agentgateway vs codex-security
Both are catalogued under Guardrails & Security. The figures come from the GitHub API; the assessments are ours.
agentgatewayProxy that puts auth, policy and tracing in front of MCP, A2A and LLM trafficOfficialApache-2.0
codex-securityCLI and TypeScript SDK that scans a codebase to find, validate and fix security vulnerabilities.OfficialApache-2.0At a glance
| At a glance | agentgateway | codex-security |
|---|---|---|
| License | Apache-2.0 | Apache-2.0 |
| Languages | Rust, Go | TypeScript, Python |
| Deployment | Self-hosted / Runs locally | Runs locally / Self-hosted |
| Maturity | Growing | Growing |
| Stars | 4.4k | 9.9k |
| Star growth over the last 7 days | — | — |
| Forks | 730 | 689 |
| Open issues | 343 | 129 |
| Last commit | 14 Aug 2026 | 16 Aug 2026 |
| Activity | Active | Active |
What each one does
agentgateway
A Rust data plane that sits between agents and everything they call — model providers, MCP servers, other agents — so authentication, RBAC, rate limits and OpenTelemetry export are configured once instead of reimplemented in every agent. Solo.io donated it to the Linux Foundation in August 2025 and it moved under the Agentic AI Foundation in June 2026, alongside MCP and goose. It is young for something that sits in the request path: per-user identity onto downstream MCP servers is still an open issue, so confirm the authentication model you need before putting it in front of production traffic.
Full entry →codex-security
`npx @openai/codex-security scan .` walks a checkout and leaves JSON results on stdout, while `--mode deep` spreads discovery across workers and subagents until it stops turning up anything new. Across runs, `scans compare BEFORE_SCAN_ID AFTER_SCAN_ID` matches findings by root cause and labels them new, persisting, reopened, resolved or unknown, so a second scan reports movement instead of restating the whole report. It is a poor fit as a pre-commit gate: deep discovery runs until `--max-time-hours`, which defaults to 96. Access is also gated — the CLI needs access to Codex Security, and some cybersecurity requests and protected findings require Trusted Access for Cyber approval, so cloning the repo on its own scans nothing.
Full entry →What you can do
agentgateway
- Put several MCP servers behind one port — One
mcpbackend takes a list of named targets — the repository's multiplex example launchesmcp-server-timewithuvxandserver-everythingwithnpx— and exposes them together on a single bind. stdio, SSE and streamable HTTP all terminate at the gateway, so the client sees one endpoint. - Authorise individual tool calls with CEL —
mcpAuthorizationrules are CEL expressions over the verified JWT and the call itself:mcp.tool.name == "echo"leaves one tool open to anyone whilejwt.sub == "test-user" && mcp.tool.name == "get-sum"restricts another to a single subject. Tool-level policy is what the MCP specification explicitly declines to enforce itself. - Route by cost rather than by model name — A virtual model dispatches to real backends through conditional rules — the cost-routing example sends requests whose
max_tokensis 1024 or less togpt-4o-miniand larger ones up the tiers — with the last target acting as the required fallback. Budget and spend controls, prompt enrichment and failover sit on the same OpenAI-compatible surface. - Run it standalone or as a Gateway API controller — A single binary reading flat YAML covers local and non-Kubernetes deployments; the built-in controller implements Gateway API plus the Inference Gateway extensions, routing to self-hosted models on GPU utilisation, KV cache state, LoRA adapters and queue depth. Guardrails hook into regex filters, OpenAI moderation, Bedrock Guardrails, Model Armor or a custom webhook.
- Check the identity story before committing — Enterprise SSO with per-user credentials to downstream MCP services, OAuth Identity Assertion for cross-app access and custom OAuth scopes are all still open issues, and another reports that the current versioning scheme breaks automated patch updates. The proxy is production-shaped; the delegated-identity half of it is not finished.
codex-security
- One command, or one SDK call —
npx @openai/codex-security scan .is the whole entry point;--modeland--effort hightune the run. The TypeScript equivalent isnew CodexSecurity()plusawait security.run("."), which returnsresult.reportPath. - Deep scans with an explicit stop condition —
--mode deeptakes--workersand--subagentsfor parallelism and--stop-after-no-new 3,--max-discovery-runs 10and--max-time-hours 1.5as budgets. Discovery otherwise halts at 96 hours, and findings completed before the limit are still returned. - Findings tracked across scans —
scans compare BEFORE_SCAN_ID AFTER_SCAN_IDreuses saved matches and matches the rest by root cause; findings stayunknownwhere coverage was incomplete or the original location was never reviewed.findings list [repository]surfaces open findings not confirmed by the latest scan. - Swap in another inference provider —
--provider openrouter,--provider fireworksand--provider amazon-bedrockpair with a matching--modelsuch asanthropic/claude-sonnet-4.5. Bedrock acceptsAWS_BEARER_TOKEN_BEDROCKas well as standard access keys, profiles, web identity and the default AWS credential chain. - Containerized bulk scanning — The official image and its Docker Compose config run noninteractive, resumable scans of repositories pinned to immutable Git revisions.
--knowledge-base PATHshares security documents with every repository,--scan-prompt-file PATHcarries the scan instructions common to all of them, and apromptCSV column holds the instructions for one repository.