Proxies and gateways

Pipelock vs Envoy AI Gateway

An Envoy Gateway extension that fronts LLM APIs and multiplexes MCP servers, next to an agent firewall that inspects payloads and signs receipts.

Reviewed: September 2026
Read: 3 min
Sources: 3 checked

At a glance

Pipelock source Envoy AI Gateway

Job Agent firewall. Mediates HTTP, WebSocket, and MCP traffic routed through it, scans it for secret leaks, prompt injection, SSRF, and tool poisoning, and can emit signed action receipts for mediated decisions when a signing key is configured. Envoy Gateway extension that routes LLM API traffic and aggregates MCP servers behind one endpoint, with OAuth, JWT and CEL access control, tool filtering, and upstream API key injection.

Enforcement point Network path, outside the agent process Kubernetes ingress and egress path, on Envoy

Source Open source, Apache-2.0 core; Enterprise under ELv2 Open source, Apache-2.0; Envoy community project

Pricing shape Free core; paid Pro and Enterprise tiers Free

Runs as Single Go binary, self-hosted; container and Helm Kubernetes with Envoy Gateway, Helm, or the standalone CLI

Pick Envoy AI Gateway

You run Envoy Gateway already and want LLM routing and an MCP gateway with OAuth, tool filtering, and CEL rules inside that data plane.

Pick Pipelock

You need what crosses the wire inspected and signed: encoding-aware DLP, injection normalization, tool-description drift, SSRF, and offline-verifiable receipts, on every connection the deployment routes through it.

Run both

Envoy AI Gateway for platform-level routing and access. Pipelock next to the agent for payload inspection and evidence.

Want the runtime boundary, not just another checklist?

Get Pipelock See Pricing

The short version

Pipelock is an open-source agent firewall. It inspects HTTP, WebSocket, and MCP traffic routed through it on the agent’s network path for credential leaks, prompt injection, SSRF, and tool poisoning, and can emit signed action receipts for mediated decisions when a signing key is configured.

Envoy AI Gateway is an Apache-2.0 extension to Envoy Gateway from the Envoy community. Its docs describe an LLM gateway and an MCP gateway. The MCP side aggregates multiple servers into one endpoint, filters which tools are exposed, authenticates clients with OAuth, and applies access rules from JWT claims, scopes, and CEL expressions. Upstream API keys are injected at the gateway so clients never hold them.

Envoy AI Gateway is platform routing and access control on Envoy. Pipelock is payload inspection and evidence next to the agent.

Feature comparison

Feature	Pipelock	Envoy AI Gateway
Architecture	Network proxy, single self-hosted Go binary	Envoy Gateway extension on Kubernetes, or a standalone CLI
What it fronts	HTTP, HTTPS CONNECT (payloads only with TLS interception on), WebSocket, MCP stdio and HTTP, A2A	LLM provider APIs and MCP servers over HTTP
Multi-server aggregation	One wrapper per server or upstream	Yes, with per-server tool filtering
Authentication	Not a gateway function	OAuth flows, JWT
Authorization	Tool policy via config	JWT claims, scopes, and CEL expressions
Upstream credential injection	No	Yes, API keys injected at the gateway
Credential scanning (DLP)	65 patterns, encoding-aware	Not documented
Prompt injection detection	Deterministic patterns with multi-pass normalization	Not documented
Tool poisoning and rug-pull drift	Fingerprinting and drift detection	Not documented
SSRF protection	Private IP, metadata, and DNS rebinding checks	Not documented
Telemetry	Prometheus, syslog, webhook	Envoy observability
Signed receipts	Yes, Ed25519, verifiable offline	Not documented
License	Apache-2.0 core; Enterprise under ELv2	Apache-2.0

Where Envoy AI Gateway is stronger

It is Envoy. If your platform already runs Envoy Gateway, LLM routing and an MCP gateway arrive as configuration in the data plane you operate, with Envoy’s load balancing and observability.

Aggregation and tool filtering. Many MCP servers become one endpoint, and the tools each exposes can be included or excluded by name or pattern.

Access control from identity. OAuth authentication plus CEL rules over JWT claims and scopes decide who may call which tools.

Keys stay at the gateway. Upstream API keys are injected by the gateway, so the calling client never holds them.

Where Pipelock is stronger

Content inspection. Encoding-aware DLP on bodies and tool arguments, injection normalization on responses, tool-description fingerprinting and drift detection, SSRF checks before DNS. Envoy AI Gateway’s MCP docs cover routing and access, not payload scanning.

The agent’s whole path. A container or namespace with Pipelock as its only route, or host containment rules that drop direct sockets, lets Pipelock see plain HTTP and WebSocket egress from the agent, not only the model and MCP endpoints the gateway fronts. A proxy environment variable alone leaves direct connections, DNS, and alternate proxies uninspected.

Evidence. A signed, offline-verifiable receipt per decision.

No Kubernetes required. One binary on a laptop or a CI runner.

Architecture difference

Clients -> Envoy AI Gateway (auth, CEL rules, tool filter, key inject) -> LLM providers, MCP servers
Agent   -> Pipelock (inspect, decide, sign)                           -> internet, MCP servers

The gateway lives at the platform edge. The firewall lives next to the agent. A serious deployment can have both.

Sources checked

Third-party descriptions on this page come from the public materials below, read on the dates shown. Features and pricing change; check the current documentation before you decide.

envoyproxy/ai-gateway README checked 2026-09-01 · Apache-2.0; follows the CNCF code of conduct
Envoy AI Gateway docs: MCP gateway capabilities checked 2026-09-01 · server multiplexing, tool filtering, OAuth authentication, JWT claims, scopes, and CEL authorization, upstream API key injection
Envoy AI Gateway releases checked 2026-09-01 · v1.1.0 from August 2026 was the newest release at the time of checking

Third-party product names and marks belong to their owners. PipeLab is not affiliated with, sponsored by, or endorsed by the makers of any product compared on this page. Descriptions of other products come from their own public materials on the dates listed above and reflect PipeLab's reading of them. If something here is wrong or out of date, tell us and it will be corrected.

Frequently asked questions

What's the difference between Pipelock and Envoy AI Gateway?

Envoy AI Gateway is an extension to Envoy Gateway that routes LLM API calls and aggregates MCP servers behind one endpoint with OAuth, JWT, and CEL access control. Pipelock is an agent firewall that inspects the content of HTTP, WebSocket, and MCP traffic routed through it and can emit signed receipts when a signing key is configured. One is platform routing and access control. The other is payload inspection and evidence.

Does Envoy AI Gateway scan tool descriptions or responses?

Its MCP docs describe aggregating servers, filtering which tools are exposed, authenticating clients, and applying CEL rules. Content scanning of tool descriptions, arguments, or responses, drift detection, and signed receipts are not documented.

Can I use both?

Yes. Envoy AI Gateway can front the MCP servers and models at the platform edge while Pipelock wraps the agent’s egress or the MCP upstreams for inspection and receipts.