What each is for, where IBM ContextForge is strong, and how the two differ, capability by capability.
IBM · Based on the vendor's public documentation, last reviewed .
IBM ContextForge
ContextForge is IBM's open-source gateway and registry that federates MCP servers, A2A agents and REST or gRPC APIs behind one endpoint, with team-scoped roles, SSO, per-user OAuth to upstream servers and plugins.
Open source (Apache 2.0) and self-hosted: a Python package on PyPI, container images, a Helm chart for Kubernetes, and guides for OpenShift and the major clouds. The admin UI has an air-gapped mode.
Vekri
Runtime authorization for AI agents. Vekri Gateway checks every tool call against a verified identity, a task scope and Cedar policy; privileged writes wait for a person's approval of the exact operation; a broker executes with credentials the agent never sees.
In Vekri's cloud, or self-hosted in your Kubernetes cluster with no connection to Vekri.
Side by side
| Capability | What it means | Vekri | IBM ContextForge |
|---|---|---|---|
| Decides each tool call inline | Every agent tool call is allowed or denied before it reaches the protected system. | Yes Vekri Gateway decides every MCP tool call sent through it before the broker executes it; a denied call never reaches the system. It is a boundary only when it is the only path to that system. | Documented Each tool call must pass token team scoping and a role check for permission to execute tools; a caller without that permission receives HTTP 403. [2] |
| Verified workload identity | An agent running as a workload proves who it is with a credential the platform issued, not a shared key. | Yes Kubernetes projected service-account tokens, verified with TokenReview before Vekri issues a short-lived token for the run; every call is then authenticated. SPIFFE X.509-SVIDs from a configured trust bundle (no Workload API yet). | Not in public docs Clients authenticate with JWTs, API tokens or tokens from an external identity provider. Attesting a workload's identity, for example with Kubernetes or SPIFFE, is not described. [5] |
| Employee agents use company SSO | Agents that employees run sign in as that employee, through the company identity provider. | Yes Vekri is the MCP authorization server for Claude Code and federates to your OpenID Connect provider. SAML sign-in is not available yet. | Documented SSO with GitHub, Google, Microsoft Entra ID, Okta, Keycloak and generic OIDC providers, and OAuth 2.0 with dynamic client registration and PKCE. [5] |
| Task-scoped permissions from the server | What an agent may do is set per task by the server, not by the agent or its prompt. | Yes A run scope for workloads, or a protected access assignment for employees. The effective permission is always an intersection, never a widening. | Not in public docs Access follows the teams in the caller's token and the roles held in them. A scope issued by the server for each task is not described in the public documentation. [2] |
| Policy as code, deny by default | Decisions come from versioned policy, and anything not allowed is refused. | Yes Cedar over typed operations. Unknown operations and evaluation errors are denied, and a revision can be simulated before it is published. | Partly Team-scoped roles grant permissions such as executing tools, and new tools are private by default. Optional plugins can enforce Rego policies through OPA, or Cedar policies. [2] [3] [4] |
| Approval of the exact operation | A person approves one specific operation, and the approval cannot be reused for another. | Yes Privileged writes wait for another person to approve that operation, bound to its digest, short-lived and single use, with separation of duties. | Not in public docs ContextForge relays MCP elicitation requests from upstream servers, so a server can ask the user to confirm an action. An approval step enforced by the gateway is not described in the public documentation. [5] [10] |
| Agent never holds backend credentials | Secrets for the protected system stay out of the agent's reach. | Yes A broker executes with narrowly scoped Kubernetes or GitHub App credentials. Incoming tokens are never forwarded. | Documented The gateway acts as the OAuth client for upstream servers, stores per-user tokens encrypted and attaches them to requests. On-behalf-of token exchange and header passthrough are also available. [6] [7] [5] |
| Audit evidence of decision and outcome | Each call leaves a durable record of what was decided and what happened. | Yes Intent is recorded durably before execution and the outcome after; an uncertain outcome is never retried blindly. | Documented Audit trails of changes and security events such as authorization denials can be stored in the database, and tool invocations can be traced with arguments, results and timing. Both are turned on in configuration. [8] [9] |
| AI agents on workstations | Finds AI coding agents and other AI applications on employee devices, and watches or controls what they do there. | Partly Vekri Endpoint discovers coding agents, desktop and IDE AI apps, local models and their MCP servers on macOS and Linux, and its local MCP gateway decides each MCP tool call sent through it (Claude Code verified connecting; tool calls verified with an MCP client library). On macOS, a network gateway mediates MCP requests to approved remote servers, and agent control stops AI agents the organization has not allowed. Hooks observe built-in tools without blocking them; Windows is not supported. | Not in public docs Discovering coding agents on employee devices is not described in the public documentation. |
| Prompt and output inspection | Detects prompt injection or sensitive data in what models read and write. | Partly Tool results on Vekri Gateway and the local MCP gateway are inspected for prompt injection before the agent reads them; sensitive-data categories are detected on the device, off by default. Browsers and file uploads are not inspected. | Documented Plugins detect and redact PII, detect secrets such as API keys and private keys, and moderate content through IBM Watson, Granite Guardian, OpenAI, Azure or AWS. [4] |
| Systems covered | Which systems, platforms or agents the product works with. | Kubernetes and GitHub, with GitLab, PostgreSQL, MySQL, MongoDB, Slack, Jira, Linear, Asana, ClickUp, monday.com, HubSpot, Pipedrive, Zendesk, Freshdesk and custom OpenAPI connectors in preview. | Any MCP server, A2A agents, and REST or gRPC services exposed as MCP tools, over HTTP, WebSocket, SSE, stdio and streamable HTTP, with more than 40 plugins. |
| Deployment | How the product is delivered. | In Vekri's cloud, or self-hosted in your Kubernetes cluster with no connection to Vekri. | Open source (Apache 2.0) and self-hosted: a Python package on PyPI, container images, a Helm chart for Kubernetes, and guides for OpenShift and the major clouds. The admin UI has an air-gapped mode. |
Every agent tool call is allowed or denied before it reaches the protected system.
An agent running as a workload proves who it is with a credential the platform issued, not a shared key.
Agents that employees run sign in as that employee, through the company identity provider.
What an agent may do is set per task by the server, not by the agent or its prompt.
Decisions come from versioned policy, and anything not allowed is refused.
A person approves one specific operation, and the approval cannot be reused for another.
Secrets for the protected system stay out of the agent's reach.
Each call leaves a durable record of what was decided and what happened.
Finds AI coding agents and other AI applications on employee devices, and watches or controls what they do there.
Detects prompt injection or sensitive data in what models read and write.
Which systems, platforms or agents the product works with.
How the product is delivered.
More comparisons
Linux Foundation (created by Solo.io)
agentgateway is an open-source proxy for model, MCP and A2A traffic, hosted by the Linux Foundation. It authorizes MCP tools with CEL rules, accepts SPIFFE identities and exchanges tokens for backend credentials.
Cloudflare, Inc.
Cloudflare One gathers remote MCP servers behind portals protected by Cloudflare Access, with curated tools, managed OAuth and per-request logs. Gateway adds DLP and detects MCP traffic; AI Gateway handles model traffic.
Docker, Inc.
Docker's open-source MCP Gateway runs MCP servers in containers behind one endpoint. The paid Docker AI Governance tier adds Cedar policy for MCP tool calls, with rules on arguments and in-session confirmation.
Kong Inc.
Kong AI Gateway routes model, MCP and A2A traffic through one gateway built on Kong Gateway. Its Enterprise MCP plugins expose REST APIs as MCP tools, validate OAuth tokens and apply per-tool access lists.
Microsoft
Microsoft's open-source MCP Gateway deploys, scales and routes MCP servers and tools in Kubernetes behind one gateway, with a management API and portal, Entra ID sign-in and app roles on each server and tool.
Contact Sales
Talk to us about the AI your organization uses, the systems agents reach and how you deploy: in Vekri's cloud, or inside your own Kubernetes cluster.