Does Traefik Hub MCP Gateway Run on Kubernetes and Support GitOps Workflows?

Yes. Traefik supports self-hosted Kubernetes, Docker Swarm, HashiCorp Nomad, and VM-based deployment and declarative configuration. You can manage YAML policies in version control, review changes, and promote them through GitOps delivery workflows.

How Does Traefik Hub MCP Gateway Authenticate Agents?

Traefik acts as an OAuth 2.1 and OAuth 2.0 resource server. It validates JWT access tokens, publishes protected-resource metadata, and returns WWW-Authenticate challenges so compatible MCP clients can discover authentication requirements.

Can Permissions Differ by Agent, Tool, and Transaction?

Yes. TBAC policies combine JWT claims with MCP request attributes to restrict access by agent, task, tool, operation, record type, transaction amount, or time window. Unmatched requests can be denied by default.

How Does Traefik Hub MCP Gateway Support Tenant Isolation?

Policies can use identity and tenant claims from JWTs with MCP request attributes to enforce tenant-specific access. Validate the complete isolation model against the identity, policy, and deployment architecture planned for production.

Can Traefik Hub MCP Gateway detect sensitive data in tool calls?

Yes. Content guards scan tool-call arguments before they reach the MCP server and tool results before they reach the agent. Content Guard can mask or block PII, and LLM Guard can block calls based on checks from an external guard model.

How are Stateful MCP Sessions Handled?

Server-side session affinity routes a long-running conversation to the same pod. Deterministic routing can preserve that association during rollouts and autoscaling, while separate read and write pools can isolate workloads.

What MCP Observability and Audit Capabilities are Available?

Traefik exports OpenTelemetry traces, metrics, and logs to compatible monitoring systems. Its verifiable agent evidence capabilities can also record delegated authority, policy decisions, and reasons for approvals and denials in an append-only log designed for independent verification.

Is an MCP Gateway Enough to Secure AI Agents?

No. An MCP gateway governs tool calls, one of three boundaries an agent crosses. Traefik's Triple Gate pattern adds an AI gateway for prompt-level threats and an API gateway for backend services, all in one Traefik Hub binary. Secure MCP servers, hardened infrastructure, identity governance, and secure development practices are still required.

MCP Gateway: Control What AI Can Access

MCP Gateway 101

What is an MCP gateway?

An MCP gateway is a policy enforcement point between AI agents and Model Context Protocol (MCP) servers. It authenticates each request, decides which tools and data an agent can use, and records the decision.

AI agents reach tools and data only through the MCP gateway, which authenticates and authorizes each call and blocks the ones that are not allowed

Challenges

Why Do MCP Connections Need a Gateway?

MCP defines how agents connect to tools. Without a gateway, whoever runs the servers handles access decisions, session routing, and governance.

Agents Get More Access Than Their Task Needs
An agent with a valid credential can call any tool the server exposes. Those credentials also end up copied into agent code, CLIs, and notebooks.
Governance is Siloed and After the Fact
ACLs and generic API gateways aren't designed to enforce agent-centric access control. Tool-by-tool rules have no central review or versioning, and observability is split across logs and teams.
Agent Actions Can't Be Proven in an Audit
Traces are sampled, filtered, and can be altered by whoever operates them. When an auditor asks months later who authorized an action, under which policy, and whether the record has changed since, a trace can't answer.

The Solution

Introducing Traefik Hub MCP Gateway

Traefik Hub MCP Gateway extends Traefik Hub API Gateway, so API, AI, and MCP traffic run through a single binary. It sits between MCP clients and MCP servers as the data and control plane, runs on any orchestrator (self-hosted or air-gapped), and enforces Task-Based Access Control (TBAC) on every request.

MCP clients (chatbots, IDEs, agents, LLMs) connect through the Traefik MCP Gateway, which handles session management, observability, AuthN and AuthZ against your identity provider (Azure Entra ID, Ping Identity, Okta, Keycloak, AWS Cognito, Auth0), before reaching storage, analytics, custom, and database MCP servers

Task, Tool, & Transaction-Based Access Control (TBAC)

Authorize each request by task, tool, and transaction, down to individual tool arguments
Compare arguments to JWT claims at runtime, such as capping approve_expense at each agent's approval_limit
Isolate tenants with a single rule using variable substitution
Deny any request that matches no policy, by default
Filter tools/list, prompts/list, and resources/list so agents only see the tools they can use

Fingerprint shield linking tasks, tools, and transactions in a single access decision

Authentication and Runtime Policy Guardrails

Validate JWTs as an OAuth 2.1 and OAuth 2.0 resource server
Publish authentication metadata and WWW-Authenticate challenges
Inject upstream API keys, with optional On-Behalf-Of forwarding and token exchange support
Apply rate, concurrency, time-window, and query-pattern limits
Add optional topic, PII, and jailbreak controls
Evaluate TBAC policies using JWT claims and MCP attributes
Manage YAML policies through GitOps review and promotion
Deny unmatched requests with configurable messages

Locked shield in front of a policy checklist and a Git branch, representing authentication and policy guardrails

Session-Smart Load Balancing

Server-side session affinity keeps long-running conversations on the same pod
Separate read and write pools protect systems of record
Deterministic routing maintains session affinity through rollouts and autoscaling
Stable routing helps reduce failed sessions, retries, and duplicate writes

Cloud routing sessions to a consistent set of pods, with a checklist of healthy sessions

Observability and Verifiable Audit

OpenTelemetry metrics and traces tagged by MCP method, tool, prompt, and resource URI
Tool-call arguments stay out of traces unless you opt in
Export to Grafana, Datadog, Dash0, or any OpenTelemetry backend
PII masking and blocking with content guards
Append-only, witness-cosigned evidence of every allow and deny, verifiable on your infrastructure

Log lines under a magnifying glass next to an alert and a telescope, representing observability and audit

Compare

How Traefik Hub MCP Gateway Compares

Traefik Hub MCP Gateway compared with Apigee, Gravitee APIM, Tyk, and Kong AI Gateway
Capability	Apigee	Gravitee APIM	Tyk	Kong AI Gateway	Traefik Hub MCP Gateway
Best for	Satisfied Google Cloud teams exposing existing Apigee APIs as MCP tools	Satisfied Gravitee users wanting OAuth2 with dynamic client registration for MCP clients	Satisfied Tyk users wanting per-tool rate limits, timeouts, and circuit breakers	Teams satisfied with Kong or Konnect that are governing LLM, MCP, and A2A traffic together	Kubernetes teams needing argument-level policy. Best for self-hosted or air-gapped deployments.
Access scope	API products listing allowed tool operations per OAuth client	OAuth2 plans on the MCP proxy API	Per consumer: proxies, JSON-RPC methods, tools, resources, prompts	Consumer ACLs; OAuth2 scoping so writes can require tighter access than reads	Agent identity, task, tool, resource URI, tool arguments
Conditions on tool arguments	Not documented	Not documented	Not documented	Not documented	Numeric and string conditions evaluated against JWT claims
MCP content guardrails	Not documented for MCP proxies; Model Armor policies cover LLM prompts and responses	AI-powered PII redaction on tool results, scoped per tool	Not documented; per-tool request size limits, timeouts, and circuit breakers	Documented as not supported on MCP Proxy traffic; guardrails cover LLM traffic	PII detection, masking, and blocking plus semantic checks via external guard models, on tool arguments and results
MCP observability	Apigee Analytics	Not documented	MCP metric instruments and structured access logs	OpenTelemetry metrics for AI, MCP, and A2A traffic	OpenTelemetry metrics and traces; tool arguments opt-in
Tamper-evident agent evidence	Not documented; Cloud Audit Logs cover admin and data access activity	Not documented; Audit Trail covers API activity and configuration changes	Not documented; Dashboard audit log covers admin activity	Not documented; signed audit logs cover Admin API and Konnect platform activity	Immutable, witness-cosigned transparency log of gateway approvals and denials
Deployment	Apigee SaaS or hybrid	APIM 4.12 with Access Management	Tyk Gateway v5.13+	Konnect-managed or self-hosted	Self-hosted Kubernetes, air-gapped capable

Compare Traefik Hub MCP Gateway with

Traefik Hub MCP Gateway compared with Apigee
Apigee	Traefik Hub MCP Gateway
Best for
Satisfied Google Cloud teams exposing existing Apigee APIs as MCP tools	Kubernetes teams needing argument-level policy. Best for self-hosted or air-gapped deployments.
Access scope
API products listing allowed tool operations per OAuth client	Agent identity, task, tool, resource URI, tool arguments
Conditions on tool arguments
Not documented	Numeric and string conditions evaluated against JWT claims
MCP content guardrails
Not documented for MCP proxies; Model Armor policies cover LLM prompts and responses	PII detection, masking, and blocking plus semantic checks via external guard models, on tool arguments and results
MCP observability
Apigee Analytics	OpenTelemetry metrics and traces; tool arguments opt-in
Tamper-evident agent evidence
Not documented; Cloud Audit Logs cover admin and data access activity	Immutable, witness-cosigned transparency log of gateway approvals and denials
Deployment
Apigee SaaS or hybrid	Self-hosted Kubernetes, air-gapped capable

Based on vendor documentation reviewed in September 2026. “Not documented” means the capability did not appear in the documentation reviewed. For MintMCP, TrueFoundry, and Docker MCP Gateway, see Best MCP Gateways 2026.

Frequently Asked Questions

Traefik Hub MCP Gateway supports Streamable HTTP, the MCP specification's transport for remote servers. The standalone HTTP+SSE transport was deprecated in the 2025-03-26 spec revision, so the gateway doesn't support it. Server-sent event streams within Streamable HTTP responses are supported.