Notifications
Clear all
Topic starter
20/08/2026 6:05 pm
TL;DR: TrueFoundry’s comparison of RunLayer and its own platform shows how AI gateway architecture is converging with MCP governance, shadow AI discovery, and runtime guardrails, while still separating model routing from endpoint discovery, according to TruFoundry. The control question is no longer whether to add policy, but where identity, tool access, and audit must sit to govern agents without fragmenting the stack.
NHIMG editorial — based on content published by TruFoundry: RunLayer vs TrueFoundry: MCP governance and AI gateway compared
By the numbers:
- TrueFoundry says its AI gateway adds only about 3 to 4 ms of overhead while serving 350+ RPS on a single vCPU.
- TrueFoundry says its gateway connects to more than 1,600 LLMs through one OpenAI-compatible API.
Questions worth separating out
Q: How should security teams govern managed MCP access for AI clients?
A: Security teams should treat managed MCP as a federated resource server and issue identity-bound tokens for each delegated task.
Q: What is the difference between shadow AI discovery and runtime governance?
A: Shadow AI discovery finds hidden agents, tools, and MCP servers that were never formally approved.
Q: When should teams centralise AI gateway controls instead of using point tools?
A: Centralise when model routing, MCP access, audit, and policy all need to be managed together.
Practitioner guidance
- Define the MCP authorisation boundary Identify which tools require gateway enforcement, which require endpoint discovery, and which still need separate approval workflows before first use.
- Separate discovery from enforcement ownership Assign one team to inventory shadow AI and undeclared MCP servers, and a different team to run the runtime policy controls that stop risky calls.
- Standardise a single audit schema Make agent identity, model request, tool invocation, and approval outcome land in one traceable record for investigations and access reviews.
What's in the full article
TruFoundry's full comparison covers the operational detail this post intentionally leaves for the source:
- Exact MCP gateway policy hooks and approval flow configuration for production use
- Per-capability comparison of shadow AI discovery methods across MDM and traffic-based controls
- Implementation detail for model routing, fallbacks, and cost control in the gateway
- The full feature matrix covering audit, guardrails, and deployment options
👉 Read TruFoundry's comparison of RunLayer and TrueFoundry for MCP governance →
MCP governance and AI gateway controls: what teams should compare?
Explore further
20/08/2026 6:40 pm
MCP governance is becoming the new identity control plane for AI workflows. Once models, agents, and tools are routed through the same gateway, the question is no longer simply who can sign in. It is which non-human identities can invoke which tools, under what policy, and with what evidence. That makes the gateway a governance surface, not just an infrastructure layer. Practitioners should treat MCP authorisation as part of identity architecture, not a separate AI plumbing decision.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- A separate finding from the same research shows that only 52% of companies can track and audit the data their AI agents access, leaving 48% with a compliance and breach-investigation blind spot.
A question worth separating out:
Q: Who is accountable when an AI agent makes a destructive tool call?
A: Accountability sits with the organisation that allowed the runtime, connector, and policy model to exist together without sufficient control. In practice, that means security, platform, and application owners all share responsibility for the guardrails that should have stopped the action at the tool boundary.
👉 Read our full editorial: AI gateway governance for MCP and agent access is converging
