Kobel vs enterprise MCP gateways
Same word, different job. Enterprise gateways govern the network; Kobel governs the endpoint. Here is which one solves your problem — including the case where the answer is not Kobel.
Last reviewed:
Enterprise MCP gateways and Kobel share a name and almost nothing else. MintMCP, TrueFoundry, Obot, Pomerium, Kong, Cloudflare, IBM ContextForge and Portkey sit in the network path in front of remote MCP servers. They authenticate callers against your identity provider, apply role-based rules about which tools a role may invoke, and produce compliance-grade audit trails. They are bought by IT departments, deployed to cloud or Kubernetes, and mostly priced on request.
Kobel sits on one person's Windows or Mac and decides what an AI may do with that machine's folders, business software and accounts. If your question is "which of my 400 employees may call this tool", buy a gateway. If it is "the AI must never see this folder", that is a different product.
Two different places in the stack
Network-side gateway
AI client → gateway → remote MCP servers → SaaS APIs
- Identity: your IdP (Okta, Entra, Google)
- Unit of control: a tool on a server, for a role
- Deployment: cloud, VPC, Kubernetes
- Buyer: platform or security team
- Blind to: anything on an employee's disk
Host-side permission layer
AI client → Kobel → folders, apps, accounts on this device
- Identity: the person sitting at the machine
- Unit of control: a folder, app or account, at one of five levels
- Deployment: a desktop app
- Buyer: the individual, freelancer, agency or SME
- Blind to: traffic between other people and remote servers
Neither replaces the other. A large organisation that has deployed Pomerium in front of its internal MCP servers still has 200 laptops where someone has pointed a local assistant at their home directory. That is the gap Kobel closes, and no network gateway can see it.
Feature comparison
| Enterprise MCP gateways | Kobel | |
|---|---|---|
| Examples | MintMCP, TrueFoundry, Obot, Pomerium, Kong, Cloudflare, IBM ContextForge, Portkey, agentgateway | — |
| Runs | Cloud SaaS, VPC, on-premise, Kubernetes | Windows and macOS desktop |
| Governs local files | No | Yes, per folder |
| Governs remote MCP servers | Yes, centrally | No |
| Identity model | SSO, OIDC, SAML, service accounts | The person using the device |
| Per-tool policy | Yes (Pomerium and agentgateway are the strongest) | Per resource and capability |
| Write-with-backup level | No | Yes |
| Read-original-write-copies level | No | Yes |
| Setup | YAML, CRDs, Helm charts, IdP configuration | Drag a folder in, pick a colour |
| Audit log | Compliance-grade, exportable to SIEM | Local, timestamped, tamper-evident |
| Data leaves the device | Usually yes | No |
| Pricing | Mostly on request; some freemium | Free tier; €49 one-time or €3.90/month; team plans from €29/month |
Who is who in the gateway market
Worth knowing before you decide anything, because most published "best MCP gateway" lists are written by vendors who rank themselves first.
- MintMCP — cloud control plane with virtual MCP servers, SSO, RBAC and audit trails. Enterprise, pricing on request.
- TrueFoundry — MCP layer on an existing AI gateway; cloud, VPC, on-premise or air-gapped. Freemium entry tier.
- Obot — open-source (MIT) enterprise AI control plane: MCP hosting, registry, gateway and chat client.
- Pomerium — identity-aware zero-trust proxy with the most granular per-tool policy language in the category.
- Kong, Cloudflare, Envoy AI Gateway, Apache APISIX, WSO2 — API-gateway incumbents extending into MCP.
- IBM ContextForge — Apache-2.0 self-hosted gateway, registry and proxy federating MCP, A2A and REST.
- agentgateway — open-source AI data plane donated to the Linux Foundation, with per-identity tool scoping.
- Portkey — LLM gateway with an MCP registry and access control at organisation, workspace and tool level.
Nearly every ranked list for this category is published by one of the vendors in it. Read them, but check the domain before you trust the ranking. This page is no different — it is published by Kobel — which is why the comparison above states plainly what Kobel cannot do.
The developer-tool middle ground
Between network gateways and Kobel sits a group of local tools built for engineers. If you are comfortable in a terminal, look at these before buying anything:
- Docker MCP Toolkit — runs MCP servers in isolated containers with per-server and per-tool enable/disable, Docker-signed catalog images, and no host filesystem access until the user explicitly grants a mount. Currently in beta, included with Docker Desktop (free for personal use and small businesses, paid above that).
- ToolHive Studio — container isolation plus network and filesystem permission profiles, Apache 2.0.
- Continue — three-state allow / ask / exclude permissions with glob paths in
permissions.yaml; technically the closest thing to a fine-grained model, in a text file. - Cursor —
permissions.jsonwithserver:toolmatching and wildcards. - Lasso MCP Gateway and MCP Defender — local traffic inspection for secrets, PII and prompt injection. Complementary to, not a substitute for, access control.
Kobel's argument against these is not technical superiority. It is that a bookkeeper, a lawyer or a designer will
never edit permissions.yaml, and the permission model that gets used is the one that gets configured.
Verdict
Buy an enterprise gateway if…
- You have an identity provider and need RBAC on top of it
- Your MCP servers are remote and shared across a team
- You need SIEM export and compliance attestation
- You deploy to Kubernetes
- Your rules must come from an identity provider, not from a per-device admin console
Choose Kobel if…
- The sensitive data is on someone's laptop
- Nobody involved will write a YAML policy
- You want five graded levels, not allow/deny
- Nothing may be processed off the device
- You also want business apps and social accounts under the same rules
Running both
For any organisation past a handful of people this is the sensible end state, not a compromise. The two layers cover different halves of the same question:
- The gateway governs shared remote MCP servers, ties access to identities from your IdP, and produces the central audit evidence compliance asks for.
- The desktop layer governs what each endpoint exposes to whichever AI tools that person installed — including the ones IT never approved — and keeps a local log the AI cannot reach.
They do not conflict, because they never see the same traffic. A request from an employee's assistant to an internal MCP server passes the gateway; a request from that same assistant to that employee's Documents folder never leaves the machine and only the desktop layer is in a position to say no.
Kobel's five permission levels
Every folder, app and account gets exactly one of these five levels. You set it by dragging a folder in and picking a colour — there is no configuration file.
- GreenRead and write. The AI may open files and save changes in place.
- TealWrite with automatic backup. Every change is preceded by a backup copy, so a bad edit is always reversible.
- OrangeRead the original, write only to copies. The AI can work with your data but cannot alter the source file.
- YellowRead only. Look, don't touch.
- RedBlocked. The resource is invisible to the AI.
Keep reading
Sources
Try it on one folder
Install Kobel, drag in a single folder, set it to read-only, connect your assistant. Two minutes. Free Basis tier, no account needed.
Download KobelSee featuresFrequently asked questions
What is the difference between an MCP gateway and Kobel?
Position in the stack. Enterprise MCP gateways such as MintMCP, TrueFoundry, Obot or Pomerium sit in the network in front of remote MCP servers and enforce role-based rules from your identity provider. Kobel runs on a single Windows or Mac and enforces per-folder, per-app rules for the resources on that device. Kobel is itself an MCP gateway — a local one.
Can an enterprise MCP gateway protect the files on my laptop?
No. Network gateways govern traffic to MCP servers they sit in front of. They have no visibility into what a local AI client does with the local filesystem, which is why organisations that have deployed one still have an unmanaged endpoint problem.
Which MCP gateway has the most granular permissions?
Among network gateways, Pomerium's policy language and Solo.io's agentgateway offer the most precise per-tool matching — Pomerium can match tool names by exact value, prefix, suffix or blocklist per role. For local file resources, granularity means something different: Kobel's five levels distinguish read-only, write-to-copies, write-with-backup and full access per folder.
Is Kobel open source?
No. Kobel is a commercial desktop application for Windows and macOS with a free tier. If open source is a requirement, look at IBM ContextForge, Obot, ToolHive or agentgateway — all of which target developers and platform teams rather than end users.
Do I need both a gateway and a local permission layer?
In an organisation of any size, probably. They cover different attack surfaces: the gateway governs shared remote servers and produces central audit evidence, the local layer governs what each endpoint exposes to whichever AI tools that person installed.
How much do enterprise MCP gateways cost?
It varies more than people expect. TrueFoundry lists a $0 Developer plan with 50,000 MCP tool calls per month (its pricing page also advertises a 7-day trial, so confirm which applies), Kong and Portkey publish pricing, Obot's community edition is free to self-host, IBM ContextForge is Apache 2.0, and Cloudflare's AI Gateway core features are free with usage-based add-ons. MintMCP and WSO2 do not publish enterprise pricing. Verify current terms directly with each vendor.