Agent security platforms side by side

One platform for discovering, governing and securing agents: a device agent and cloud discovery for shadow AI, a gateway for MCP and model calls tied to your identity provider, policies to tool-argument depth, and runtime scanners on tool definitions, outputs and sessions.

Deployment: Runlayer-hosted single-tenant, or self-hosted in your AWS account (Terraform) or on EKS/GKE (Helm operator). Not open source.

• VisibilityStrongAI Watch through MDM inventories clients, MCP servers, skills and agent configs; Cloud Discovery for Copilot Studio, Azure AI Foundry, Entra Agent ID, Bedrock and AgentCore; browser extension for AI web chats.
• AuthenticationStrongDirectory sync from your identity provider; agent accounts with machine or on-behalf-of tokens; DPoP-bound tokens; OAuth broker per connector.
• Credential handlingStrongSecret references in your AWS Secrets Manager, fetched at connect time and held in memory only; short-lived repository-scoped GitHub tokens.
• Policy depthStrongPer user, group, role, agent account or attribute; server or tool scope; conditions on arguments, client, IP, OAuth scopes, tool annotations and session history; human approval (beta).
• Runtime threat detectionStrongToolGuard (tool definitions, outputs, intent drift), AgentGuard (session behavior), PII, credential and invisible-character scanners; block, mask, hint or alert; findings mapped to MITRE ATLAS.
• AuditStrongWho called, on whose behalf and with which credential; searchable, archived to S3; continuous SIEM export; session telemetry; OpenTelemetry ingest for Claude Code.
• Deployment effortLowHosted or in your own cloud; devices through existing MDM.

Runlayer vs Docker MCP Gateway →

Security and governance for agents across SaaS agent builders, cloud and endpoints, with an MCP gateway URL for tool calls.

Deployment: Commercial, demo-led. Self-hosting and open source not documented.

• VisibilityStrongLive inventory across SaaS (Copilot Studio, Agentforce), cloud (Bedrock, Vertex) and endpoint; known and shadow MCP servers in one place.
• AuthenticationPartialTies Okta and Entra identity to agent activity; not documented as the sign-in or OAuth layer for agents.
• Credential handlingPartialNames credential sprawl as a governed risk; vaulting or injection not documented.
• Policy depthStrongAllow, modify or block each agent action; MCP calls per tool, agent, user or team with context conditions.
• Runtime threat detectionStrongDetection and response mapped to OWASP and MITRE ATLAS; tool poisoning, rug pulls, sensitive data leaving.
• AuditStrongLive view of each request, tool and identity; audited rules; incidents feed forensics.
• Deployment effortMediumPlatform connections plus registering a gateway URL for MCP.

Workload identity and access management with an identity-aware gateway in front of MCP servers that holds credentials so agents never do.

Deployment: Aembit Cloud with Aembit Edge components; MCP Identity Gateway as a managed service; Terraform provider.

• VisibilityPartialWorks on agents and servers configured in policy; discovery not documented.
• AuthenticationStrongTrust providers (cloud metadata, Kubernetes, OIDC), users through your OIDC provider, combined user-and-agent access decisions, MCP authorization server.
• Credential handlingStrongGateway holds credentials in memory and injects them per request; short-lived; providers for OAuth, cloud federation, Vault and cloud secret managers.
• Policy depthPartialAccess conditions (geo, time, device posture); tool access by glob on tool names; argument rules not documented.
• Runtime threat detectionPartialContent inspection delegated to CrowdStrike AIDR as a content security provider.
• AuditStrongAudit logs, workload events and step-by-step authorization events; log streams to S3 or GCS for SIEMs.
• Deployment effortMediumSaaS control plane plus edge components you deploy in your environments.

Entra identities, blueprints and governance extended to AI agents, including Copilot Studio agents and third-party agents through an SDK or workload identity federation.

Deployment: SaaS within Microsoft Entra.

• VisibilityPartialAgent identities listed in the Entra admin center; MCP server discovery not documented.
• AuthenticationStrongOAuth 2.0 tokens for agents acting alone or on a user's behalf; supports MCP and agent-to-agent protocols.
• Credential handlingPartialAgents retired without orphaned credentials; a secret vault for agents not documented.
• Policy depthPartialConditional Access, ID Protection and ID Governance for agents; per-tool MCP rules not documented.
• Runtime threat detectionPartialRisk detection on identities and network filtering through Global Secure Access; prompt-injection detection not documented.
• AuditPartialSign-in and audit logs for agent authentication and activity.
• Deployment effortLowPart of Entra for Microsoft customers; some security features need a Microsoft Agent 365 licence.

Puts several MCP servers behind one endpoint protected by Cloudflare Access, with SSO for users and tool allowlists per portal.

Deployment: SaaS; dashboard, API or Terraform.

• VisibilityPartialServers an admin adds; discovery of servers already in use not documented.
• AuthenticationStrongUsers through your identity provider in Cloudflare Access; managed OAuth for non-browser clients; service tokens for machines.
• Credential handlingPartialAttaches upstream credentials when proxying, secrets stored encrypted; without per-user upstream OAuth, users share an admin credential.
• Policy depthPartialAccess policies per portal and server; tools enabled per portal; argument rules not documented.
• Runtime threat detectionPartialOptional HTTP logging and DLP through Cloudflare Gateway; injection and poisoning detection not documented.
• AuditPartialEach tool request logged by Access; analytics API for tool-call counts.
• Deployment effortMediumNeeds a domain on Cloudflare and an identity provider in Zero Trust; private servers through Cloudflare Tunnel.

An open-source proxy that runs MCP servers in isolated containers and manages their configuration, credentials and tool access.

Deployment: Open source (MIT); Docker CLI plugin. Its governance features are listed as invite-only.

• VisibilityPartialKnows the servers in your catalogs and profiles; discovery not documented.
• AuthenticationPartialOAuth to upstream servers; user sign-in or SSO for clients not documented.
• Credential handlingStrongSecrets kept in Docker Desktop's secret store and injected when calls are forwarded.
• Policy depthPartialTools enabled per profile; containers with restricted privileges, network and resources; argument rules not documented.
• Runtime threat detectionPartialContainer isolation contains damage; threat detection not documented.
• AuditPartialBuilt-in logging and call tracing; user attribution not documented.
• Deployment effortMediumRuns with Docker Desktop's MCP Toolkit or as a binary on Docker Engine; each client pointed at it.

Runlayer vs Docker MCP Gateway →

A commercial AI security platform, and an open-source plugin-based MCP gateway that sits in front of other MCP servers.

Deployment: Open-source gateway (MIT) plus commercial platform.

• VisibilityStrongPlatform discovers and risk-scores MCP servers across Claude, Cursor, Windsurf and custom agents; the open-source gateway sees only its own config.
• AuthenticationPartialPlatform role-based control per user and team; open-source gateway documents no user authentication.
• Credential handlingPartialMasks secrets in responses; vaulting or short-lived credentials not documented.
• Policy depthPartialIntent-aware and natural-language policies in the platform; argument rules not documented.
• Runtime threat detectionStrongScans tool descriptions for hidden instructions, prompt injection and PII; platform monitors tool calls for indirect injection.
• AuditPartialPlatform audit trail with SIEM export; open-source tracing to local files.
• Deployment effortMediumpip or Docker for the gateway; the platform is demo-led.

An API that screens content going into a model and its output for prompt attacks, data leakage and harmful content, with agent discovery offered separately.

Deployment: SaaS API, or self-hosted with an Enterprise licence on Kubernetes or Docker.

• VisibilityPartialAgent Discovery connects to Bedrock, Google Cloud, Copilot Studio, Agentforce and others; the guard itself sees only calls sent to it.
• AuthenticationNoneAPI keys for the guard; not an identity or OAuth layer for agents.
• Credential handlingPartialDetects sensitive data leaking; holds no credentials for agents.
• Policy depthPartialPolicies per project in detect or enforce mode; tool allow and deny lists at call time.
• Runtime threat detectionStrongDirect and indirect prompt attacks including poisoned tool responses, data leakage, malicious links.
• AuditPartialGuard logs and analytics; detections exportable to a SIEM.
• Deployment effortMediumYour application or gateway calls the API on each interaction.