TL;DR: IBM ContextForge has no license fee or hosted SaaS price, but the article shows that self-hosting shifts cost into Kubernetes, Redis, monitoring, security, upgrades, and engineering time, according to TruFoundry. The practical lesson is that gateway economics now include identity governance, observability, and access control overhead, not just software cost.
At a glance
What this is: IBM ContextForge is an open source MCP gateway with no license fee, but the article argues that self-hosting moves the bill into infrastructure, operations, and governance overhead.
Why it matters: IAM and platform teams need to budget for the hidden control plane around MCP, because access, observability, and compliance costs can exceed the software itself.
Context
IBM ContextForge is an open source MCP gateway, so the pricing question is really a hosting question. Once a team self-hosts it, the cost model shifts from software spend to Kubernetes capacity, Redis, storage, networking, observability, and the engineering time required to operate those components.
For identity and access teams, the important point is not whether the gateway is licensed, but whether the organisation can govern it as production infrastructure. That means defining who can register servers, how tool calls are logged, how secrets are scoped, and how upgrades and recovery are owned.
The article's core claim is that a self-hosted MCP layer only looks free until it becomes part of the control plane. At that point, governance, security, and reliability work become part of the real price of admission.
Key questions
Q: How should security teams budget for a self-hosted MCP gateway?
A: They should budget for infrastructure, engineering time, observability, support, and identity controls together. A self-hosted gateway often shifts cost into Kubernetes, Redis, logs, upgrades, and access governance, so the real price is operational ownership rather than software licensing.
Q: Why can a free MCP gateway still be expensive in production?
A: Because production cost comes from the controls around the gateway, not only the code itself. If the platform must prove who can register servers, which tokens can invoke them, and whether activity is logged for audit, the organisation is paying for governance work every day.
Q: What breaks when teams do not budget for gateway observability?
A: They lose the ability to explain tool usage, isolate failures, and prove access scope after something goes wrong. In practice that means poor incident reconstruction, weak audit evidence, and slower recovery, which are all operational costs even when the software itself has no license fee.
Q: How do teams decide between managed and self-hosted MCP gateways?
A: Choose based on where you need control over credentials, logs, residency, and revocation. Managed gateways reduce operational burden, but self-hosted or VPC-native options may be necessary when policy, jurisdiction, or containment requirements demand tighter ownership of the runtime.
Technical breakdown
Why self-hosted MCP creates hidden infrastructure cost
An MCP gateway is not just an API proxy. In production it usually depends on a Kubernetes runtime, Redis for caching or federation state, persistent storage, ingress, TLS, and load balancing. Each dependency adds patching, scaling, backup, and failure-domain work, so the operating cost is distributed across platform functions rather than visible as a single software invoice.
Practical implication: treat gateway hosting as an infrastructure programme, not a lightweight app deployment.
Where observability becomes part of the cost model
The article shows that a usable gateway needs metrics, logs, tracing, and alerting, not only connectivity. OpenTelemetry, Prometheus, Grafana, and centralised logging are not optional decoration when tool calls affect AI behaviour and access decisions. Without that layer, teams cannot explain usage, isolate failures, or prove who invoked which tool and when.
Practical implication: budget observability as a core control, because debugging and auditability are part of run cost.
How security controls change the real total cost
Self-hosting pushes security work into OAuth configuration, token scoping, secrets management, RBAC design, certificate rotation, and compliance reporting. Those are identity governance tasks, not just deployment tasks, because the gateway becomes the enforcement point for who can use which MCP server and under what conditions. The hidden expense is the control layer around the gateway, not merely the gateway itself.
Practical implication: assign explicit ownership for RBAC, secret rotation, and audit evidence before production rollout.
Threat narrative
Attacker objective: The objective is to reach higher-value tools, data, or control paths through a gateway that has been overexposed by weak governance.
- Entry begins when teams adopt a self-hosted MCP gateway and must expose it to internal users, model traffic, and tool integrations.
- Credential access follows through OAuth scopes, tokens, and secrets that now sit inside the gateway's operating boundary.
- Escalation occurs when weak RBAC, broad token scope, or poor isolation lets one team or tool reach more servers than intended.
- Impact is operational and governance-related, with outages, audit gaps, and expanded blast radius across AI workloads and connected tools.
Breaches seen in the wild
- LiteLLM MCP auth bypass 2026: An exploited LiteLLM MCP auth bypass and default sk-1234 master keys let attackers steal AI gateway master and provider API keys.
- Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Self-hosted MCP turns price into governance debt: The article shows that a zero-license gateway still creates a recurring control burden in hosting, observability, and access management. That burden is not optional overhead, because the gateway becomes part of the identity and policy layer for AI tools. Practitioners should treat deployment choice as a governance decision, not a procurement shortcut.
Identity controls do not disappear when the software is free: OAuth configuration, token scoping, and RBAC are the real cost centre once the gateway is in production. Free software can still carry expensive entitlement design work, especially when multiple teams share the same control plane. The implication is that identity governance effort shifts from licensing review to operational enforcement.
MCP economics now include the cost of proving control: Monitoring, logging, certificate rotation, and compliance reporting are not secondary features in a production gateway. They are the evidence layer that lets security teams answer who used what, under which scope, and whether the access path remained bounded. If that evidence is not budgeted, the platform may be cheap to install but costly to defend.
Hidden cost is usually blast-radius expansion: The first budget line is infrastructure, but the more important one is organisational reach. A shared gateway centralises model and tool traffic, which makes RBAC, visibility, and change control more valuable and more fragile at the same time. Practitioners should design for bounded access paths before scaling adoption.
ContextForge's free tier does not remove the enterprise problem: The article's own comparison makes clear that the main issue is not whether a team can run one service, but whether it can run a governed platform. That distinction matters because production AI access paths fail at the control layer long before they fail at the code layer. Teams should budget for the platform they are actually operating, not the one they imagine from the README.
From our research library:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- Read next: AI Agent Identity Security Buyer's Guide
What this signals
Hidden-cost pricing is really identity-control pricing: Once an MCP gateway sits in the path of tool access, the true budget line is governance overhead. That means teams should price token scoping, server registration, logging, and RBAC as first-class production controls, not as post-launch hardening.
A self-hosted gateway also creates a new boundary for audit and accountability. If teams cannot reconstruct which tool was called, under what credential, and by which workflow, the platform is operating below the evidence threshold that modern identity programmes need.
For practitioners
- Budget the full control plane Model Kubernetes, Redis, storage, ingress, monitoring, upgrades, and recovery as one operating cost before approving self-hosting.
- Assign ownership for gateway governance Define who approves MCP server registration, token scope, RBAC policy, certificate rotation, and audit evidence.
- Separate pilot cost from production cost Use a sandbox deployment for evaluation, then reprice production for high availability, multi-team access, and compliance reporting.
- Require access logging at the gateway boundary Make every tool call attributable through central logs so security and audit teams can reconstruct usage and scope decisions.
Key takeaways
- The article's core lesson is that a free MCP gateway can still carry meaningful production cost in infrastructure, governance, and engineering time.
- For IAM and platform teams, the hidden expense is the control layer around access, not the gateway code itself.
- Production viability depends on whether an organisation can own observability, RBAC, and audit evidence as ongoing operating responsibilities.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on gateway-scoped identity, privilege, and access control for AI tools. |
| Recommendation — Apply ASI03 thinking to bound tool access, token scope, and gateway privilege in production AI pathways. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | MCP gateways expose non-human access paths that can become overprivileged if governance is weak. |
| Recommendation — Review MCP server entitlements against NHI-05 and remove any access that exceeds task scope. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article explicitly discusses token scoping, OAuth, and certificate rotation. |
| Recommendation — Use IA-5 to manage gateway credentials, rotation, and revocation as continuous operations. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Shared gateway access and RBAC design are central to the article's cost and control analysis. |
| Recommendation — Apply PR.AA-05 to define and enforce least-privilege access for MCP servers and tool calls. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | The article focuses on cloud gateway governance, access control, and administrative ownership. |
| Recommendation — Map gateway administration to IAM controls so access, approvals, and audits stay centrally governed. | ||
Key terms
- MCP Gateway: The control layer that relays assistant intent to tools and data sources through the Model Context Protocol. In practice, it becomes a policy boundary, not just a transport layer. If it trusts model output too early, it can turn unverified reasoning into real-world execution or disclosure.
- Self-Hosted Infrastructure Cost: Self-hosted infrastructure cost is the full operating burden of running software yourself, including compute, storage, networking, monitoring, patching, and recovery. In identity programmes, this cost often matters more than the nominal licence price because control ownership moves in-house.
- Gateway Governance Gap: The mismatch between request-level enforcement and actual identity governance. A gateway can inspect traffic and block calls, but it cannot by itself determine standing privilege, lifecycle status, or whether the caller is entitled across the broader enterprise environment.
- Action Scope: Action scope is the set of outcomes an AI system is permitted to trigger based on its granted access and task context. In agentic environments, it is a better control target than simple account permission because it reflects what the system can actually do with data, tools, and timing.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 20, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org