Why teams choose MintMCP over TrueFoundry

Both products have an MCP gateway, but they're shaped differently. MintMCP is built around Bundles — a single primitive that carries SCIM groups, curated tools, access policy, and audit, with Agent Bundles re-applying the same shape to per-agent identities. TrueFoundry has Virtual MCP Servers for tool curation, separate Virtual Account Tokens for agents (shared service-account credentials with the same access for all requests), and RBAC managed across the broader gateway. If you want a Bundle-shaped governance object that's the unit of admin for humans and agents alike — plus shadow-AI detection on developer machines — MintMCP is the more direct fit.

Both expose a curated subset of tools across upstream MCP servers as one endpoint, and both are strong tool-curation primitives. The difference is the access and identity model around them. MintMCP Bundles carry SCIM-driven group membership, per-Bundle access policy, per-Bundle audit, and Agent Bundles re-apply the same primitive to agents. TrueFoundry's RBAC lives in the broader AI Gateway via custom roles + tool-level RBAC + Cedar/OPA, applied across the gateway rather than as per-Virtual-MCP-Server admin delegation. Agent identity in TrueFoundry comes from Virtual Account Tokens, which the docs note "provide the same level of access for all requests" — i.e., a shared service-account token, not a per-agent identity.

Each agent gets an Agent Bundle: its own credentials (bearer API keys plus OAuth 2.0 client-credentials), scoped to the tools it needs, rotatable independently of human users, with an "act as agent" admin flow for connectors that require per-agent OAuth. TrueFoundry's Virtual Account Tokens are service-account tokens with per-server permissions but provide the same level of access for all requests — there's no per-agent identity with delegated credentials, scoped tools, or independent rotation, and no "act as agent" flow.

Yes. MintMCP lets you write JavaScript policies that run on every tool call and route to AWS Bedrock Guardrails, GCP DLP, Microsoft Purview, Nightfall, or Skyflow, with built-in templates for each. TrueFoundry uses Cedar and OPA as first-class policy languages with built-in TFY guardrails plus integrations with Azure Prompt Shield, Google Model Armor, GraySwan Cygnal, Akto, and Patronus — strong, but a different shape (declarative policy languages vs an inline JS hook), and the listed DLP names differ.

Standard MCP servers that run on TrueFoundry will run on MintMCP, so most of the work is reconfiguring rather than rebuilding. Migration is usually three steps: (1) bring your MCP servers in (most are already in the catalog), (2) set up SSO, SCIM, and Bundles that mirror your existing Virtual MCP Servers, RBAC, and Virtual Account Tokens, and (3) point Claude, Cursor, or Copilot at the MintMCP gateway URL. Many teams finish in an afternoon.

Yes. MintMCP is SOC 2 Type II audited and compliant with HIPAA standards, with a BAA available on request. Customers and prospects can self-serve audit letters, sub-processors, pen-test summaries, and security questionnaires from a public trust center, which usually shortens vendor reviews from weeks to days.

Yes — MintMCP is an official Cursor partner and is built around Claude, so Claude Desktop and Claude Code are tested first. It also works with GitHub Copilot, ChatGPT, Windsurf, and any other MCP-compatible client.