Head-to-head · updated 13 September 2026
DataShield vs Docker MCP Gateway: who governs the pipe, and who governs the data?
Docker is very good at this. The MCP Catalog gives you signed, containerized MCP servers. The Toolkit wires them into Claude Code or Cursor in one click. The Enterprise Gateway adds SSO, an approved server list, call-level rules and an event stream to your SIEM. If your problem is that thirty developers each pasted a random MCP server into their config file, buy Docker and stop reading.
Our problem starts one step later. A gateway can say the agent was allowed to call the tool. It can't say what came back. DataShield sits at the data: datasets are tokenized at ingest, agents query tokenized data over MCP, and detokenization is a privileged, audited operation. Every governed call is sealed into a hash chain you can verify without trusting us. Below is the honest split, including the rows Docker wins.
The short version
Pick DataShield when
- Someone will one day ask you to prove an agent's access log wasn't edited. A SIEM stream can't answer that. Our chain answers it with math. Run the verifier.
- The risk is in the rows the tool returns, not the tool. We classify and tokenize at ingest, and we can generalize quasi-identifiers (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails), with a measured cardinality-reduction score per column. How that works.
- A GDPR erasure request has to land without breaking your audit trail. Crypto-shred does that. Deleting log lines does not.
- You need an emergency path that is scoped, timed and recorded. Break-glass for agents ships in Auth, live in production. See Auth.
Pick Docker when
- The threat you're worried about is a rogue MCP server on a laptop. Their sandbox model is real isolation, not a policy PDF. We don't do that, and we don't pretend to.
- You want breadth on day one. The catalog ships signed images with SBOMs from Stripe, Grafana, GitHub, Heroku and more. Building that yourself takes a year.
- Your developers already live in Docker Desktop. Zero adoption friction beats any feature list, and the open-source gateway costs nothing.
- You need one policy that covers every harness: Claude, Copilot, Gemini, whatever ships next quarter. That's their pitch, and it's a good one.
Bottom line: run both. Docker governs the pipe and the box the tool runs in. DataShield governs the data the tool hands back, and keeps proof of the decision. If you can only fund one and your exposure is regulated data rather than rogue binaries, start here.
Feature by feature
Competitor cells describe what Docker's public site, docs and GitHub say as of the date above. If we've mischaracterised something, email support@myorg.ai and we'll correct it, credited.
| What matters | DataShield | Docker MCP Gateway | Edge |
|---|---|---|---|
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion or truncation. Public verifier. | A structured event per policy evaluation, tied to user and agent, streamed to Splunk, Datadog or Grafana. Rich and useful. We found no claim that the record is tamper-evident. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling, a declared authority tier and a revocation re-check before dispatch. Authority is per agent, not per group. | Sign-in through your IdP, group-scoped server and tool exposure, allow and deny rules by server, tool and transport. Org-wide revocation is picked up on the next call. This is a real policy layer. | ◈ |
| Sandbox isolation | None. We authorize and record. We don't contain a process. | Each MCP server runs in its own container, with microVM isolation in Docker Sandboxes, plus network and filesystem allow or deny rules. | ◇ |
| Supply chain of tools | We publish MCP endpoints on Auth, Ontology and Lighthouse, and ship OCI images for Auth, Ontology, Corpus and Lighthouse with a role-routing entrypoint and per-service healthchecks. Every deploy carries a signed manifest whose EdDSA signature Guardian verifies on the host. No catalog of third-party servers. | Signed catalog images with SBOMs and Docker Scout provenance checks on pull. Publisher verification on Docker Hub. Strong, and a threat model we don't cover. | ◇ |
| Data handling | Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Tokens are deterministic, join-preserving and vault-reversible. quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column for quasi-identifiers. | The gateway routes calls and injects credentials. It doesn't classify, tokenize or mask what the tool returns. We found no PII or PHI handling in their docs. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents that auto-revokes and can't be quietly deleted from the log. | Not described in public docs. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor IDs are HMAC-committed, so the chain still verifies after a subject is erased. | Not addressed. SIEM retention is your problem, and deleting events from it weakens the record you were keeping for the auditor. | ◆ |
| Secrets and credentials | Connection Vault holds encrypted per-subject credentials, with eight strategies including Snowflake keypair JWT. Use is logged against the agent. | Credentials stay in your secret store and are supplied at call time only, never shipped in client config. OAuth flows proxied by the gateway. Genuinely good design. | ◈ |
| MCP and agents | MCP tool tokens with scope ceilings, issued by Auth and verified via JWKS. Per-call metering attributed to the agent. | Aggregates many servers behind one gateway MCP server. Dynamic MCP keeps context flat as the catalog grows. Works with Claude Code, Cursor, VS Code, ChatGPT Enterprise. | ◇ |
| Deployment | Self-hosted in your own cloud or data center, or on a dedicated single-tenant server we operate. Your keys. | Open-source gateway under MIT on your own machine. Enterprise Gateway managed in your cloud, or as an air-gapped appliance. A Docker-managed cloud is listed as coming soon. | ◈ |
| Maturity signals | Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so. | Docker Inc. since 2013. Catalog and Toolkit shipped May 2025 with 100+ verified tools. Enterprise line shipped through 2026. Millions of developers already installed. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | OSS gateway free. Docker plans run $0 to $24 per user per month. MCP Enterprise Gateway and AI Governance are contact-sales, with no figures published. | ◈ |
◆ DataShield leads◇ Docker MCP Gateway leads◈ comparable
Docker claims are drawn from docker.com product pages, the Docker blog and the docker/mcp-gateway repository, last checked 13 September 2026. We link them below rather than paraphrase from memory.
Three things you get here that you won't get from an MCP gateway
A log you can prove, not just ship
Streaming events to Splunk is good hygiene. It is not evidence. Anyone with write access to the index can change the story, and the index can't tell you it happened. Ours is a hash chain with signed checkpoints, and the verifier says what broke, not just that something did. That's the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser.
Control over the payload, not just the call
A gateway approves snowflake.query. Then 4,000 rows of patient data come back and the gateway waves them through, because that was never its job. We tokenize at ingest and generalize quasi-identifiers, so the rows the agent reads were never the raw ones. See the data layer.
An erasure you can defend
GDPR says delete the subject. Your examiner says keep the log. Those two instructions fight unless the log was built for it. Crypto-shred destroys the subject's key material, the data goes unreadable, and the chain still verifies. See the diagram.
Where Docker is genuinely stronger
We'd rather you hear this from us. Docker owns the developer's machine, and that is where agent tool use actually happens. Container isolation per MCP server is a real security primitive that we do not have. Signed images with SBOMs and provenance checks answer a supply-chain question we don't answer at all. The catalog has been growing since May 2025 and ships tools from Stripe, Grafana, GitHub and Heroku, which is breadth nobody catches quickly. And their 2026 enterprise line is not a slide deck: SSO, group-scoped tool exposure, call-level rules, org-wide revocation and audit streaming all ship today. Their writing is good too. The post on the ExploitGym incident, where agents took roughly 17,600 actions in four and a half days, makes the right point: human-tempo review does not scale to agent tempo.
Here's the push-back. Docker's own argument is that the boundary should sit below the harness, because agents route around guardrails they can see. Fair. But a gateway is still a pipe, and a pipe only governs traffic that flows through it. The moment an agent reaches a database through a path Docker isn't brokering, the policy is silent and the SIEM never hears about it. That's why we put the check at the data service and seal the decision where it was made. And when the examiner asks for the March records, "we streamed them to Splunk" is an answer about plumbing. "Here is the chain, run the verifier yourself" is an answer about proof.
Questions worth asking both of us
These are the questions we'd want answered if we were buying. Ask them on every vendor call, including ours.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it, checkpoints are signed and chained, and verification tells deletion apart from truncation and from tampering. Run it on a sample chain at /verify. Docker: their pages describe a structured event per policy evaluation, streamed to your SIEM. We found no claim of tamper evidence. Ask them what stops a privileged user editing the index.
What happens to a revoked agent mid-session?
Both of us handle this, and we won't pretend otherwise. DataShield re-checks authority on every governed tool call, so the next call fails closed. Docker's Enterprise Gateway can cut off a server or tool for the whole organization, and sessions pick it up on the next call. The difference is scope: theirs is org-wide by server and tool, ours is per agent, with a scope ceiling and an authority tier. Ask both of us to demo it live.
If we already run Docker MCP Enterprise Gateway, what does DataShield add?
Three things their docs don't cover: what's inside the response, whether the record can be proven unaltered, and what happens on an erasure request. Docker approves the call. We tokenize the dataset at ingest, so the rows the agent queries were never raw, and we seal the decision into a verifiable chain. Most serious buyers run both layers.
Isn't container isolation enough?
It's excellent at blast radius, and we'd keep it. But isolation is about what a compromised process can touch on the host. It says nothing about whether an authorized agent, behaving exactly as designed, was allowed to read that particular subject's data. Those are different questions, and regulators ask the second one.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies after the subject is gone. Docker: we found nothing on erasure in their MCP or governance docs. Ask what you're meant to do with the SIEM events when a data subject writes in.
Does DataShield have SOC 2?
Not yet, and we won't imply otherwise. Auth is live a public threat model and a verifier anyone can run. Guardian and Lighthouse have been in production since April 2026. Docker is a company of a different size, with a decade of shipping behind it. Design-partner terms here include source escrow so a small vendor isn't a single point of failure. Details on the security page.
- Docker MCP Enterprise Gateway: "Policy governs every call, credentials stay in your secret store, and every decision is recorded." Audit events stream to your SIEM. — docker.com, 13 Sep 2026
- Docker AI Governance: centralized sandbox, network and MCP controls, with structured events streamed to Splunk, Datadog or Grafana. Contact-sales. — docker.com, 13 Sep 2026
- MCP Catalog and Toolkit launched with 100+ verified tools and partners including Stripe, Elastic, Grafana Labs and Kong. — Docker blog, May 2025
- "A policy you write up will apply to every harness. And every action, by all your agents, lands in one record." — Docker blog, 2 Sep 2026
- Agents took roughly 17,600 actions over four and a half days in the ExploitGym incident: about 147 hours of work at thirty seconds of human review each. — Docker blog, 18 Aug 2026
- The docker/mcp-gateway project is MIT licensed, with profiles, tool allowlists, secrets, OAuth and call tracing. — GitHub, 13 Sep 2026
- Docker plans run from $0 (Personal) to $24 per user per month (Business). MCP Enterprise Gateway is not priced on the page. — docker.com/pricing, 13 Sep 2026
Other head-to-heads
DataShield vs MintMCP
A hosted MCP gateway versus authority and evidence at the data.
AdjacentDataShield vs AI gateways
The gateway governs the pipe. Something still has to govern the data.
AdjacentDataShield vs Obot
Open-source MCP control plane, and where the evidence layer sits.
AllEvery comparison
One honest scorecard per vendor, sources at the bottom.
Keep your Docker gateway. Then see the two mechanisms it doesn't have: break a live audit chain and watch the verifier name the break, then revoke an agent mid-session. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →