Stacklok Review 2026: ToolHive Pricing, Features & Alternatives

---

What Stacklok Actually Does

The problem Stacklok solves starts on a developer’s laptop, connecting an AI client straight to whatever MCP server they found on GitHub, no review, no shared record of what got installed. Stacklok inserts a checkpoint into that path: a server only reaches an agent after it’s approved, it runs in its own isolated container, and every call gets logged back to whatever identity provider the company already uses. Stacklok’s platform page sums up the pitch in four words, local, modular, scalable, and open source, deploy the whole thing or just the pieces needed, starting with developers and scaling out to every knowledge worker in the company.

The Four Pillars: Registry, Runtime, Gateway, and Portal

Four pieces make up the platform, and each one answers a different question about how MCP access gets controlled.

• Registry: Curate a catalog of trusted servers your teams can quickly discover and deploy. It pulls from the official MCP registry, verifies provenance with built-in security controls, and ships preset configurations for faster onboarding.
• Runtime: Deploy, run, and manage MCP servers locally or in a Kubernetes cluster with security guardrails, each one sandboxed under a minimal permission file. A Kubernetes Operator handles fleet management at scale.
• Gateway: Internally called vMCP, or Virtual MCP Server. Defines dedicated endpoints for centralized security, authentication, and auditing, with SSO through OIDC/OAuth and the ability to orchestrate multiple tools into one virtual MCP.
• Portal: A desktop app and browser-based Cloud UI where developers discover and install servers with one click. Stacklok separately markets an AI Gateway alongside the MCP Gateway, routing LLM requests, enforcing token budgets, and logging model spend, a newer addition it’s actively promoting.

Together, the four cover the full path a request takes, discovery, execution, enforcement, and access, which is a more complete architecture than most competitors ship as a single product.

The Company Behind It

Stacklok was founded in Seattle in 2023 by Craig McLuckie and Luke Hinds, and is led today by McLuckie as CEO alongside CTO Joe Beda. Both McLuckie and Beda co-created Kubernetes at Google and later founded Heptio together, acquired by VMware in 2018, and that lineage shows directly in the product’s Kubernetes-native design. The company raised $17.5 million in a Series A round in May 2023, led by Madrona and Accel, its only public funding round, with a team in the high 30s to low 40s as of mid-2026 (36 per PitchBook, 42 per LeadIQ and Datanyze).

From AI-Coding Security to MCP Governance

Stacklok’s first products targeted a narrower problem, keeping AI coding assistants from leaking secrets or pulling in malicious packages. All three are gone: Minder went to the Open Source Security Foundation in October 2024, Trusty was retired June 8, 2025, and CodeGate sits archived on GitHub as no longer maintained. What replaced them runs on ToolHive, the open source core, plus Stacklok Enterprise on top. Coding-assistant security was 2024’s problem. Governing what an autonomous agent can call in production is 2026’s, and the product now reflects that shift completely.

Client and Framework Support

Five clients get automatic configuration per Stacklok’s own docs: VS Code with GitHub Copilot (v1.99.0+), Cursor, Cline, and Claude Code, plus Roo Code, though that integration is now deprecated since Roo Code’s own extension was discontinued in May 2026. Any other Server-Sent Events client, including Windsurf and Zed, connects manually. Stacklok’s marketing separately claims compatibility with “hundreds” of AI clients through the Portal, an upper-bound figure worth some skepticism.

Managing config across several of those clients on one machine is its own headache, since each stores settings differently. ToolHive’s desktop Portal handles that inside its own runtime, and mTarsier solves the same problem client-agnostically for anyone not ready to adopt it.

The July 2026 MCP Spec Update

MCP’s stateless 2026-07-28 revision replaced the older stateful transport model, and ToolHive moved fast, hardening virtual MCP authorization end-to-end and closing a server-side request forgery gap in the same stretch of releases. Stacklok is also a maintainer of the official MCP registry and a Silver member of the Agentic AI Foundation, the Linux Foundation initiative now hosting the MCP spec itself, a seat at the table worth something when a breaking change lands.

Why an MCP Platform Instead of Running Servers Directly

That question is answered directly in Stacklok’s FAQ, and it comes down to two things:

• Security: The spec covers only front-end authentication, a user to a server. A platform adds back-end authentication, authorization, and token exchange the spec leaves out.
• Usability: Running servers directly puts each developer in charge of discovery and setup. A platform lets an admin pre-configure access so users get one click instead.

Secrets go into encrypted storage or a 1Password integration instead of a plaintext file, with the password held in the OS keyring. Custom servers outside the registry still run too, Docker images directly, or Python, Node.js, and Go packages built into a container automatically.

The shape of the product is clear by now, a governance layer, not a tool catalog. What it costs and what setup looks like is next.

---

How We Reviewed This

Worth laying out what this review actually rests on before the deep dive starts.

• Documentation and product pages: Stacklok’s own docs, pricing pages, release notes, and published case studies.
• Independent sources: G2 reviews, GitHub issues, and third-party reporting from TechCrunch, The Register, and PitchBook.
• One hands-on test: Downloaded and ran the ToolHive CLI (thv v0.40.1) directly, in an environment with no container runtime installed. It refuses to run under those conditions, even --version and --help fail, returning an immediate “no container runtime available” error with no lightweight inspection path around it.
• What we didn’t do: No full production Kubernetes deployment, no paid Enterprise onboarding call.

That’s enough to speak with confidence about documented behavior and real reviewer feedback, less so about what a live Enterprise rollout actually feels like day to day. Any point below where that distinction matters is flagged again in context.

---

Getting Started with ToolHive: Step by Step

Setup starts with the free desktop app and, for most people, ends there too, since the Enterprise path runs through a sales conversation rather than a self-serve signup.

• Download the desktop app for macOS, Windows, or Linux. No account or signup wall for the open source core.

• Open the built-in Registry page and pick a server, the fetch tool is a common first choice.
• ToolHive auto-configures the connection for whichever client is already installed, per the five clients confirmed above.
• For servers that need authentication, secrets get set through the desktop UI instead of a plaintext config file.

Where the Setup Gets Rough

The desktop path above is clean, but two issues surface once setup moves past a single laptop, both documented rather than hidden in a changelog somewhere.

• A real Kubernetes bug. GitHub issue #1874 (September 2025) documented the Kubernetes Operator defaulting every proxy to the older SSE transport regardless of what a RunConfig or CLI flag specified for streamable HTTP. It was fixed via a follow-up pull request, but it was a genuine connection issue for anyone who hit it first.
• A Windows upgrade lock. The thv.exe binary locks itself while any MCP server proxy is still running, blocking an in-place upgrade until the lingering process is manually killed in Task Manager.

Neither is disqualifying. Both are the kind of friction that shows up more in a Kubernetes rollout than in the marketing copy.

---

Stacklok Pricing in 2026

There’s no pricing page to link to. Stacklok structures its commercial offering into two SKUs, both sold as annual subscriptions, plus professional services billed on time and materials.

The Two Enterprise SKUs

Everything above the free tier breaks down into three line items:

What ToolHive Community Gets You Free

The open source core is genuinely free, no credit limits and no feature-gated trial, Apache 2.0 licensed with community support through GitHub and Discord. Stacklok pitches it as the right starting point for individual developers and teams evaluating MCP. Where Enterprise earns its price:

Ending an Enterprise contract doesn’t cut off access to your own infrastructure, since the platform is self-hosted and the data never left your environment. What’s lost is Enterprise features and support, and downgrading to open source is a supported path rather than a threat used to keep customers locked in. Stacklok has also stated an intent to eventually donate ToolHive to an open source foundation, the same path Minder already took, though that’s a stated intention rather than something that’s happened yet.

Hidden Costs and Total Cost of Ownership

The Kubernetes infrastructure itself isn’t included in either SKU, since Enterprise assumes a cluster already exists. Teams without one are pricing that build-out in separately, a cost that never shows up on a Stacklok invoice.

Stacklok’s docs claim most customers see value inside two weeks of signing, and a separate marketing page claims teams reach production in under 60 days. Both are vendor-stated, with no independent benchmark behind them, best treated as a starting expectation rather than a guarantee. Every number past the free tier is a quote, not a list price, a genuine difference from Composio or MCP360, both of which publish self-serve tiers a team can price out before ever talking to a salesperson. Whether that quote-only model is worth tolerating depends on how the platform performs, starting with what real reviewers say.

---

Review and Rating

G2 lists Stacklok under its AI Gateways category with a 4.3 out of 5 average rating. That number rests on exactly two reviews, both posted in May 2026, both from verified users at enterprise companies with more than a thousand employees. For a platform running in Fortune 500 environments, that’s a thin sample worth naming directly rather than treating a 4.3 average as settled.

What Reviewers Praise

One reviewer, at a staffing and recruiting enterprise, said the registry feature makes it easy to register MCP servers and get them discovered across Cursor, Windsurf, and Claude Code. As G2 puts it, “the registry feature makes it easy to register different AI agents” and have them found by the clients a team already uses. A second reviewer, at an airlines and aviation enterprise, described the open source tooling as a genuine enabler of secure MCP adoption.

What Reviewers Flag

The first reviewer’s one complaint is that MCP as a protocol still isn’t fully approachable for less technical users, something a more polished ToolHive UI would help with. The second flags a lack of ready-made, specialized solutions out of the box.

Real Customer Deployments

Beyond G2, Stacklok publishes named case studies on its own site, vendor-published rather than independent, but backed by real, checkable claims.

• TRM Labs, a real, named threat-intelligence company, moved local MCP servers off individual developer laptops and onto Stacklok’s self-hosted runtime after more than 90 percent of its employees started regularly building with terminal agents. “That really became the main driver for building on Stacklok,” said Andrew Hannigan of TRM Labs.
• A Global 2000 software category leader, unnamed, used Stacklok to regain control of shadow AI and roll out a central MCP registry used by thousands of employees.
• A Fortune 500 financial services firm, also unnamed, reported Cursor acceptance rates climbing from 40 percent to over 80 percent in under three months after deploying Stacklok.

Together, the G2 reviews and the case studies point the same direction, strong marks from people actually using it, on a sample too thin to call definitive either way.

---

Stacklok’s Security and Incident History

Security is the entire premise Stacklok sells on, so it earns real scrutiny rather than a single paragraph. The whole pitch of a governance platform is that it’s more trustworthy than letting developers run MCP servers unsupervised, and that claim only holds up if the platform’s own tooling, architecture, and track record can survive being checked rather than taken on faith.

Security Tooling: Community vs. Enterprise

The open source core ships with Sigstore Cosign package signing and an SBOM on every release, plus basic Trivy scanning and unit and integration tests. Stacklok Enterprise expands that considerably: static analysis attested through Sigstore on every release, autonomous penetration testing on every minor version, hardened container base images through Chainguard or an equivalent, and vulnerabilities across all four severity levels patched within a defined SLO under responsible disclosure. SLSA build provenance is Enterprise-only, on top of the signing both tiers get.

The Self-Hosted Architecture Advantage

ToolHive’s core pitch is architectural rather than procedural. Each MCP server runs sandboxed with no locally stored credentials, using an SSE proxy that forwards requests without exposing container ports directly, and permissions are customizable through JSON profiles scoped to exactly the network or file system access a given server needs. The whole platform runs inside a company’s own Kubernetes cluster instead of routing traffic through a third party’s cloud, which matters for any team under data residency or private cloud requirements a SaaS MCP gateway structurally can’t meet.

Publicly Disclosed Security Incidents

We found no publicly disclosed security incident tied to Stacklok or ToolHive as of this writing, worth stating plainly rather than treating as proof of anything. It’s a young, self-hosted platform with a small team, and the absence of a public incident this early is encouraging without being conclusive. Compare that to Composio’s May 2026 breach, which started with a single compromised employee OAuth token and escalated into the company’s own tool-execution sandbox. Stacklok hasn’t had that test yet, and nobody outside the company knows how it would hold up until it does.

---

Stacklok Alternatives Worth Comparing

Stacklok competes for governance budget more than it competes with SaaS tool-access platforms like MCP360, but buyers often weigh both when deciding where that budget goes. The platforms worth comparing it against are companies actually built around MCP governance, not a side feature buried inside a much larger business:

1. MCP360 is a hosted gateway bundling 100+ ready-made tools behind one API key, a different layer aimed at tool access rather than governance. Self-serve pricing, $0 to $333 a month. A direct comparison is available.
   
2. Archestra is an open source, self-hosted platform combining an MCP registry, gateway, and orchestrator with built-in prompt-injection guardrails and SSO through Entra ID or Okta, tested with Fortune 50 companies per its own site.
   
3. agentgateway is a Linux Foundation-hosted open source proxy for MCP, LLM, and agent traffic, narrower than a full platform since it has no registry or portal of its own.
   
4. Lunar.dev MCPX is Gartner-recognized as a Representative Vendor in the MCP Gateways category, open core with a paid, SOC 2 Enterprise tier.

None of these four solve the same problem, which is really the point: MCP360 hands an agent more to reach, the other three decide what it’s allowed to reach at all, and that distinction matters more to a budget decision than any single feature comparison in the table above.

---

Is Stacklok Right for You

Fit depends more on company size and existing infrastructure than on industry.

Is Stacklok Good for SMBs?

Rarely, at least not Stacklok Enterprise. The turnkey SSO, patch SLAs, and policy packs solve a coordination problem most small teams haven’t hit yet. ToolHive Community handles real MCP governance at zero cost long before Enterprise becomes worth a conversation.

Is Stacklok Good for Enterprises?

Yes, more than almost any other segment. Kubernetes-native architecture, audit trails, and IdP integration solve problems that show up at Global 2000 scale, exactly where Stacklok’s own case studies concentrate.

Choose Stacklok If

• Your team already runs Kubernetes and wants a governance layer inside your own infrastructure instead of routing MCP traffic through someone else’s cloud.
• Your compliance team is asking pointed questions about which MCP servers are authenticated, audited, and patched.
• Okta or Entra ID integration with group-based role mapping is a hard requirement, not a nice-to-have.

Consider Alternatives If

• You need a published price you can budget against before a sales call, since Stacklok won’t give you one.
• Your team has no existing Kubernetes footprint and isn’t planning to build one.
• What you’re missing is more tools for your agents to call, not tighter control over the ones you already run.

The product Stacklok sells today didn’t exist in its current form a year ago, and how quickly that shift happened, from AI-coding security to full MCP governance, says something about where the company thinks the real budget is heading. Whether that bet pays off for a given team depends less on the roadmap and more on how fast the two-review G2 page turns into twenty, and how the platform performs the first time something in that Kubernetes cluster goes wrong.

---

Frequently Asked Questions

What is Stacklok?

Stacklok is an enterprise MCP platform that controls which MCP servers an AI agent can reach. It’s built by Kubernetes co-creators and runs entirely inside a company’s own Kubernetes cluster, not through a third-party cloud.

Is Stacklok free?

Yes, partly. ToolHive, the open source core, is completely free under Apache 2.0. Stacklok Enterprise, the paid tier with SSO and support, requires a sales conversation.

How much does Stacklok Enterprise cost?

There’s no public price list. Stacklok Enterprise is sold as an annual subscription split into two SKUs, the Enterprise Platform and Enterprise Connectors, plus professional services billed on time and materials. Pricing is quote-only after a demo request, unlike MCP360’s published self-serve tiers running $0 to $333 a month.

Is ToolHive open source?

Yes. ToolHive is fully open source under the Apache 2.0 license, with no time limit or feature gate. It’s maintained by Stacklok and Red Hat, and Stacklok has stated an intent to eventually donate it to an open source foundation, though that hasn’t happened yet.

What happened to CodeGate, Trusty, and Minder?

All three are gone. Minder, the supply-chain policy engine, was donated to the Open Source Security Foundation in 2024. Trusty, the package risk scorer, was retired in mid-2025. CodeGate is archived on GitHub and no longer maintained. Stacklok replaced all three with ToolHive and Stacklok Enterprise, its current MCP governance platform.

Does Stacklok work with Claude Code, Cursor, and other MCP clients?

Yes. Five clients get automatic configuration: VS Code with GitHub Copilot, Cursor, Cline, Claude Code, and Roo Code, though Roo Code’s own extension was discontinued in 2026. Other clients like Windsurf and Zed connect manually.

What are the best alternatives to Stacklok?

The closest self-hosted peers are Archestra, agentgateway, and Lunar.dev MCPX, companies built specifically around MCP governance rather than as a side feature of a larger business. For teams that need broad tool access instead of tighter governance, MCP360 solves a this problem at published, self-serve pricing.

How does MCP360 compare to Stacklok?

They solve different layers of the same problem. Stacklok governs which MCP servers your own infrastructure can reach, self-hosted and Kubernetes-native. MCP360 is a hosted gateway bundling 100+ ready-made tools behind one API key, published pricing from $0 to $333 a month, for agents that need broader tool access fast.