MCP adoption creates a second-order problem: once an agent has dozens of servers and hundreds of actions, tool discovery, credentials, approvals and audit logs become infrastructure problems. Managed gateways are emerging to put those controls behind one endpoint.
DigitalOcean's Action Gateway documentation now describes governed access to tens of thousands of tools through a managed MCP endpoint or SDK, including connections for Claude Code and Codex. That makes “gateway vs direct MCP” a practical architecture decision rather than a hypothetical one.
Benchmark status: planned. AiFolder has not published gateway latency or reliability scores yet.
Two architectures
Direct:
Agent → MCP Server A
→ MCP Server B
→ MCP Server C
Gateway:
Agent → MCP Gateway → Tool A / B / C / ...Direct connections minimize intermediaries. A gateway centralizes identity, approvals, connection management and observability. Neither is automatically better.
What we will benchmark
| Metric | Why it matters |
|---|---|
| p50/p95 tool-call latency | Measures gateway overhead |
| Tool discovery tokens | Large catalogs can inflate context |
| Permission granularity | Tests least privilege |
| Approval UX | Human control for risky actions |
| Failure isolation | One broken provider should not break all tools |
| Audit completeness | Needed for debugging and governance |
The 10, 100 and 1,000-tool test
We will expose synthetic tools with predictable schemas and gradually increase catalog size. The agent receives identical tasks. We measure how many schemas enter context, selection accuracy, latency and token consumption. This isolates protocol/tooling overhead from the quality of third-party APIs.
Permission test
Our fixture has read-only and write actions. The agent should freely call low-risk reads while requiring approval for a synthetic destructive write. We record whether policy lives at the agent, gateway, downstream service, or multiple layers.
Failure test
We intentionally make one synthetic tool slow and another unavailable. A robust gateway should surface scoped errors and preserve unrelated tools. Direct MCP may have a smaller blast radius by construction; the benchmark will measure rather than assume.
When direct MCP is simpler
For one agent with two trusted local servers, a gateway can be unnecessary infrastructure. Direct connections are easier to inspect and have fewer moving pieces. Gateways become interesting when credentials, teams, approvals and many providers need a shared policy plane.
When a gateway earns its place
Centralized audit logs, credential brokering, policy enforcement and a stable endpoint can reduce operational work at scale. The trade-off is concentration risk and an additional network hop.
