Building one MCP server is a solved problem. Deciding who guards the tenth one is not.

Once your agent connects to more than a handful of MCP servers, you put a gateway in front of them — one endpoint that aggregates the servers, filters tool definitions so the model isn't drowning in them, and becomes the single place to enforce authentication, policy, and an audit log. We've compared the open-source gateways and rounded up the self-hostable field. This piece is the question that comes right after you pick one: do you run it yourself, or pay someone to?

Here's the answer up front, because it's simpler than the vendor decks make it: the build-vs-buy call is not about the software. All the gateways do roughly the same job. It's about who gets paged when the gateway drops a token-audience check at 2am. If you can't name that person, you've already answered the question.

The gateway is a security control, not a convenience#

The trap is treating the gateway like a router — plumbing you set up once and forget. It isn't. The moment it's enforcing the MCP authorization spec — validating token audiences, refusing to pass client tokens through to upstream APIs, screening third-party servers for tool-poisoning — it has become a security control on your critical path.

And an unstaffed security control is theater. A self-hosted gateway that nobody patches, whose logs nobody reads, whose policy nobody updates when you add a sketchy new MCP server, is worse than no gateway: it's a false sense of a door. So the real cost of "build" isn't the compute. It's the standing obligation to staff the thing.

The build-vs-buy question isn't "can I run this software?" It's "can I be the on-call for a security boundary while also shipping my product?"

When to self-host#

Self-host — ContextForge, agentgateway, or MetaMCP — when all three of these are true:

Self-hosting is genuinely the right call for a large share of solo builders. An afternoon of YAML beats a subscription when the threat model is small. Own the box, own the pager, move on.

When to buy#

Buy a managed gateway when any one of these is true — because each one is a full-time obligation you probably can't cover:

The representative buy option right now is Runlayer — a managed, all-in-one MCP security gateway that came out of stealth in late 2025 with $11M in seed funding led by Khosla Ventures' Keith Rabois and Felicis. It's aimed squarely at the gaps founders hit in the raw protocol — security, observability, auditability — and it pulled in David Soria Parra, MCP's lead architect, as an advisor, plus early customers including Gusto, Rippling, dbt Labs, Instacart, Opendoor, and Ramp.

Name-checking it is not an endorsement. It's the shape of the "buy" side: someone else runs the door and carries the pager, and you pay for the time back. Before you depend on any managed gateway, do the two boring checks that decide whether "buy" is reversible — can you export your audit logs and policy, and is there a self-host or open-core escape hatch if the pricing or the company changes on you. A gateway you can't leave is a bigger risk than the sprawl it solved.

The decision, in one breath#

Under two servers you wrote yourself, skip the gateway. Past five servers, or the first one you didn't write, you need one. From there: self-host if the upstreams are yours, the compliance surface is light, and you can staff the pager; buy if any untrusted server, any near-term audit, or any single-founder time crunch is in play. The 2026-07-28 stateless spec made the door cheaper to run either way — it did not decide who stands in it. That part is still yours.