Start with the problem, not the product label
If a local stdio server must be reachable over HTTP, that is a transport-boundary problem and a proxy can be enough. If many teams need a shared endpoint, consistent identity, allowlists, quotas, audit, and lifecycle controls, the problem is a gateway. Buying a gateway for a single transport bridge adds an unnecessary control plane; treating a proxy as fleet governance leaves policy scattered.
A proxy does not automatically preserve security semantics
A proxy that forwards OAuth or API tokens can become a confused deputy. Current MCP security guidance forbids accepting tokens that were not issued for the MCP server and passing them through unchecked. Document which component is the OAuth client, which resource a token targets, where consent occurs, and which identity reaches the downstream service.
- Terminate TLS and validate the upstream destination.
- Keep token audience separation between the MCP endpoint and downstream APIs.
- Define whether the proxy rewrites tool names, schemas, errors, or timeouts.
- Log correlation IDs without logging credentials or full sensitive payloads.
A gateway centralizes controls and centralizes failure
Central routing, tool allowlists, schema monitoring, rate limits, and audit can reduce inconsistent enforcement. The trade-off is a wider blast radius: a bad route, stale cache, identity mapping error, or outage can affect every connected server. Run the gateway as production infrastructure with health checks, policy tests, change review, and an escape path for critical workflows.
Decide by team shape
A solo developer usually needs direct connections or one lightweight proxy. A small team may use a shared remote endpoint when it eliminates repeated local setup. A platform team serving many groups should evaluate a gateway when it can name the policies it will enforce and the evidence it will produce. 'Enterprise' alone is not a requirement.
Validate the chosen architecture
Trace one request end to end: discovery, tool selection, authorization, downstream call, response, cancellation, and logs. Then repeat with an unreachable upstream, an expired token, a schema change, and a slow tool. Measure added latency in your environment; do not copy a vendor benchmark into an architecture decision.