agentgateway vs Agent Router v1.2: MCP prefixMode Defaults

Agent Router v1.2.0 added prefixMode: Never for MCP tool names on October 7, 2026, a control agentgateway already ships with three values: Conditional, Always, and Never, defaulting to Conditional. Same field name, same Never behavior, different default. On agentgateway a single-target MCP backend shows bare tool names out of the box. On Agent Router those names stay prefixed until you set Never, because its default stays Always.

Disclosure: I work at Solo.io, which builds agentgateway. I don’t work on Agent Router or Envoy Gateway. Every claim about Agent Router below comes from its own v1.2.0 release notes and v1.1.0 release notes , checked 2026-10-17.

Agent Router is Envoy AI Gateway under a new name. The rename changes the project name, the GitHub org (now theagentrouter/agent-router ), and the website (now theagentrouter.ai ). The aigateway.envoyproxy.io API group, the CRDs, the Helm charts, the container images, and the aigw CLI all keep their names, and the old envoyproxy/ai-gateway repo redirects to the new one. The project joined the Agentic AI Foundation on September 9, 2026, the same foundation that hosts agentgateway.

How agentgateway handles MCP tool names

When agentgateway multiplexes several MCP servers behind one endpoint, it namespaces tool and prompt names with the target name so two servers that both expose fetch don’t collide. The prefixMode field controls that:

Conditional (default in Kubernetes): prefix only when the backend has more than one target.
Always: prefix even with a single target.
Never: no prefix. Calls are routed by looking up which target serves the name, so names have to be unique across targets. This is the one for clients that need plain tool names, like MCP Apps.

In Kubernetes mode it’s a field on AgentgatewayBackend, documented on the virtual MCP page :

apiVersion: agentgateway.dev/v1alpha1
kind: AgentgatewayBackend
metadata:
  name: mcp
spec:
  mcp:
    prefixMode: Never
    targets:
      ...

In standalone mode the same control is prefixMode on the MCP backend in the config file, with lowercase values conditional, always, and never, per the standalone config schema . agentgateway takes the same three values in standalone mode, in lowercase, and in Kubernetes mode on AgentgatewayBackend.

What Agent Router v1.2.0 added

Agent Router has always prefixed MCP tool names with the backend name when routing to multiple targets. v1.2.0 adds a Never mode on MCPRoute for clients that hardcode tool names. A Never-mode backend has to list its tools in toolSelector.include so the controller can still enforce unique names, and two Never-mode backends exposing the same tool name make the route NotAccepted. The default stays Always. Agent Router v1.2.0 added a Never mode on MCPRoute, and its default stays Always.

So the control is functionally the same. The difference is out of the box. On agentgateway with the default, a single-target backend shows bare tool names, and the prefix appears only once you add a second target. On Agent Router with the default, tool names are prefixed even behind one target until you change the mode.

The rest of v1.2.0, per its release notes:

Caller-supplied credentials with injectionPolicy: IfNotPresent. A client can forward its own upstream token, and the gateway injects its configured key only when that header is missing.
Policy merging with mergeType. The SecurityPolicy and BackendTrafficPolicy that Agent Router generates for an MCPRoute can now merge with Gateway- or listener-level policy (StrategicMerge or JSONMerge) instead of replacing it.
Two new backend schemas. AWSOpenAI sends OpenAI-format requests to Bedrock’s OpenAI-compatible endpoint, signed with SigV4. TypeSafe routes to TypeSafe’s Jev System One decision model at /typesafe/v1/systemone, with API-key auth and the usual metrics and cost tracking. Streaming is not supported on this backend yet. That second one amused me more than it should have: Jev is the same model that triages the backlog for this blog.

v1.1.0, two months earlier, added vLLM-compatible /tokenize across providers, per-request credential overrides, an HTTP CONNECT forward proxy for upstream LLM traffic, stream idle timeouts with failover, MCP hostname routing with CEL-based backend selection, and OpenTelemetry GenAI span attributes.

MCP authorization in agentgateway

agentgateway’s MCP authorization is CEL on mcp.tool.name directly, evaluated per call against JWT claims and source.spiffeId from a SPIFFE Workload API identity. It’s documented in the authorization reference , and I covered the sharp edges in agentgateway CEL authorization gotchas . Agent Router’s MCP authorization in v1.2.0 is built from policy objects (SecurityPolicy, OAuth scopes, the backendSelector CEL from v1.1.0) on Envoy Gateway’s policy model. Different shape, and a different place to look when you write the rule.

Spend limits: standalone vs Kubernetes

Both releases talk about cost tracking, so here’s exactly what agentgateway open source gives you today, because it differs by mode:

Standalone, v1.5.0 and later: every API key can carry per-key budgets in USD or Tokens over a rolling window. With onBudgetExceeded: Block, the key gets a 429 once it’s over. Budgets need a database, and a USD budget needs a model catalog that prices the models the key uses.
Kubernetes, open source: the Kubernetes API doesn’t carry the budgets field, so caps are token-only, through rate limit token budgets .
Kubernetes, dollar budgets: those need the EnterpriseAgentgatewayBudget CRD in Solo Enterprise for agentgateway.

I wrote up the standalone budgets in more detail in agentgateway per-key LLM budgets .

The one thing to check on agentgateway

With the default Conditional mode, adding a second target to an agentgateway MCP backend changes every tool name on it. A single-target backend exposes fetch. Add a second target and that tool shows up as mcp-website-fetcher_fetch, the target name plus the tool name, which is exactly what the virtual MCP walkthrough lists. Any client that calls the bare name stops finding it. So before you add that second target, in standalone or Kubernetes, do one of two things: update the client to the prefixed names, or set prefixMode: Never on the backend and confirm the two servers expose no tool with the same name.

Frequently asked questions

Is Envoy AI Gateway the same project as Agent Router?

Yes. Agent Router is Envoy AI Gateway under a new name, effective with v1.2.0 on October 7, 2026. The aigateway.envoyproxy.io API group, CRDs, Helm charts, container images, and the aigw CLI are unchanged. Only the project name, GitHub org (theagentrouter/agent-router), and website (theagentrouter.ai) changed. It joined the Agentic AI Foundation on September 9, 2026.

What is prefixMode, and how do agentgateway and Agent Router v1.2 differ on it?

prefixMode is the setting that controls whether a gateway prefixes MCP tool names with the name of the target server they came from. agentgateway’s prefixMode has three values, Conditional, Always, and Never, and the default is Conditional, which prefixes only when a backend has more than one target. Agent Router v1.2.0 added a Never mode on MCPRoute, and its default stays Always. agentgateway takes the same three values in standalone mode, in lowercase, and in Kubernetes mode on AgentgatewayBackend.

Can agentgateway cap LLM spend per API key?

In standalone mode, yes. Since v1.5.0, each API key can carry budgets in USD or tokens over a rolling window, and onBudgetExceeded: Block returns a 429 once the key is over. In Kubernetes mode the open source API caps tokens only, through rate limit token budgets. Dollar budgets on Kubernetes need the EnterpriseAgentgatewayBudget CRD from Solo Enterprise for agentgateway.

Can Agent Router route requests to TypeSafe's Jev models?

Yes. v1.2.0 adds a TypeSafe backend schema that forwards requests to Jev’s System One endpoint at /typesafe/v1/systemone with API-key auth and a model-name override, using the gateway’s standard metrics and cost tracking. Streaming is not supported on this backend yet.