5 Best MCP Gateways for Databases in 2027
Which gateway or control layer to put between Claude, ChatGPT or Cursor and your production databases, compared on row and column rules, approvals and audit logs, with verified pricing.
- €29 per user per month, everything in Starter included
- Rated 5.0 on G2 (2 reviews)
Updated 14 November 2026. Prices checked 14 November 2026 against each vendor’s own pricing page.
- FormalContact sales
One policy layer over databases and MCP servers
- See SaturnSQL GuardSaturnSQL Guard€29/user/mo
Governing AI tools on databases without running a gateway
- TeleportFree CE / contact sales
Self-hosted access for people, servers and MCP in one place
- hoop.devFree OSS / contact sales
An open source guardrail between agents and live databases
- Docker MCP GatewayFree (MIT)
A free, open source gateway for local MCP servers
What is an MCP gateway?
An MCP gateway is a proxy between AI clients and the MCP servers they call. Instead of configuring every server in every client, people connect Claude, ChatGPT or Cursor to the gateway, and it decides who may use which server and tool, supplies the credentials, and logs the calls.
Most gateways are general. They see a database MCP server as one more tool, so they can allow or block execute_query, but not the SQL inside it. For production data the questions are narrower: can the agent write, which tables, columns and rows can it read, who approves a change, and is every query tied to a person? This list ranks gateways on those.
If the MCP tools you worry about are databases
SaturnSQL Guard decides, per database, whether Claude, ChatGPT or Cursor can reach it and how far they may go, holds risky queries until a person approves the exact SQL, limits tables, columns and rows per person, and logs every query under a name. There is no gateway to run. It governs only SaturnSQL’s own MCP server, so it is not a gateway for your other tools.
Feature comparison
| Formal | SaturnSQL Guard | Teleport | hoop.dev | Docker MCP Gateway | |
|---|---|---|---|---|---|
| Gateway for any MCP server* | ✓ | — | ✓ | ~ | ✓ |
| Allow or block tools per person* | ✓ | ~ | ✓ | ? | ~ |
| Limit tables, columns or rows* | ✓ | ✓ | ? | ~ | — |
| Value masking | ✓ | ✓ | ? | ✓ | — |
| A person approves a risky query* | ~ | ✓ | ~ | Enterprise | — |
| Audit log of AI database activity* | ✓ | ✓ | ✓ | ✓ | ~ |
| Nothing to deploy in your network* | — | ✓ | — | — | ~ |
| Open source* | ? | — | ✓ | ✓ | ✓ |
| Self-hosted option* | ~ | — | ✓ | ✓ | ✓ |
| Starting paid price | Contact sales | €29/user/mo | Contact sales | Contact sales | Free |
✓ available · ✓ Paid = not on the free tier · Sales = Enterprise plan, through sales · ~ partial · ? not documented by the vendor · — not available
- Gateway for any MCP server: SaturnSQL governs its own MCP server, not other tools. Formal covers remote servers over HTTPS. hoop.dev is a sidecar you place in front of a gateway or a system.
- Allow or block tools per person: SaturnSQL sets what AI tools may do per database instead: Off, Shared queries only, Read-only or Same as the user. Docker allowlists tools per profile, not per person.
- Limit tables, columns or rows: SaturnSQL hides tables and columns, masks columns and filters rows, on PostgreSQL, Redshift, MySQL, SQL Server and BigQuery. Formal masks columns and filters rows out of results. hoop.dev masks values.
- A person approves a risky query: Formal approves one-time or time-bound exceptions to a policy, and Teleport approves access requests for a role or resource, rather than reviewing the SQL itself.
- Audit log of AI database activity: Docker logs tool names and the shape of arguments, not their values, so not the SQL.
- Nothing to deploy in your network: SaturnSQL connects to the database from a static IP or through an SSH bastion. Docker runs on each person’s machine. A proxy inside your network is also the stronger boundary, which is why the infrastructure tools use one.
- Open source: Teleport’s code is AGPL-3.0; its Community Edition binaries are free for companies under 100 employees and US$10M revenue.
- Self-hosted option: Formal’s Connector runs in your infrastructure; its control plane is hosted by Formal.
Prices checked 14 November 2026 against each vendor’s own pricing page: Formal · SaturnSQL Guard · Teleport · hoop.dev · Docker MCP Gateway.
The 5 best MCP gateways for databases
Formal
Best for: One policy layer over databases and MCP serversFormal is the most database-aware MCP gateway we checked: the same Connector proxies remote MCP servers and databases such as Postgres, MySQL, Snowflake and BigQuery, so one set of identity-based policies can block a query, mask columns or drop rows from results, though its prices are not published.
Strong
- + MCP gateway with access per user, group or tool, and every tool call logged under a person
- + Database proxy for Postgres, MySQL, MariaDB, Redshift, MongoDB, Snowflake, BigQuery, ClickHouse, DynamoDB and Redis
- + Policies can block a query, mask columns, filter rows out of results or add a row limit
- + Admins approve one-time or time-bound exceptions to a blocked action
Limits
- − No published pricing; it starts with a demo
- − The Connector runs in your infrastructure, and the control plane is hosted by Formal
- − The MCP gateway covers remote servers over HTTPS, not local stdio servers
Pricing: Not published. Formal’s site offers a demo. pricing page, checked 14 November 2026.
SaturnSQL Guard
Best for: Governing AI tools on databases without running a gatewaySaturnSQL Guard is not a general MCP gateway, it governs the AI tools that reach your databases through SaturnSQL’s own hosted MCP server: per database it sets what Claude, ChatGPT or Cursor may do, holds risky queries for a person to approve, and logs every query under a name, on the Pro plan at a published €29 per user per month.
Strong
- + AI tool access per database: Off, Shared queries only, Read-only or Same as the user
- + Risky AI requests wait for a person, who approves the exact SQL to run once
- + Hide or mask columns, hide tables and filter rows per person, in every AI tool they connect
- + Audit log of every query from the editor, schedules, API keys and AI tools, including refused ones
- + Each person signs in over OAuth, and the model never holds the database credentials
Limits
- − Governs its own MCP server only, not other tools such as Slack or GitHub
- − Access rules check the SQL on PostgreSQL, Redshift, MySQL, SQL Server and BigQuery; a restricted database user stays the real boundary
- − No SAML or SCIM on Guard, no self-hosting and no SOC 2 report
Pricing: Guard comes with the Pro plan, €29 per user per month with everything in Starter. Pro is coming soon, with a waitlist. Starter, with the MCP server but without the governance features, is €19 per user per month. pricing page, checked 14 November 2026.
Teleport
Best for: Self-hosted access for people, servers and MCP in one placeTeleport enrolls MCP servers next to the databases, servers and clusters it already protects, with per-tool allow and deny rules in roles and an audit event for every MCP request in every edition, and its Community Edition is free for companies with fewer than 100 employees and under US$10M in annual revenue.
Strong
- + MCP server enrollment, identity-based access and per-tool audit events, Community Edition included
- + Allow and deny tools by name, glob or regular expression in a role
- + Exposes enrolled PostgreSQL databases to MCP clients as tools
- + Self-hosted, with AGPL-3.0 code on GitHub, or Teleport Cloud
Limits
- − Database access over MCP covers PostgreSQL, and Teleport advises a read-only database user because the model can run any query
- − Paid pricing is not published; it depends on active users and protected resources
- − Teleport services to deploy next to your resources
Pricing: Community Edition is free for companies with fewer than 100 employees and under US$10M annual revenue, self-hosted. Paid editions, self-hosted or cloud, are priced on active users and protected resources, with no list price published. pricing page, checked 14 November 2026.
hoop.dev
Best for: An open source guardrail between agents and live databaseshoop.dev is not an MCP gateway itself but a sidecar you place in front of a database, a server or your MCP gateway, where it masks sensitive values, refuses destructive statements and scores each agent action for risk, and the sidecar is MIT-licensed and free with limits.
Strong
- + PostgreSQL, MySQL and MongoDB, plus SSH, RDP, Kubernetes, HTTP and gRPC
- + Masks sensitive values in results before the client sees them
- + Refuses destructive statements, with the reason you wrote
- + Logs each action with its decision: run, mask, approve or block
Limits
- − The free edition allows 1 sidecar, 1 guardrail, 1 masking rule and 1 AI Analyzer rule
- − Approval workflows, the control plane and the full AI Analyzer are Enterprise
- − Enterprise has no published price; it is quoted per environment
Pricing: Open Source is free, MIT-licensed and self-hosted, with 1 sidecar, 1 guardrail, 1 masking rule and 1 AI Analyzer rule. Enterprise requires a license and is quoted per environment, with no published price. pricing page, checked 14 November 2026.
Docker MCP Gateway
Best for: A free, open source gateway for local MCP serversDocker MCP Gateway is the best free starting point, an MIT-licensed gateway that runs each MCP server, a database one included, in its own container with only the secrets it declares and logs every call, but it has no database-level rules, so the database user decides what the model can do.
Strong
- + MIT open source, running with Docker Desktop or Docker Engine
- + Each MCP server runs in an isolated container with restricted privileges and resources
- + Tool allowlists per profile, and secret scanning on tool calls by default
- + Signature checks for servers from Docker Hub’s mcp/ namespace
Limits
- − No database rules: no read-only mode, row or column limits, or approvals
- − Call logs record tool names and the shape of arguments, not the SQL
- − Identity, per-call policy and SIEM audit are in the separate MCP Enterprise Gateway, sold through sales
Pricing: The MCP Gateway is free and MIT-licensed. Docker Desktop is free for companies with fewer than 250 employees and under US$10M revenue, and needs a paid subscription above that. The MCP Enterprise Gateway has no published price. pricing page, checked 14 November 2026.
Other MCP gateways
These are strong general gateways, better than anything above for routing many non-database tools. None documents database-level rules, so the database user still decides what the model can do.
- Kong AI GatewayPlus from $25/mo + usage
Kong’s AI MCP Proxy turns REST APIs into MCP tools or fronts existing MCP servers, with allow and deny rules per tool and an audit log of allowed and denied calls, but the plugin is part of AI Gateway Enterprise and its docs describe no database controls. Pricing.
- Microsoft MCP GatewayFree (MIT)
Microsoft’s MCP Gateway is an MIT-licensed reverse proxy and management layer for MCP servers on Kubernetes, with Entra ID sign-in and role-based access per server, and its docs describe no database controls. Pricing.
- IBM ContextForgeFree (Apache 2.0)
IBM’s ContextForge is an Apache 2.0 gateway that federates MCP servers and REST APIs into virtual servers, with basic, JWT or custom auth, OpenTelemetry tracing and 40+ plugins, self-hosted from PyPI, a container or Helm, and its docs describe no database controls. Pricing.
- TrueFoundry$25/user/mo
TrueFoundry runs LLM and MCP traffic through one gateway, with access rules per MCP server or tool, approval flows for which roles may use a server and a trace of every call, and a free Developer plan for up to 3 users. Pricing.
The category is young and consolidating. Three AI and MCP gateways have already been bought:
| Tool | What happened | Status |
|---|---|---|
| Portkey | Palo Alto Networks completed its acquisition of the AI gateway, now part of Prisma AIRS source | Acquired May 2026 |
| Lunar.dev | Boomi acquired the AI gateway as part of Boomi Connect, its managed MCP server offering source | Acquired July 2026 |
| MCP Manager | Usercentrics acquired the MCP gateway source | Acquired January 2026 |
When a database-specific control is enough
If your agents call ten MCP servers, a general gateway gives you one place for access and logs. If the server that worries you is the one with production data, the gateway is the wrong layer: it sees a tool call, not a query against customers.email.
That is the case SaturnSQL Guard is built for. Each connection has an AI tool access mode: Off, Shared queries only, Read-only or Same as the user. Risky requests from an AI tool (changes by default, or exports or every request if you choose) wait for the person or an admin to approve the exact SQL, which then runs once. Access groups hide tables and columns and filter rows per person, and the rules follow that person into every AI tool they connect. The audit log records every query, including the ones a rule refused. More on database governance for MCP and AI and database access management.
Guard only sees queries that go through SaturnSQL, and its access rules check the SQL before it runs, so a restricted database user stays the real boundary. It has no self-hosting and no SOC 2 report. If you need those, or one gateway for every tool, choose Formal, Teleport or a general gateway above.
Still choosing the MCP server itself? See the best MCP servers for databases.
How we judged
We ranked on what each tool controls once an AI agent reaches a database: whether it can write, which tables, columns and rows it sees, whether a person approves risky queries, and whether every query is logged under a name. We also counted what you have to deploy and whether a price is published. Every price, licence and feature was checked against the vendor’s own site or docs on 14 November 2026 and is linked from its entry. Where a vendor does not document a feature, the table says unknown rather than guess. Where a competitor beats SaturnSQL, it is in our Limits list.
Frequently asked questions
What is an MCP gateway?
An MCP gateway is a proxy between AI clients, such as Claude, ChatGPT or Cursor, and the MCP servers they call. Clients connect to the gateway instead of to each server, and the gateway decides who may use which server and tool, supplies the credentials, and logs the calls. Most are general: they treat a database MCP server like any other tool.
Do I need an MCP gateway to connect Claude to a database?
Not always. A gateway earns its place when agents use many MCP servers and you want one place for access and logs. If the risk you care about is databases, what matters is what the AI tool may do there: read-only or not, which tables, columns and rows, who approves a change, and a record of every query under a person’s name. A database-specific control such as SaturnSQL Guard covers that without a gateway, and a restricted database user stays the real boundary either way.
What is the best MCP gateway for databases?
For one policy layer over both databases and MCP servers, Formal, which can block queries, mask columns and filter rows, though its price is not published. To govern AI tools on databases without running a gateway, SaturnSQL Guard, on the Pro plan at €29 per user per month. If you already use Teleport for infrastructure access, its MCP support adds per-tool rules and audit events. For a free start, Docker MCP Gateway, with the database user doing the limiting.
Is there an open source MCP gateway?
Yes. Docker MCP Gateway and Microsoft’s MCP Gateway are MIT-licensed, and IBM’s ContextForge is Apache 2.0. hoop.dev’s sidecar is MIT-licensed and free with 1 rule of each kind. Teleport’s code is AGPL-3.0, with free Community Edition binaries for companies under 100 employees and US$10M revenue. None of the open source options we checked documents per-person table, column or row rules for databases; hoop.dev masks values.
What should an MCP gateway control for a database?
Five things: which databases AI tools can reach and whether they may write, which tables, columns and rows they can read, a person approving risky changes before they run, credentials that never reach the model, and an audit log that ties every query to a person. General gateways mostly stop at which tools a person may call, so check the database-level items vendor by vendor.
Is SaturnSQL Guard an MCP gateway?
Not a general one, and we would rather say so. SaturnSQL has its own hosted MCP server, and Guard governs what AI tools do through it: AI tool access per database, approvals of the exact SQL, per-person table, column and row rules, and an audit log. It does not sit in front of other MCP servers such as Slack or GitHub, and it has no self-hosting or SOC 2 report. If your agents use many tools, pair it with a general gateway or pick one above.
How much does an MCP gateway cost?
Docker MCP Gateway, Microsoft’s MCP Gateway and IBM ContextForge are free to self-host. TrueFoundry is free for up to 3 users, then $25 per user per month on Pro. Kong Konnect Plus starts at $25 a month plus usage, with its MCP proxy plugin documented under AI Gateway Enterprise. SaturnSQL Guard comes with the Pro plan at €29 per user per month. Formal, hoop.dev Enterprise, Teleport’s paid editions and Docker’s MCP Enterprise Gateway do not publish prices.
Decide what AI tools can do in your databases, from €29 per user per month.
