This spotlight is part of our MCP company spotlights, within The MCP Guide. Building an MCP company? See SEO and GEO for MCP companies.
Obot is an open-source platform for managing how a company uses AI tools. For MCP, it hosts servers, puts them behind a governed gateway, and publishes approved servers and skills through a registry. Every edition runs the same MIT-licensed code.
Checked against: Obot's GitHub README and docs on 28 October 2026. eSEOspace did not test Obot's products.
Key Takeaways
- Obot describes itself as "an open-source platform for organizations to manage, secure, and govern their AI ecosystems."
- Its MCP Gateway combines servers into virtual MCP servers (vMCPs) and controls tool access by user or identity-provider group.
- Obot hosts MCP servers in isolated environments and can reach private servers through outbound tunnels.
- The free Community edition covers up to 100 users and 100 devices; Enterprise is "Contact sales."
- Obot says it is "fully open source under the MIT License," with no paid features held back in code.
At a glance
| Item | Detail |
|---|---|
| Company | Obot AI |
| What it offers for MCP | MCP gateway, MCP hosting, MCP and Skills registries, device monitoring (Obot Sentry) |
| Who it's for | IT, security and platform teams governing AI tool use |
| Open source? | Yes, MIT License |
| Pricing | Community free (up to 100 users); Enterprise contact sales; Obot Cloud free trial, then paid |
What Obot offers for MCP
MCP Gateway
The Obot README calls the gateway "a single governed entry point to every MCP server a user is allowed to reach." Admins build virtual MCP servers (vMCPs) that combine one or more catalog servers behind one endpoint. Profiles control which servers and tools each user or group can use.
Other features listed in the README:
- MCP tunnels to reach servers on private networks without opening inbound ports.
- Pinning each component to a catalog snapshot, so changes need an explicit upgrade.
- Tool search on large vMCPs, so clients don't load every tool definition.
- Filters that can inspect, reject or modify requests and responses.
Hosting and registries
Obot Server provides "isolated execution for hosted MCP servers," per the README. Its MCP and Skills registries are "built on curated Git-backed catalogs." Staff can find and install approved servers from Claude Code, Codex, Cursor, VS Code and other tools, or through the Obot CLI.
Obot Sentry
Obot Sentry runs on user devices. The README says it can inventory installed AI clients, MCP servers and skills, install hooks for Claude Code, Cursor and VS Code, and record local tool calls. Enforcing tool-call allowlists on managed devices is marked experimental.
Who it's for
Obot targets organizations that want one place to approve, host and audit MCP servers across many AI clients. Because it is MIT licensed and self-hostable on Docker or Kubernetes, it suits teams that want to read the code or keep data in-house. Our MCP governance guide for IT leaders explains the policies such a platform should enforce.
Pricing
Obot does not publish dollar prices. Its editions page compared these options on 28 October 2026:
| Edition | Hosting | Cost | Users and devices |
|---|---|---|---|
| Community (unregistered) | Self-hosted | Free | Up to 100 each |
| Community (registered) | Self-hosted | Free | Up to 100 each; adds Entra, Okta, JumpCloud and Auth0 sign-in |
| Enterprise | Self-hosted | Contact sales | Set by contract |
| Obot Cloud | Hosted by Obot | Free trial, then paid | Set by plan |
The docs say "the editions differ only in their license key." Enterprise adds support and removes the user and device caps.
Security and trust
The Obot homepage says you can "put SSO and OIDC in front of every connection, scoped by role" and get a "full audit trail." The README describes correlated audit logs across the platform and controls over OAuth, shared credentials and Kubernetes secrets. The homepage links to a Trust Center but names no certifications. Since the code is open, your security team can review it directly. Our MCP security risks guide lists what to look for.
Alternatives
- IBM ContextForge is another open-source gateway and registry, under Apache 2.0.
- Lunar.dev offers MCPX, an MIT-licensed gateway, with paid per-seat tiers.
- Runlayer is a managed alternative with shadow AI detection on devices.
See our list of MCP gateways and all MCP company spotlights.
Next step
Try Obot locally with Docker to see whether vMCPs and profiles match how your teams work. If you want help designing server approvals and access groups before rollout, our MCP readiness audit is a good first step.
Frequently asked questions
Is Obot free?
The Community edition is free for up to 100 users and 100 devices, self-hosted. Registering it, also free, adds enterprise sign-in providers. Enterprise and Obot Cloud are paid.
What license does Obot use?
The docs say "Obot is fully open source under the MIT License." Every edition runs the same code; only the license key differs.
What is a virtual MCP server in Obot?
A virtual MCP server, or vMCP, combines one or more servers from the catalog behind a single endpoint. Admins then control which users or groups can reach which tools.
Can Obot monitor MCP use on laptops?
Yes, per the README. Obot Sentry inventories AI clients and MCP servers on devices and records local tool calls. Enforcing allowlists on devices is marked experimental.
