Training Example: Tyk Technologies – Review the Data, Give Your Score & Compare to the Real AI Evaluation

[H2] API management
built so you can go your own way
[H2] API management
built so you can go your own way
The only truly independent API management platform — and the only open source AI governance control plane in the market.Full control. No lock-in. Deploy anywhere. Get a demo Pricing WHY TYK
[H2] Independent by design.Not a cloud. Not a suite. Not a compromise.
Every other platform wants to own your infrastructure.Tyk is built for teams who need to own it themselves.
[H4] Deploy anywhere
Cloud, on-prem, hybrid, Kubernetes, sovereign regions, air-gapped. The same platform, the same policies, wherever your data has to live. vs. Hyperscalers — usage-based pricing breaks at telco and payments volumes. Single-cloud deployment creates data residency problems.
[H4] Buy what you'll run
Enterprise API governance without buying a platform you’ll use 20% of. Tyk does one thing well: API management and governance, end to end.vs. MuleSoft / IBM — full-suite lock-in at enterprise scale. You pay for what you don’t use, and leave when the contract expires.
[H4] Open source foundation
The gateway is open source. No proprietary runtime. No black box. Your team can read it, fork it, extend it, and contribute back.vs. Apigee / Kong — cloud-managed control planes with proprietary runtimes. The further in you go, the harder it is to leave. AI GOVERNANCE
[H2] The only open source AI governance control plane.
AI agents, MCP servers, and LLM-backed services aren’t a different problem from API management. They’re the same problem with higher stakes.Tyk governs AI traffic the same way it governs classic APIs — one control plane, one audit trail, one place to set policy. And unlike every other vendor in this space, the governance layer is open source. See how it works
[H4] What the control plane covers
[H3] Token-aware rate limiting
LLM spend tracked and enforced per tenant, team, and cost centre — from day one.
[H3] Tyk MCP Gateway
Per-tool rate limits, filtered discovery, and a full audit trail for the remote MCP servers your AI agents call. Same control plane as your classic APIs.
[H3] Unified audit trail
Agent → tool → API events exported via OpenTelemetry. One audit log for compliance teams and regulators.
[H3] Policy as code
Same GitOps workflow for AI policy as for classic API policy. No separate tooling, no separate approval chain
[H3] Open source
The only AI governance control plane in the market with a fully open source foundation. Inspect it, extend it, run it yourself. MCP GATEWAY
[H2] MCP, governed.
AI agents are already calling MCP servers in production. Your security and platform teams need controls that ship today, not next quarter.
[H4] 01
[H4] Per-tool rate limiting
Independent consumer counters at the level of the individual tool. No other gateway ships this today.
[H4] 02
[H4] Filtered discovery
Agents see only the tools they are entitled to invoke. Tools they cannot call are invisible to them.
[H4] 03
[H4] OAuth 2.1 with PRM
Native Protected Resource Metadata. Spec-compliant clients discover the authorisation server automatically, without manual configuration.
[H4] 04
[H4] One control plane
MCP proxies managed alongside your REST and GraphQL APIs. Same Dashboard, same policies, same keys. Learn more CUSTOMER STORIES
[H2] What teams actually needed.
The buyers who choose Tyk aren’t looking for the biggest vendor. They’re looking for the one that fits how they work. Tyk’s API management solution serves as the central enabler to orchestrate our capabilities and APIs. With Tyk we can create and maintain not only service-specific APIs but also build API aggregations, proxies, mocks or even a mixture of these different kinds of APIs. Alexander TroppmannLead Cloud-native Architect, ZEISS Our bill with MuleSoft was very, very large, and so part of the initiative… was cost savings. Yes, there’s an initial upfront cost for the development work, but year over year, we'll be saving, I think in our case… upwards of half a million dollars per year. Todd LyonVP Engineering Manager, TAB Bank Our approach has always been to go with vendors that take the time to listen to our pain points, resolve our problems, and keep our needs in their roadmap. Tyk has been the perfect partner. We have continuous engagement with them. They’ve talked to our developers and had learning sessions with us. That has really helped our team grow. Vaishali DalviVP Web Development, RBFCU Read customer stories DEPLOYMENT
[H2] Your infrastructure.
Your rules.
No mandatory cloud. No forced upgrade path. Tyk runs where you need it to run.
[H4] Cloud
Tyk-managed SaaS. Fast to start, fully maintained.
[H4] Self-managed
Full control. On-prem, private cloud, or air-gapped environments.
[H4] Hybrid
Control plane in the cloud, data plane wherever the data lives.
[H4] Sovereign
Data residency compliance. Deploy in regulated regions without redesigning your governance model.All deployment models run the same codebase, enforce the same policies, and produce the same audit events. No feature disparity by deployment type. Try Tyk for free HOW WE COMPARE
[H2] The only platform that doesn't ask you to choose.
Between control and scale. Between open source and enterprise support. Between API management and AI governance.TykApigeeKongMuleSoftAWS / AzureTruly self-managed deploymentPartialPartialPartialOpen source gatewayOpen source AI governance control planeSovereign / data residency deploymentLimitedPartialPartialAir-gapped / disconnected operationPartialUnified policy: classic APIs + AI agentsAdd-onPluginAdd-onNo mandatory suite adoptionPartialPredictable per-deployment pricingPartial
[H2] Ready to go your own way?
Talk to the team, or start with the open source gateway and see how far you get before you need us. Get a demo Read the docs ISO 27001 · SOC 2 Type II · PCI DSS · AWS Partner

TYK MCP GATEWAY
[H1] Same gateway you trust for APIs. Now for MCP.
Bring tool-level controls and observability to the remote MCP servers your AI agents are already calling.On the platform your team already runs. Book a demo Read the docs
[H4] 10+ years
Governing protocols at enterprise scale
[H4] NatWest, Capital One +
Production deployments at Tier-1 banks
[H4] SOC2 & ISO compliant
Trusted by regulated buyersTHE PROBLEM
[H2] MCP is hitting production. Your API controls don't reach it.
Remote MCP servers are HTTP services. Without a gateway in front of them, they accumulate the same risks any ungoverned service does, with one extra dimension: a single MCP server typically exposes dozens of tools with very different cost and risk profiles. list_files is cheap. execute_sql is expensive. send_email is irreversible. Sharing one rate limit across all three is a production incident waiting to happen.
[H3] Authentication is fragmented
Each MCP server implements its own auth, or none. There is no central place to issue credentials, enforce access, or revoke instantly when an agent or employee is offboarded.
[H3] Access is binary
An agent either has access to a server or it does not. There is no way to say "this agent can read but not delete" without running separate servers per role, which multiplies infrastructure.
[H3] No cost or risk control at the tool level
A poorly behaved or compromised agent can call expensive, irreversible operations with no throttle. There is no mechanism to protect high-value actions from high-volume noise.
[H3] Zero visibility
No standard way to see which agents are calling which tools, how often, or where failures occur. Compliance teams cannot audit. SREs cannot triage.What Tyk MCP Gateway does
[H2] One control plane in front of every remote MCP server.
Tyk sits in front of remote MCP servers and applies authentication, granular access control, per-tool rate limiting, and full observability to every JSON-RPC request. MCP proxies are managed alongside your existing REST and GraphQL APIs in the same Dashboard, using the same policies and the same key management.There is no separate system to operate. No new team to hire. The platform and security teams already using Tyk get MCP governance as a native capability on the infrastructure they already run.What Tyk MCP Gateway does
[H2] Four reasons enterprise teams choose Tyk for MCP.
[H2] 01
[H2] TRUST TRANSFER
[H4] The team alreadymanaging your APIs.
A decade governing REST, SOAP, GraphQL, gRPC and streaming. MCP is incremental. Production-proven at Barclays, NatWest, Capital One, First American, General Dynamics, Ford OAuth, JWT, mTLS, OAuth 2.1 native. All in production today.
[H2] 02
[H2] UNIFIED MANAGEMENT
[H4] One control plane acrossREST, GraphQL, & MCP.
MCP proxies in the same Dashboard, with the same policies and keys as your existing APIs. Same OAS-based configuration model and authentication methods as your existing APIs Tyk Operator support: MCP proxies and policies as Kubernetes CRDs, GitOps-driven
[H2] 03
[H2] GRANULARITY
[H4] Tool-level control, notprotocol-level approximation.
API-level rate limiting is too blunt for AI agents. Tyk applies controls per tool and per consumer. Per-tool rate limiting with independent consumer counters. No other gateway ships this today. Filtered discovery: agents see only the tools they are entitled to invoke. Tools they cannot call are invisible to them. Five rate-limit levels per consumer: policy, proxy, method, tool, resource or prompt.
[H2] 04
[H2] SOVEREIGNTY
[H4] Runs in any environmentyour data must stay in.
On-prem, any cloud, or polycloud. Regulated buyers don’t compromise on data residency to govern AI agents. The same deployment model trusted by BFSI, healthcare, government and defence customers GDPR, HIPAA, SOC2, NIS2 ready 99.99% uptime achievable in customer-controlled environmentsWhat’s shipping today
[H2] Available today
Configurable through the Dashboard, the Tyk Operator, or the management API.
[H5] Capability
[H5] Detail
Proxy management Full create, read, update, delete via Dashboard and API. Same model as REST and GraphQL APIs. Authentication Bearer token, API key, JWT, OAuth 2.0, mTLS. All Tyk auth methods apply to MCP. OAuth 2.1 Native implementation with Protected Resource Metadata. Spec-compliant clients self-configure. Tool-level rate limiting Five independent levels per consumer: policy global, per proxy, per method, per tool, per resource or prompt. Per-consumer RBAC Proxy, method, and primitive level. Allow and block lists with regex support. Filtered discovery tools/list, resources/list, prompts/list responses scoped per consumer policy. Observability Dashboard analytics by proxy and primitive. OpenTelemetry metrics and structured access logs with MCP-specific fields. Traffic management Circuit breakers, request size limits, header transforms per tool, resource, or prompt. Upstream auth (Enterprise) OAuth 2.0 client credentials for OAuth-protected upstream MCP servers. Deployment Cloud, self-hosted, or hybrid. Same MDCB-managed clusters as your existing APIs. Tyk Operator MCP proxies and policies as Kubernetes CRDs. GitOps-driven deployment and lifecycle management.HOW IT WORKS
[H2] One proxy, many agent roles, no new infrastructure.
A single policy grants a read-only agent access to a weather MCP proxy, restricts it to specific tools, limits its overall call volume, and applies a tighter limit on the expensive generate_forecast tool.
[H3] What it can do:
Up to 200 calls per minute to this proxy. get_current_weather shares that budget. generate_forecast has a separate, tighter budget of 10 calls per minute.
[H3] What this agent sees:
When it calls tools/list, Tyk returns three tools, not the full upstream catalogue. The other tools on the server are invisible because the agent has no entitlement to them.
[H3] What happens at the limit:
When generate_forecast hits 10 calls, the agent receives a 429 on that tool only. The other tools continue to work. policy.json Weather Agent — Standard Tier{
"name": "Weather Agent — Standard Tier",
"rate": 1000, "per": 60,
"access_rights": {
"{proxy-id}": {
"limit": { "rate": 200, "per": 60 },
"json_rpc_methods_access_rights": {
"allowed": ["tools/call", "tools/list"]
},
"mcp_access_rights": {
"tools": {
"allowed": ["get_current_weather", "search_weather", "generate_forecast"]
}
},
"mcp_primitives": [
{
"type": "tool",
"name": "generate_forecast",
"limit": { "rate": 10, "per": 60 }
}
]
}
}
}HOW IT COMPARES
[H2] The right depth, on the right surface.
Two categories of vendor are entering the MCP space. Both have structural limits.OPTION A
[H4] MCP-native gateways
Purpose-built for MCP capabilities, not Enterprise needs. Often fast-moving and feature-rich within their narrow surface.Govern MCP onlyREST and GraphQL APIs sit outside their scopeAdds a separate platform, separate team, separate audit trail Structural limit:Narrow surface area.OPTION B
[H4] Traditional API gateways
Already in your estate. Most have announced MCP proxying and basic auth.API-level rate limiting only, not tool-levelFiltered discovery is rare and partialTool-level granularity requires JSON-RPC body parsing, not a config flag Structural limit:Depth at the policy layer.TYK
[H4] One platform, full depth.
Ten years of API gateway expertise applied to MCP, on the same control plane as your REST and GraphQL APIs.Per-tool rate limiting with independent consumer countersPer-consumer filtered discovery across tools, resources & promptsUnified Dashboard, policies and keys across every protocol No structural limit.One platform, one team.WHERE IT SITS IN THE STACK
[H2] MCP Gateway and AI Studio: the full stack for governing AI.
AI Studio governs what happens inside the LLM loop: models, tokens, cost, and agent tool orchestration. MCP Gateway governs the infrastructure underneath the tools themselves: securing, observing, and rate-limiting the MCP servers those tools call. Most enterprise customers will run both, because the two layers answer different questions.Tyk MCP GatewayTyk AI Studio Primary concern Govern traffic to remote MCP servers Govern LLM usage, cost, and agent tooling What it sees Requests, JSON-RPC methods, primitives Tokens, models, tools, spend Auth model API keys, OAuth 2.1, JWT, mTLS OAuth, API keys for LLM providers Rate limiting Per-tool, per-consumer, per-method Per-model, per-budget Who uses it Platform engineers, security teams AI engineers, cost owners
[H2] FAQ
[H4] Is the Tyk MCP Gateway safe for Enterprise use?
The remote MCP server pattern is. Local MCP, which is around 90% of the public landscape today, is not enterprise-fit because it bypasses your infrastructure entirely. Tyk MCP Gateway is built for the remote deployment model, which is HTTP-based and behaves like any other API. That is the pattern enterprise teams are now standardising on.
[H4] Can Tyk govern MCP servers we already run, without changing them?
Yes. The gateway sits in front of your existing remote MCP servers. The upstream servers do not change. Tyk handles authentication, access control, rate limiting, and observability at the gateway layer. Customers have dropped Tyk in front of MCP infrastructure in a single afternoon.
[H4] How do agents authenticate with Tyk MCP Gateway?
Tyk supports all standard authentication methods: bearer token, API key, JWT, OAuth 2.0, and mTLS. For teams following the MCP spec’s recommended approach, Tyk also implements OAuth 2.1 with Protected Resource Metadata. Spec-compliant clients discover the authorisation server automatically, without any manual configuration. For agents connecting to upstream MCP servers that are themselves OAuth-protected, upstream OAuth 2.0 client credentials are available in the Enterprise edition.
[H4] How does Tyk give different agents access to different tools?
Without a gateway, there is no mechanism for per-consumer access control. Agent access to an MCP server is all-or-nothing. Tyk’s filtered discovery applies each agent’s policy at the gateway layer: when an agent calls tools/list, Tyk returns only the tools, resources, and prompts that agent is entitled to see. The upstream server doesn’t change, and no separate deployment is needed per role.
[H4] What visibility does Tyk give me into MCP traffic?
Four layers. The Dashboard shows request volume, error rates, and latency broken down by proxy and by individual primitive (tool, resource, or prompt), without any custom configuration. Every request also produces a structured access log entry with four MCP-specific fields: mcp_method (the JSON-RPC method), mcp_primitive_type, mcp_primitive_name, and mcp_error_code, which you can feed into your SIEM, log aggregator, or compliance pipeline.For metrics, Tyk emits two MCP-specific OpenTelemetry metrics: tyk.mcp.requests.total, a counter broken down by method, primitive type, primitive name, error code, and HTTP status; and tyk.mcp.primitive.duration, a histogram of upstream execution time per primitive. Route them to Prometheus, Grafana, Datadog, or any OTel-compatible backend.For tracing, every MCP request produces a distributed trace spanning agent, gateway, and upstream server. MCP-specific attributes (method, primitive type, primitive name, error code, and session ID) are set on each span, so when something fails your SREs can pinpoint whether the issue is at the gateway or upstream in seconds, not hours.
[H4] Do I need Tyk AI Studio as well?
Not to use MCP Gateway. MCP Gateway runs standalone and governs MCP infrastructure on its own. AI Studio governs the LLM loop above the tools. Most enterprises adopting both will run them together because they answer different questions.
[H4] Which MCP spec version does Tyk support?
Tyk MCP Gateway is fully compliant with MCP spec 2025-11-25, including Streamable HTTP transport and full SSE (Server-Sent Events) support with session continuity across reconnects.
[H4] What's in the Enterprise edition vs the Community edition (OSS)
The full feature set, including five-level rate limiting, per-consumer RBAC, filtered discovery and OAuth 2.1 PRM, is in the OSS gateway. Upstream OAuth 2.0 client-credentials auth, for connecting to OAuth-protected upstream MCP servers, as well as the control plane management layer is Enterprise Edition. Talk to us if you want a detailed walk-through against your specific use case.
[H4] Where does Tyk MCP Gateway run?
Tyk Cloud, self-managed on-prem, any cloud, or polycloud. The same deployment model used by our regulated customers in financial services, healthcare and government, because the customer controls where the software and data live.
[H4] How do I get started with Tyk MCP Gateway?
Tyk MCP Gateway is available as part of the Tyk API Management platform. If you’re an existing Tyk customer, contact your account team. If you’re evaluating Tyk, start with a self-managed trial or request a demo to see the MCP Gateway in action with your own API estate.
[H3] Book a demo
Book a demo
[H3] Read the docs
Read the docs
[H2] See it in production.
A 30-minute demo, walked through by a solutions architect. We’ll show tool-level rate limiting, filtered discovery, and the audit trail your security team will ask for, against your own use case.

[H2] Build faster. Scale smarter.
When you connect with our team, you can expect: A deep dive into your business and technology processes Expert guidance to identify the best solution for your needs Clear, detailed answers to all your questions Collaborate with us to develop a tailored strategy that leverages Tyk to drive innovation and achieve your goals.Need immediate assistance? Use the chatbot in the bottom right of your window to get quick answers. Looking for technical support? Join our community for expert insights and discussions.
[H2] SPEAK TO OUR EXPERTS
[H1] Get a demo

[H1] How Land Information New Zealand saves 100+ hours monthly managing their APIs with Tyk's gateway
[H4] 40,000 requests per minute
Peak API traffic serving 80 developers and 13,000 end users across government services.
[H4] 100 monthly hours saved
Reduced complexity saves 2 hours per API across 50 APIs, delivering significant cost savings.
[H4] 50 APIs centralized
Complete ecosystem of microservices now managed through unified Tyk gateway infrastructure.
[H3] Region
APAC
[H3] Sector
Government & Public Sector
[H3] Product
Self-Managed
[H2] Why Tyk?
Land Information New Zealand was seeking the right balance between features and cost. It undertook a cost benefit analysis, comparing Tyk with other API gateway providers.“We don’t want to pay for features we’re not going to use,” says Product Owner Ankit Tarway. “Tyk delivers all the features we need at the best price. Choosing Tyk made sense both operationally and financially.”
[H2] At a glance
[H3] Company
Land Information New Zealand provides expert property and location information on New Zealand’s land, sea and rivers. linz.gov.nz
[H3] Key features used
Tyk Gateway RBAC API Analytics Toitū Te Whenua – Land Information New Zealand – is a government department providing a wide range of services relating to the country’s land, sea and rivers. Its work encompasses everything from Crown property applications and land records to maritime safety, along with maps, charts, geodesy and much more.Land Information New Zealand carries out this work by providing microservices, which external users such as surveyors, property lawyers and the general public consume through its app. Internal teams build the microservices, using an ecosystem of around 50 APIs to do so.It is working with Tyk to achieve greater efficiency in building and managing APIs, enabling the department to get its microservice products to market faster and more cost-effectively.
[H2] The problem
Before using Tyk, Land Information New Zealand’s teams were relying on proxy generators, then manually copying and pasting APIs. Ankit Tarway comments:“Doing everything manually was draining developers’ time. It was very inefficient. We replaced the manual processes with Tyk API Gateway, resulting in significant time and cost savings. With Tyk in place, complexity reduced and efficiency increased. Having everything centralized made our API development and maintenance drastically easier and more cost-effective.”Implementing Tyk Gateway also served as a secondary use case, as Tarway explains:“Tyk has made it much easier to review and enhance our API security – that’s been an additional benefit of using the gateway.”
[H2] The role of Tyk
Tyk is providing Land Information New Zealand with a simple, efficient solution for developing and maintaining its APIs, resulting in a much faster product release cycle.Land Information New Zealand has deployed Tyk as a self-managed installation, hosted on AWS in Sydney. It uses Tyk for its production, non-production, pre-production and development environments, making good use of Tyk’s role-based access control user management capabilities.Using Tyk to modernize its infrastructure has enabled Land Information New Zealand to enhance its operations’ overall efficiency and security and improve scalability and time to market. It has standardized and aligned its API implementation approach while improving monitoring and alerting.Without Tyk Gateway in place, the future would have looked very different for the department. Its already complex API ecosystem and processes would have continued to become more cumbersome and require more manual intervention and coordination across different teams. Costs would have remained higher, with inefficiencies driving the need for additional resources. Relying on so many manual processes also meant greater scope for security flaws – something no organization can afford to take lightly.
[H2] The solution
Implementing Tyk was a clear and simple process, with Product Owner Ankit Tarway serving as an internal champion at Land Information New Zealand. The infrastructure team spearheaded the implementation, with developers engaged throughout the process on Tyk’s features and capabilities. Tarway oversaw the implementation, facilitating Tyk’s rollout and adoption for all API-related development.“We have 50 APIs. Tyk has enabled us to save two hours per API by reducing the complexity of our processes and streamlining our maintenance needs. That’s 100 hours saved, which is good for us in dollar terms. And not only are we saving money, but we’re getting products to market faster.”In addition to reaping the rewards of simplified API development and deployment, Land Information New Zealand is enjoying the security benefits of using Tyk to manage its APIs. The team has also been impressed with the support of Tyk’s account team, provided as part of Tyk’s Gold Service Level Agreement. Land Information New Zealand has made use of Tyk’s community board as well, reaping the reward of extensive open source community expertise.A further benefit has been the improved developer experience that Tyk API Gateway has enabled. Developers now have the tools and resources they need to easily and efficiently build APIs, saving time and headaches while fostering innovation. The increased agility also puts Land Information New Zealand in a stronger position to quickly respond to market changes and customer needs.
[H2] The future
For now, Tyk’s functionality is perfectly aligned with Land Information New Zealand’s release timelines and requirements. But that’s not to say there isn’t scope for further developments in future, as Product Owner Ankit Tarway concludes:“We’re interested in Tyk’s Developer Portal. While we don’t use it currently, if we get to the point of exposing our APIs to our business partners, then it will be very handy. We’ve already talked to our developers about its potential – we’re thinking about the Developer Portal in terms of its long-term value.”
[H2] Related customer stories
[H2] SmarTone
SmarTone transforms API management: from manual inefficiency to unified control​ Telecom & Communications APAC Self-Managed
[H2] Rouvy
How ROUVY scaled from 1M to 21M monthly API requests with Tyk's lightning-fast gateway​ Leisure Global Self-Managed
[H2] Kalamuna
How Kalamuna turned a fragile legacy system into a rock-solid API ecosystem, powered by Tyk.​ Government & Public Sector Americas Cloud
[H3] Start for free
Start for free
[H3] Get a demo
Get a demo
[H2] Ready to get started?
You can have your first API up and running in as little as 15 minutes. Just sign up for a Tyk Cloud account, select your free trial option and follow the guided setup.