# agentgateway vs Agent Router v1.2: MCP prefixMode Defaults

> Agent Router v1.2 added prefixMode: Never for MCP tool names. agentgateway ships Conditional, Always and Never, defaulting to Conditional. How they differ.

- Canonical URL: https://webofmike.com/agent-router-vs-agentgateway/
- Author: Mike Moore (https://webofmike.com/about/)
- Published: 2026-10-18
- Last modified: 2026-10-18
- Tags: AI Gateways, MCP, Platform Engineering, Generative AI
- Cite as: Mike Moore, "agentgateway vs Agent Router v1.2: MCP prefixMode Defaults", Web of Mike (webofmike.com), 2026-10-18. https://webofmike.com/agent-router-vs-agentgateway/


Agent Router v1.2.0 added `prefixMode: Never` for MCP tool names on October 7, 2026, a control agentgateway already ships with three values: `Conditional`, `Always`, and `Never`, defaulting to `Conditional`. Same field name, same `Never` behavior, different default. On agentgateway a single-target MCP backend shows bare tool names out of the box. On Agent Router those names stay prefixed until you set `Never`, because its default stays `Always`.

*Disclosure: I work at Solo.io, which builds agentgateway. I don't work on Agent Router or Envoy Gateway. Every claim about Agent Router below comes from its own [v1.2.0 release notes](https://github.com/theagentrouter/agent-router/releases/tag/v1.2.0) and [v1.1.0 release notes](https://github.com/theagentrouter/agent-router/releases/tag/v1.1.0), checked 2026-10-17.*

Agent Router is Envoy AI Gateway under a new name. The rename changes the project name, the GitHub org (now [`theagentrouter/agent-router`](https://github.com/theagentrouter/agent-router)), and the website (now [theagentrouter.ai](https://theagentrouter.ai)). The `aigateway.envoyproxy.io` API group, the CRDs, the Helm charts, the container images, and the `aigw` CLI all keep their names, and the old `envoyproxy/ai-gateway` repo redirects to the new one. The project joined the [Agentic AI Foundation](https://www.aaif.io/) on September 9, 2026, the same foundation that hosts agentgateway.

## How agentgateway handles MCP tool names

prefixMode is the setting that controls whether a gateway prefixes MCP tool names with the name of the target server they came from. agentgateway's prefixMode has three values, Conditional, Always, and Never, and the default is Conditional, which prefixes only when a backend has more than one target.

When agentgateway multiplexes several MCP servers behind one endpoint, it namespaces tool and prompt names with the target name so two servers that both expose `fetch` don't collide. The `prefixMode` field controls that:

- `Conditional` (default in Kubernetes): prefix only when the backend has more than one target.
- `Always`: prefix even with a single target.
- `Never`: no prefix. Calls are routed by looking up which target serves the name, so names have to be unique across targets. This is the one for clients that need plain tool names, like MCP Apps.

In **Kubernetes mode** it's a field on `AgentgatewayBackend`, documented on the [virtual MCP page](https://agentgateway.dev/docs/kubernetes/latest/documentation/mcp/virtual/):

```yaml
apiVersion: agentgateway.dev/v1alpha1
kind: AgentgatewayBackend
metadata:
  name: mcp
spec:
  mcp:
    prefixMode: Never
    targets:
      ...
```

In **standalone mode** the same control is `prefixMode` on the MCP backend in the config file, with lowercase values `conditional`, `always`, and `never`, per the [standalone config schema](https://agentgateway.dev/schema/config). agentgateway takes the same three values in standalone mode, in lowercase, and in Kubernetes mode on AgentgatewayBackend.

## What Agent Router v1.2.0 added

Agent Router has always prefixed MCP tool names with the backend name when routing to multiple targets. v1.2.0 adds a `Never` mode on MCPRoute for clients that hardcode tool names. A `Never`-mode backend has to list its tools in `toolSelector.include` so the controller can still enforce unique names, and two `Never`-mode backends exposing the same tool name make the route `NotAccepted`. The default stays `Always`. Agent Router v1.2.0 added a Never mode on MCPRoute, and its default stays Always.

So the control is functionally the same. The difference is out of the box. On agentgateway with the default, a single-target backend shows bare tool names, and the prefix appears only once you add a second target. On Agent Router with the default, tool names are prefixed even behind one target until you change the mode.

The rest of v1.2.0, per its release notes:

- **Caller-supplied credentials with `injectionPolicy: IfNotPresent`.** A client can forward its own upstream token, and the gateway injects its configured key only when that header is missing.
- **Policy merging with `mergeType`.** The `SecurityPolicy` and `BackendTrafficPolicy` that Agent Router generates for an MCPRoute can now merge with Gateway- or listener-level policy (`StrategicMerge` or `JSONMerge`) instead of replacing it.
- **Two new backend schemas.** `AWSOpenAI` sends OpenAI-format requests to Bedrock's OpenAI-compatible endpoint, signed with SigV4. `TypeSafe` routes to TypeSafe's Jev System One decision model at `/typesafe/v1/systemone`, with API-key auth and the usual metrics and cost tracking. Streaming is not supported on this backend yet. That second one amused me more than it should have: Jev is the same model that triages the backlog for this blog.

v1.1.0, two months earlier, added vLLM-compatible `/tokenize` across providers, per-request credential overrides, an HTTP CONNECT forward proxy for upstream LLM traffic, stream idle timeouts with failover, MCP hostname routing with CEL-based backend selection, and OpenTelemetry GenAI span attributes.

## MCP authorization in agentgateway

agentgateway's MCP authorization is CEL on `mcp.tool.name` directly, evaluated per call against JWT claims and `source.spiffeId` from a SPIFFE Workload API identity. It's documented in the [authorization reference](https://agentgateway.dev/docs/kubernetes/latest/security/authorization/), and I covered the sharp edges in [agentgateway CEL authorization gotchas](/agentgateway-cel-authorization-gotchas/). Agent Router's MCP authorization in v1.2.0 is built from policy objects (`SecurityPolicy`, OAuth scopes, the `backendSelector` CEL from v1.1.0) on Envoy Gateway's policy model. Different shape, and a different place to look when you write the rule.

## Spend limits: standalone vs Kubernetes

Both releases talk about cost tracking, so here's exactly what agentgateway open source gives you today, because it differs by mode:

- **Standalone, v1.5.0 and later:** every API key can carry [per-key budgets](https://agentgateway.dev/docs/standalone/latest/llm/cost-controls/budget-limits/per-key/) in `USD` or `Tokens` over a rolling window. With `onBudgetExceeded: Block`, the key gets a 429 once it's over. Budgets need a database, and a `USD` budget needs a model catalog that prices the models the key uses.
- **Kubernetes, open source:** the Kubernetes API doesn't carry the `budgets` field, so caps are token-only, through [rate limit token budgets](https://agentgateway.dev/docs/kubernetes/latest/llm/cost-controls/budget-limits/).
- **Kubernetes, dollar budgets:** those need the `EnterpriseAgentgatewayBudget` CRD in Solo Enterprise for agentgateway.

I wrote up the standalone budgets in more detail in [agentgateway per-key LLM budgets](/agentgateway-per-key-llm-budgets/).

## The one thing to check on agentgateway

With the default `Conditional` mode, adding a second target to an agentgateway MCP backend changes every tool name on it. A single-target backend exposes `fetch`. Add a second target and that tool shows up as `mcp-website-fetcher_fetch`, the target name plus the tool name, which is exactly what the [virtual MCP walkthrough](https://agentgateway.dev/docs/kubernetes/latest/documentation/mcp/virtual/) lists. Any client that calls the bare name stops finding it. So before you add that second target, in standalone or Kubernetes, do one of two things: update the client to the prefixed names, or set `prefixMode: Never` on the backend and confirm the two servers expose no tool with the same name.

## Related

- [agentgateway vs LiteLLM vs Portkey, Compared](/agentgateway-vs-litellm-vs-portkey/)
- [agentgateway per-key LLM budgets](/agentgateway-per-key-llm-budgets/)
- [agentgateway CEL authorization gotchas](/agentgateway-cel-authorization-gotchas/)