Head-to-head · updated 13 September 2026
DataShield vs Docker MCP Gateway: who governs the pipe, and who governs the data?
Docker is good at this. The MCP Catalog gives you signed, boxed MCP servers. The Toolkit wires them into Claude Code or Cursor in one click. The Enterprise Gateway adds SSO. An approved server list, call-level rules, an event stream to your SIEM too. If your problem is that thirty coders each pasted a random MCP server into their config file: buy Docker and stop reading here.
Our problem starts one step later. A gateway can say this: the agent could call the tool. It can't say what came back. DataShield sits at the data. We tokenize data sets at ingest. Agents query tokenized data over MCP. Detokenization is a locked, checked step. We seal every governed call into a hash chain you can check without trusting us. Below is the honest split, with the rows Docker wins too.
The short version
Pick DataShield when
- Someone will one day ask you to prove an agent's access log wasn't edited. A SIEM stream can't answer that. Our chain answers it with math. Run the verifier.
- The risk sits in the rows the tool sends back, not the tool. We tag and tokenize at ingest. We can broad-band quasi-IDs: dates to year, decade or age band; ZIPs to 3 or 4 digits; part phones, SSNs and emails. Each column gets a risk score. How that works.
- A GDPR erasure request has to land without breaking your audit trail. Crypto-shred does that. Dropping log lines does not.
- You need a crisis path that is scoped, timed and logged. Break-glass for agents ships in Auth, live and in use. See Auth.
Pick Docker when
- The threat you fear is a rogue MCP server on a laptop. Their sandbox model is real isolation, not a policy PDF. We don't do that, and we won't pretend to.
- You want breadth on day one. The catalog ships signed images with SBOMs from Stripe, Grafana, GitHub, Heroku and more. Building that yourself takes a year.
- Your coders already live in Docker Desktop. Zero setup pain beats any feature list. The open-source gateway costs nothing.
- You need one rule that covers every harness: Claude, Copilot, Gemini, whatever ships next quarter. That's their pitch, and it's a good one.
Bottom line: run both. Docker governs the pipe and the box the tool runs in. DataShield governs the data the tool hands back, and keeps proof of the call. If you can fund just one, and your risk is regulated data, not rogue code, start here.
Feature by feature
Competitor cells state what Docker's public site, docs and GitHub say, as of the date above. Did we get something wrong? Email support@myorg.ai and we'll fix it, credited.
| What matters | DataShield | Docker MCP Gateway | Edge |
|---|---|---|---|
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are chained too. A check names the fault: tampering, insertion, deletion or a cut. Try the verifier. | A set event per rule check, tied to user and agent, streamed to Splunk, Datadog or Grafana. Rich and handy. We found no claim that the record is tamper-proof. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling. A set rights tier and a pull check come before dispatch. Rights are per agent, not per group. | Sign-in through your IdP. Group-scoped server and tool view. Allow and deny rules, by server, tool and pipe. The next call picks up firm-wide revoke. This is a real rule layer. | ◈ |
| Sandbox isolation | None. We check and log. We don't box in a process. | Each MCP server runs in its own box. Docker Sandboxes add microVM isolation. Plus network and file allow or deny rules. | ◇ |
| Supply chain of tools | We publish MCP endpoints on Auth, Ontology and Lighthouse. We ship OCI images for Auth, Ontology, Corpus and Lighthouse, with a role-routing start point and per-service health checks. Every deploy carries a signed file. Guardian checks its EdDSA signature on the host. No list of third-party servers. | Signed catalog images with SBOMs and Docker Scout source checks on pull. Publisher checks on Docker Hub. Strong, and a threat area we don't cover. | ◇ |
| Data handling | We tokenize data sets at ingest. Agents query tokenized data over MCP. Detokenization is a locked, checked step. Tokens are fixed, join-safe and vault-reversible. Broad-banding covers dates, ZIPs, phones, SSNs and emails, with a risk score per column. | The gateway routes calls and passes keys through. It doesn't tag, tokenize or mask what the tool sends back. We found no PII or PHI handling in their docs. | ◆ |
| Break-glass | Scoped, time-boxed access, just for a crisis, just for agents. It auto-revokes and can't be quietly wiped from the log. | Not listed in public docs. | ◆ |
| GDPR erasure | Crypto-shred of per-person key parts, plus ISO 27560 consent receipts. Actor IDs carry an HMAC lock. The chain still checks out after a person is erased. | Not covered. SIEM keep-time is your problem. Dropping events from it weakens the record you kept for the auditor. | ◆ |
| Secrets and credentials | Connection Vault holds locked per-person keys, with eight modes, one being Snowflake keypair JWT. We log use against the agent. | Keys stay in your secret store. They arrive at call time only, never shipped in client config. OAuth flows proxied by the gateway. Genuinely good build. | ◈ |
| MCP and agents | MCP tool tokens with scope ceilings, set by Auth and checked via JWKS. Per-call logs tie back to the agent. | Joins many servers behind one gateway MCP server. Dynamic MCP keeps context flat as the catalog grows. Works with Claude Code, Cursor, VS Code, ChatGPT Enterprise. | ◇ |
| Deployment | Self-hosted, in your own cloud or room. Or on a single-tenant box we run for you. Your keys. | Open-source gateway under MIT on your own machine. Enterprise Gateway run in your cloud, or as a closed-off box. A Docker-run cloud sits listed as coming soon. | ◈ |
| Maturity signals | Auth, Guardian and Lighthouse are live and in use. Guardian and Lighthouse have run since April 2026. SOC 2 is not yet in place, and we say so. | Docker Inc. since 2013. Catalog and Toolkit shipped May 2025, with 100+ verified tools. Enterprise line shipped through 2026. Millions of coders already installed. | ◇ |
| Pricing | Published price, a quick quote, no sales wall. | OSS gateway free. Docker plans run $0 to $24 per user per month. MCP Enterprise Gateway and AI Governance are contact-sales, with no figures shown. | ◈ |
◆ DataShield leads◇ Docker MCP Gateway leads◈ comparable
Docker claims come from docker.com product pages, the Docker blog, and the docker/mcp-gateway repository. We checked last on 13 September 2026. We link them below, not just from memory.
Three things you get here that you won't get from an MCP gateway
A log you can prove, not just ship
Streaming events to Splunk is good hygiene. It's not proof. Anyone with write access to the index can change the story. The index can't tell you it happened. Ours is a hash chain with signed checkpoints. The verifier says what broke, not just that it did. That's the trait EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser.
Control over the payload, not just the call
A gateway approves snowflake.query. Then 4,000 rows of patient data come back, and the gateway waves them through. That was never its job. We tokenize at ingest and broad-band quasi-IDs. The rows the agent reads were never the raw ones. See the data layer.
An erasure you can defend
GDPR says delete the person. Your examiner says keep the log. Those two rules fight. Unless the log was built for it. Crypto-shred wipes the person's key parts. The data goes unreadable. The chain still checks out. See the diagram.
Where Docker is genuinely stronger
We'd rather you hear this from us. Docker owns the coder's machine, and that's where agent tool use truly happens. Box isolation per MCP server is a real security tool that we don't have. Signed images with SBOMs and source checks answer a supply-chain question we don't answer at all. The catalog has grown since May 2025, and ships tools from Stripe, Grafana, GitHub and Heroku. That's breadth nobody matches fast. And their 2026 enterprise line is not a slide deck. SSO, group-scoped tool view, call-level rules, firm-wide revoke and audit streams all ship today. Their writing is good too. The post on the ExploitGym event makes the right point. Agents took roughly 17,600 actions in four and a half days. Human-speed review can't scale to agent speed.
Here's the push-back. Docker's own point: the line should sit below the harness. Agents route around guardrails they can see. Fair. But a gateway is still a pipe, and a pipe only governs traffic that flows through it. The moment an agent reaches a database through a path Docker isn't brokering, the rule goes silent. The SIEM never hears about it. That's why we put the check at the data layer. We seal the call where it was made. And when the examiner asks for the March records, "we streamed them to Splunk" is an answer about plumbing. "Here's the chain, run the verifier yourself" is an answer about proof.
Questions worth asking both of us
These are the questions we'd want answered if we were buying. Ask them on every vendor call, including ours.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record ties to the one before it. We sign and chain checkpoints. A check tells delete apart from a cut and from a tamper. Run it on a sample chain at /verify. Docker: their pages list a set event per rule check, streamed to your SIEM. We found no claim of tamper-proof design. Ask them what stops a privileged user from editing the index.
What happens to a revoked agent mid-session?
Both of us handle this, and we won't pretend otherwise. DataShield re-checks rights on every governed tool call, so the next call fails closed. Docker's Enterprise Gateway can cut off a server or tool for the whole firm. Sessions pick it up on the next call. The gap is scope. Theirs is firm-wide by server and tool. Ours is per agent, with a scope ceiling and a rights tier. Ask both of us to show it live.
If we already run Docker MCP Enterprise Gateway, what does DataShield add?
Three things their docs don't cover. What's inside the response. Whether the record can be shown unchanged. What happens on an erasure request. Docker approves the call. We tokenize the data set at ingest, so the rows the agent queries were never raw. We seal the call into a checkable chain. Most serious buyers run both layers.
Isn't container isolation enough?
It's great at limiting blast radius, and we'd keep it. But isolation is about what a broken-into process can touch on the host. It says nothing about whether an OK'd agent was let to read that one person's data. Even one acting exactly as built. Those are two different questions. Regulators ask the second one.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-person key parts, and sends an ISO 27560 consent receipt. Actor names in the chain carry an HMAC lock. The proof still checks out after the person is gone. Docker: we found nothing on erasure in their MCP or governance docs. Ask what you're meant to do with the SIEM events when a data subject writes in.
Does DataShield have SOC 2?
Not yet, and we won't say otherwise. Auth is live with a public threat model and a verifier anyone can run. Guardian and Lighthouse have run live since April 2026. Docker is a firm of a different size, with a decade of shipping behind it. Design-partner terms here include source escrow, so one small vendor isn't a single point of failure. Details on the security page.
- Docker MCP Enterprise Gateway: "Policy governs every call, credentials stay in your secret store, and every decision is recorded." Audit events stream to your SIEM. - docker.com, 13 Sep 2026
- Docker AI Governance: centralized sandbox, network and MCP controls, with structured events streamed to Splunk, Datadog or Grafana. Contact-sales. - docker.com, 13 Sep 2026
- MCP Catalog and Toolkit launched with 100+ verified tools and partners including Stripe, Elastic, Grafana Labs and Kong. - Docker blog, May 2025
- "A policy you write up will apply to every harness. And every action, by all your agents, lands in one record." - Docker blog, 2 Sep 2026
- Agents took roughly 17,600 actions over four and a half days in the ExploitGym incident: about 147 hours of work at thirty seconds of human review each. - Docker blog, 18 Aug 2026
- The docker/mcp-gateway project is MIT licensed, with profiles, tool allowlists, secrets, OAuth and call tracing. - GitHub, 13 Sep 2026
- Docker plans run from $0 (Personal) to $24 per user per month (Business). MCP Enterprise Gateway is not priced on the page. - docker.com/pricing, 13 Sep 2026
Other head-to-heads
DataShield vs MintMCP
A hosted MCP gateway versus authority and evidence at the data.
AdjacentDataShield vs AI gateways
The gateway governs the pipe. Something still has to govern the data.
AdjacentDataShield vs Obot
Open-source MCP control plane, and where the evidence layer sits.
AllEvery comparison
One honest scorecard per vendor, sources at the bottom.
Keep your Docker gateway. Then see the two moves it doesn't have. Break a live audit chain, and watch the verifier name the break. Revoke an agent mid-session. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →