Topic
The Model Context Protocol leaves authorization optional and tool safety to the implementer. An MCP gateway is where most teams end up enforcing both. Nine gateways, compared on the controls the specification asks for.
LiteLLM is the default first gateway for many teams. Its production footprint, the March 2026 PyPI compromise and its license split send some of them looking elsewhere. Six alternatives, measured against published criteria, with a migration path.
Most flagship open-weight releases of the past year ship under Apache 2.0 or MIT. The exceptions carry user caps, revenue gates, prohibited-use policies and remote kill switches. This survey reads the licence texts, not the launch posts, and maps what each one actually permits.