Both put a gateway in the MCP request path. Envoy AI Gateway is a CNCF project for teams running Envoy and Kubernetes: solid for routing and server-level auth. PolicyLayer is the policy layer for teams who are not on Envoy and do not want to be: deterministic, argument-level rules on every tool call, with policy already written for your servers, hosted, no CRDs. Here is where each one fits.
If you run Envoy and Kubernetes, Envoy AI Gateway is a sensible base. If you do not, PolicyLayer gives you the same enforcement point without the platform.
PolicyLayer is the hosted gateway your MCP traffic runs through. Connect your servers and every tool call is checked against deterministic, deny-by-default policy before it executes: allow, deny, rate-limit, or require approval, with argument-level rules, per-identity scopes, and a per-call audit log a non-infrastructure person can read. Recommended policy ships pre-classified across 220,000+ catalogued tools, and there is nothing to deploy.
Envoy AI Gateway is an open-source CNCF project that adds AI and MCP routing to Envoy Proxy. It is primarily operated on Kubernetes, exposing MCPRoute and Backend custom resources (a standalone local mode also exists), handles upstream routing, server-level authentication, and static tool selection, and emits OpenTelemetry traces and Prometheus metrics. Production use is operated by a platform team as part of an Envoy and Kubernetes stack.
The factual delta between an infrastructure gateway and a policy layer.
| PolicyLayer | Envoy AI Gateway | |
|---|---|---|
| Tool control | Per-call policy: allow, deny, rate-limit, or approve on the call and its arguments | Static tool selection: allow or hide tools by name or regex |
| Default policies | Recommended rules pre-classified across 220,000+ catalogued tools | None out of the box; you author the configuration |
| Upstream auth | Per-person scoped grant tokens; upstream keys held by the gateway | Injects a shared upstream key or forwards client headers; does not mint per-person scoped tokens |
| Granularity | Per tool and per argument (deny refunds over $1k, block DELETE without WHERE) | Per tool, by allow or hide |
| Approvals | Human approval gates on any call | Out of scope at the gateway |
| Audit | Argument-level decision log readable without infrastructure knowledge | OpenTelemetry traces and Prometheus metrics |
| Configuration | Hosted control plane and visual editor; no cluster required | MCPRoute and Backend CRDs, YAML, on Kubernetes |
| Operated by | The team itself, with no infrastructure to run | A platform team running Envoy and Kubernetes |
| Deployment | Point your client at a URL; live in minutes | Primarily Kubernetes (CRDs, YAML); a standalone local mode exists |
| Best fit | Teams running MCP servers without a platform squad | Teams already standardised on Envoy and Kubernetes |
You want the same in-path enforcement point without standing up and operating an Envoy and Kubernetes stack to get it.
Not just which tools are visible, but whether a specific call is allowed: deny refunds over a threshold, block a DELETE without a WHERE clause, require a ticket id.
Start from recommended rules pre-classified across 220,000+ tools, instead of an empty configuration.
A per-call log of tool, arguments, and decision that a security or compliance reviewer can read without tracing OpenTelemetry spans.
Your platform team operates Envoy, and adding MCP routing as another set of custom resources fits how you already work.
You want upstream routing, load balancing, and server-level authentication more than per-call argument policy.
Running the gateway entirely inside your own Kubernetes environment is a hard requirement.
They can coexist. Envoy AI Gateway can route and authenticate MCP traffic at the infrastructure layer; PolicyLayer can enforce deterministic, argument-level policy on the tool calls that pass through. Most teams without an Envoy platform reach for PolicyLayer alone.
Whatever your agents touch, the same engine, audit, and access model is doing the work underneath every rule you write.
Rules run as code, not model judgement: argument-level conditions, quotas, deny-by-default. The same call gets the same decision every time.
Writing policies →Your security or compliance team writes and attaches policy without ever holding the upstream credentials or grant tokens.
Roles →Every call is logged with its decision and the rule that fired, attributed to the identity, in an append-only record. Argument values are redacted, never stored.
Logs & security →Upstream secrets are encrypted at rest and injected by the gateway. The agent only ever holds a scoped token.
Logs & security →Every person and agent connects with its own scoped grant. Rotate or revoke any one of them instantly, without disrupting the rest.
Core concepts →Hosted gateway. Point your clients at it, register a server, issue a token. Nothing to install.
Quick start →No. PolicyLayer is a hosted gateway. You point your MCP client at a URL and route your servers through it, with nothing to deploy. Envoy AI Gateway is primarily operated on Kubernetes; it has a standalone local mode, but production use is cluster-oriented.
Envoy AI Gateway focuses on routing, server-level authentication, and static tool selection (allow or hide tools). PolicyLayer evaluates the call and its arguments against deterministic rules: deny a refund over a limit, block a DELETE without a WHERE clause, require approval.
Yes. PolicyLayer ships recommended policy pre-classified across 220,000+ catalogued tools, so you start from known-risk rules. Envoy AI Gateway gives you the engine and you author the configuration.
Yes. Envoy can handle routing and server-level auth at the infrastructure layer while PolicyLayer enforces argument-level policy on tool calls. Teams without an Envoy platform typically use PolicyLayer on its own.
Deterministic, deny-by-default policy on every MCP tool call: approval gates, per-identity scopes, argument-level rules, and a readable audit log. No Kubernetes, no CRDs. Route your existing MCP servers through the gateway, live in minutes.
Instant setup, no code required.