This spotlight is part of our MCP company spotlights, within The MCP Guide. Building an MCP company? See SEO and GEO for MCP companies.
Pomerium is an identity-aware access proxy, and it can sit in front of MCP servers as a secure gateway. It signs users in through your identity provider, checks a policy on every request, and can block specific MCP tools by name. Your MCP server stays on the internal network and needs no auth code of its own.
Checked against: Pomerium's MCP docs on 28 October 2026. eSEOspace did not test Pomerium's products.
Key Takeaways
- Pomerium describes itself as "a secure gateway for your MCP servers" that handles authentication, authorization and TLS.
- Its policy language has an
mcp_toolrule that can block tools by exact name, prefix, suffix or list. - As an "MCP-aware bridge," Pomerium can manage upstream OAuth for servers like GitHub or Notion, so clients never see those tokens.
- Pomerium says every tool call is logged with the method, tool name and parameters.
- Pomerium Core is open source under Apache-2.0; Zero Personal is free and Zero Business is $7 to $9 per user per month.
At a glance
| Company | Pomerium |
|---|---|
| What it offers for MCP | MCP gateway routes, tool-level policies, upstream OAuth bridging, service accounts, dev tunneling |
| Who it's for | IT and platform teams exposing internal MCP servers to AI apps |
| Open source? | Yes: Pomerium Core (Apache-2.0) |
| Pricing | Zero Personal free; Zero Business $9/user/mo monthly or $7 annually; Enterprise custom |
What Pomerium offers for MCP
The MCP capability page describes Pomerium as sitting "between MCP clients and your internal servers, handling authentication, authorization, and observability for every request." It works the way an MCP gateway is meant to.
Protecting a server
In the protect a server guide, you add a route with an mcp: server: {} block. External clients like Claude, ChatGPT or VS Code then sign in through Pomerium. The server itself stays "auth-free."
Tool-level rules
The mcp_tool rule matches the tool name in each tools/call request. Pomerium's tool limits guide shows two patterns:
- Block lists: deny any tool that starts with
admin_, for example. - Allowlists: deny everything not in a short list, such as
queryandlist_tables.
Pomerium advises putting tool checks under deny, not allow, so list requests still pass. This lets you give different teams different tool sets. It is a direct control for excessive permissions.
Upstream OAuth bridging
Some MCP servers, like GitHub, Linear or Notion, run their own OAuth. Pomerium can handle that flow for each user, cache and refresh the upstream tokens, and inject them into proxied requests. The docs say "clients never see upstream credentials." Pomerium supports pre-registered credentials and auto-discovery through RFC 9728 metadata, with registration through CIMD or DCR.
The MCP reference adds two safety checks. It validates CIMD client ID domains against an allowlist before fetching them. It also checks upstream metadata URLs against a domain allowlist to protect against server-side request forgery (SSRF).
Agents and developers
For headless agents, Pomerium supports service accounts that represent a specific user. For local work, ssh -R 0 pom.run exposes a local MCP server over HTTPS, with Pomerium checking each request.
Who it's for
Pomerium fits companies that run internal MCP servers, such as a database or ticketing server, and want staff to reach them from AI apps without opening them to the internet. It suits teams that prefer self-hosting. Pomerium's agentic access page says the data plane runs "inside your environment with no third-party routing."
It does not build or host MCP servers, and it does not issue tokens for public SaaS products.
Pricing
Pomerium's pricing page shows, as of October 2026:
- Zero Personal: free. Managed control plane, 1 cluster, 10 routes and 5 policies.
- Zero Business: $9 per user per month billed monthly, or $7 billed annually. 5 clusters, 100 routes, 100 policies, access logs and change history.
- Enterprise: custom. Self-hosted control plane, directory sync and session recording.
Pomerium Core, the open-source proxy, is free under the Apache-2.0 license. The pricing page does not price MCP separately.
Security and trust
Pomerium says every authorization decision is logged. Its reference docs describe MCP-specific log fields for the method, tool name and parameters. See our audit logging guide for what to keep.
Pomerium links to a trust center at trust.pomerium.com. We could not read certifications from it on 28 October 2026, so we do not list any here. Ask Pomerium for its reports.
Alternatives
- Aembit offers an MCP Identity Gateway that injects per-user credentials.
- Lasso Security offers an MCP gateway focused on data masking and threat detection.
- Our MCP gateways list compares gateway options.
Next step
Decide which tools each team should see before you write policies. Our MCP security hub helps with that. Then compare vendors in our MCP companies hub.
Frequently asked questions
Does my MCP server need its own OAuth with Pomerium?
No. Pomerium's guide says the server needs no auth logic of its own. Pomerium signs users in and passes signed identity details in an X-Pomerium-Assertion header.
Can Pomerium block a single MCP tool?
Yes. The mcp_tool rule can deny a tool by exact name, or by prefix, suffix or list. You can also build allowlists.
Is Pomerium open source?
Pomerium Core is open source under Apache-2.0. Pomerium Zero adds a managed control plane, and Enterprise self-hosts both planes.
Does Pomerium work with Claude and ChatGPT?
Pomerium's docs name Claude, ChatGPT and VS Code as clients that can reach a Pomerium-protected MCP server. Check your client's support for remote servers on your plan.
