructure for connecting to tools.…
Mar 2026 · permit.io · its alternatives →
- 3
New ways of breaking app-integrated LLMs . Contribute to greshake/llm-security development by creating an account on GitHub.
2023 · github.com · its alternatives →
- 4ST
Hi! After learning about MCP, I'm really excited about the future of provider-agnostic, re-usable tooling. Unfortunately I've found that while it's easy to implement an MCP server for use with tools that support it (such as Claude Desktop), it's not as easy to implement your own support (such as integrating an MCP server into your own LLM application). We implemented a thin MCP wrapper that easily integrates with Mirascope calls so that you can hook up an MCP server and client super easily to any supported LLM provider. Excited to see what people build with this!
2025 · mirascope.com · its alternatives →
- 5
LLM Gatewayfree tier▲296I built an OpenAI-compatible LLM gateway that routes requests to OpenAI, Anthropic, Ollama, vLLM, llama-server, SGLang... anything that speaks /v1/chat/completions. Single Go binary, one YAML config file, no infrastructure. It does the things you'd expect from this kind of gateway... semantic routing via a three-layer cascade (keyword heuristics, embedding similarity, LLM classifier) that picks the best model when clients omit the model field, weighted round-robin load balancing across local inference servers with health checks and failover. The part I think is most…
2025 · llmgateway.io · its alternatives →
- 6
I shipped a wiki layer for AI agents that uses markdown + git as the source of truth, with a bleve (BM25) + SQLite index on top. No vector or graph db yet. It runs locally in ~/.wuphf/wiki/ and you can git clone it out if you want to take your knowledge with you. The shape is the one Karpathy has been circling for a while: an LLM-native knowledge substrate that agents both read from and write into, so context compounds across sessions rather than getting re-pasted every morning. Most implementations of that idea land on Postgres, pgvector, Neo4j, Kafka, and a dashboard. I…
Apr 2026 · github.com · its alternatives →
- 7
Over the past couple weeks, l've been really immersed in learning about MCP, a new protocol for equipping any LLM with a set of tools that can run on your own machine or a remote server you control and give all kinds of superpowers to Al agents to do things like search, etc. As part of that research, l've already built one very fleshed-out and useful MCP server that l've shared here (I've added much more to it recently though!), the LLM Gateway MCP Server, which lets you use a big model to delegate to a cheaper model (and many more things in addition to that, like running automated…
2025 · github.com · its alternatives →
- 8
Read this article by Cloudflare this morning https://blog.cloudflare.com/code-mode/ the main argument being that LLMs are much better at writing typescript code than tool calls because they've seen typescript code many more times. HN Discussion: https://news.ycombinator.com/item?id=45399204 https://news.ycombinator.com/item?id=45386248 Deno provides a great sandbox environment for Typescript code execution because of its permissions system which made it easy to spin up code that only has access to fetch and network calls. Stick an MCP proxy…
2025 · github.com · its alternatives →
- 9
Hi HN! We kept seeing devs get pwned through MCP tools in ways that security scanners completely miss. So we built an open-source analyzer to catch these attacks. Our first OSS by Mighty team. The problem: At Defcon, we saw MCP exploits with 100% success rate against Claude and Llama. Three attack patterns: Hidden Unicode in "error messages" - Paste a colleague's error into Claude, your SSH keys get exfiltrated Trusted tool updates - That database tool you've used for months? Last week's update added credential theft Tool redefinition - Malicious tool redefines "deploy to prod" to run…
2025 · github.com · its alternatives →
- 10
Hi HN, We’re building security tooling around agentic AI systems. Today, we're releasing our public MCP catalog with detailed risk analysis for every MCP server we've found on the internet: https://mcp.armor1.ai/mcp-directory We all love agents and the power that MCPs unlock: suddenly your AI assistant can query databases, manage files, call APIs, and interact with the real world. But when we started adopting MCPs ourselves, we kept running into the same nagging questions: Is this MCP safe? Where is my data actually going? Could it execute destructive actions? Is it…
Feb 2026 · mcp.armor1.ai · its alternatives →
- 11
- 12
Give LLMs access to web accessibility testing APIs
Jan 2026 · github.com · its alternatives →
- 13
This is an open‑source Model Context Protocol (MCP) server that gives any LLM a sense of the passage of time. Most MCP demos wire LLMs to external data stores. That’s useful, but MCP is also a chance to give models perception — extra senses beyond the prompt text. Six functions (`current_datetime`, `time_difference`, `timestamp_context`, etc.) give Claude/GPT real temporal awareness: It can spot pauses, reason about rhythms, and even label a chat’s “three‑act structure”. Runs locally in <60 s (Python) or via a hosted demo. If time works, what else could we surface? - Location /…
2025 · github.com · its alternatives →
- 14
New ways of breaking app-integrated LLMs . Contribute to greshake/llm-security development by creating an account on GitHub.
2023 · github.com · its alternatives →
- 15
One MCP▲13Hey HN, I’ve been experimenting with how LLMs can dynamically use large sets of tools without needing to preload them all into context - and built one-mcp to explore that idea. one-mcp is an open source MCP server built with FastAPI that acts as a semantic index + dynamic loader for API tools. Instead of hardcoding or embedding every tool spec in an LLM session (which quickly blows up context size and costs), one-mcp lets the model search, load, and execute tools on demand — using embeddings and natural language queries. What it does: - Semantic Search for Tools: Query your API catalog with…
2025 · github.com · its alternatives →
- 16MM
I built MCPlexor to solve a token waste problem I kept running into with MCP-based agents. The Problem: MCP (Model Context Protocol) is great for giving LLMs access to external tools. But if you connect multiple servers (GitHub, Linear, Postgres, Slack), you end up with 40-50k tokens of tool definitions injected into every request – before the agent even does anything. On a 200k context model, that's 25% gone. On smaller models, it's worse. And most runs only use 1-2 tools. The Solution: MCPlexor sits between your agent and your MCP servers. Instead of loading all tool definitions upfront:…
Feb 2026 · mcplexor.com · its alternatives →
- 17
We built a reference MCP server that lets your editor/agent learn a codebase directly from source (signatures, types, AST, comments). Docs are optional. The reference impl runs on our open-source project’s codebase. Why we built it Docs are important, but they add another abstraction layer between your code and your users. Keeping them at the right quality is hard (especially at a startup), and LLM-generated docs are often mediocre until you invest real polish. Exposing code to the model in a structured way keeps answers grounded and current, and it’s always available. You can even…
2025 · github.com · its alternatives →
- 18
Contribute to ShaojieJiang/mcp-is-dangerous development by creating an account on GitHub.
2025 · github.com · its alternatives →
- 19
Local-first MCP mini-vault: let AIs call external APIs without ever seeing your keys. - RachidChabane/mcp-secrets-vault
2025 · github.com · its alternatives →
- 20
Hi HN, Matvey, Ildar, Joey, and Dominik here. If you're building LLM agents that use tools, you're probably worried about prompt injection attacks that can hijack those tools. We were too, and found that solutions like prompt-based filtering or secondary "guard" LLMs can be unreliable. Our thesis is that agent security should be handled at the network level between the agent and the LLM, just like a traditional web application firewall. So we built Archestra Platform: an open-source gateway that acts as a secure proxy for your AI agents. It's designed to be a deterministic firewall against…
2025 · archestra.ai · its alternatives →
- 21
Route 5,000+ AI tools into one. Stop LLM context bloat.
Feb 2026 · github.com · its alternatives →
- 22
ContextGuard▲12I built ContextGuard after discovering that 43% of MCP servers have critical security vulnerabilities. MCP (Model Context Protocol) is the new standard that lets Claude Clients(Desktop, Windsurf, Cursor, etc.) access external tools and data sources - think of it as a plugin system for AI assistants. The problem: When you give those clients access to your filesystem, databases, or APIs through MCP servers, you're opening up serious attack vectors. Prompt injection, data leakage, and path traversal attacks are all possible. Most developers building MCP servers don't have security expertise,…
2025 · github.com · its alternatives →
- 23MT
https://github.com/mcp-shark/mcp-shark Site: https://mcpshark.sh/ I built MCPShark, a traffic inspector for the Model Context Protocol (MCP). It sits between your editor/LLM client and MCP servers so you can: • See all MCP traffic (requests, responses, tools, resources) in one place • Debug sessions when tools don’t behave as expected • Optionally run “Smart Scan” checks to flag risky tools / configs
Dec 2025 · its alternatives →
- 24
MCPSafe▲6We've been scanning MCP (Model Context Protocol) servers to understand the security posture of the ecosystem. After 306 servers and 1,211 vulnerabilities, here's what we found: - 69 critical vulnerabilities - 32 servers using eval() on untrusted input - 31 SQL injection vulnerabilities - 32 servers with hardcoded API credentials 10.5% of servers have at least one critical vulnerability. MCP servers run with your permissions. AI agents trust them implicitly. A prompt injection can exploit them remotely. MCPSafe (https://mcpsafe.org) lets you scan before you connect. Free tier…
Feb 2026 · mcpsafe.org · its alternatives →
Also compare
- TrueFoundry AI Gateway alternatives
- Permit MCP Gateway alternatives
- ChatGPT Plugins are a security nightmare alternatives
- Simple to build MCP servers that easily connect with custom LLM calls alternatives
- LLM Gateway alternatives
- A Karpathy-style LLM wiki your agents maintain (Markdown and Git) alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →