TrueFoundry's own Agent Gateway page states the architecture in one sentence: the Agent Gateway "functions as an intelligent reverse proxy specifically for agentic systems."

That is not a criticism. It is the cleanest one-line description of a well-built product, and it tells a buyer exactly what they are getting. Traffic goes through the proxy, and everything the proxy sees, it can govern — the prompt, the model response, the MCP tool call, the arguments to that call, the result that comes back. Policy attaches to the boundary. What crosses the boundary is controlled.

The question that decides this comparison is what your agents do that never crosses that boundary.

TrueFoundry (legal entity Ensemble Labs Inc., San Francisco) is an enterprise AI platform combining an AI Gateway across 1,600+ models, an MCP Gateway, an Agent Gateway, model serving, fine-tuning, and GPU orchestration — deployable in SaaS, VPC, on-prem, or air-gapped environments, with guardrails that block and rewrite traffic in the request path. Waxell is an AI control plane where enforcement is the primitive rather than a boundary feature: Observe instruments agents in two lines of code and evaluates every run against 50+ policy categories before the next step executes, the MCP Gateway governs tool calls across 160+ upstream connectors, Runtime gates each step of high-stakes workflows, and Endpoints governs the AI running on employee machines. TrueFoundry governs the traffic. Waxell governs the agent.

What is TrueFoundry built for?

TrueFoundry is the most infrastructure-complete competitor in this category, and its governance is real rather than aspirational.

The AI Gateway routes across 1,600+ models with weight-, latency-, and priority-based routing, fallbacks, semantic caching, budgets, and rate limits. The MCP Gateway registers upstream MCP servers behind RBAC, supports virtual MCP servers that expose a curated subset of tools from several upstreams, and carries an authentication model more detailed than most vendors publish: four inbound methods including per-user OAuth and identity-provider JWTs, and seven outbound models including OAuth2 authorization-code, client-credentials, and token passthrough. Access control resolves against the TrueFoundry identity and governs which MCP servers a caller reaches and which tools inside them they can invoke. The Agent Gateway, the newest layer, applies OAuth2, RBAC, and metadata-based policies to every tool invocation and enforces token- or cost-based quotas per agent, workflow, or environment.

The guardrail engine deserves particular credit, because it is documented at a level of specificity most of this market avoids. Guardrails have two axes. Operation mode is either validate — inspect and block — or mutate, which rewrites the data and can also block, with the documented example of a PII guardrail replacing an SSN with REDACTED. Enforcement strategy is enforce (block on violation and on guardrail error), enforce but ignore on error (block violations, fail open if the provider is down), or audit (log only). The hooks are explicit: input mutation runs synchronously before the model request, input validation runs in parallel and cancels the in-flight model call if it fails, and output mutation and validation run synchronously before the response is released. For MCP, mcp_tool_pre_invoke_guardrails and mcp_tool_post_invoke_guardrails check tool arguments before the tool runs and results after it returns.

The provider list is deep on both sides of the build-versus-broker line. TrueFoundry ships built-in guardrails that run on its own infrastructure with no external credentials — secrets detection, PII, content moderation, and prompt injection among them — and integrates sixteen external providers including AWS Bedrock Guardrails, Azure Prompt Shield, CrowdStrike, Patronus AI, and Google Model Armor, plus five deployable wrappers for NVIDIA NeMo, Guardrails AI, Lasso, Arthur AI, and Verra.

Behind all of it sits an actual infrastructure platform — model serving on vLLM, TGI, and Triton, fine-tuning, GPU orchestration with fractional MIG and time slicing, and, since the Seldon AI acquisition announced June 24, 2026, a decade of Kubernetes-native real-time inference tooling. Waxell does none of that and does not try to.

Where does TrueFoundry's perimeter end?

These are consequences of a gateway-centered architecture, not defects, and TrueFoundry documents most of them itself.

Governance is a paid tier, and the useful tier is not the cheap one. TrueFoundry's pricing grid is unusually transparent, which makes the line easy to read. The free Developer plan carries no role-based access control, no budget limiting, no rate limiting, and no Partner Guardrails integration. Pro at $499/month adds all four. SSO, audit logs, org management, custom guardrail hooks, virtual MCP servers, alerts, and GDPR/HIPAA-ready deployments and certificates start at Pro Plus, $2,999/month. VPC and on-prem deployment is Enterprise-only. Price the tier that contains your actual requirements, not the tier on the left.

Output guardrails do not run on streamed responses. TrueFoundry's documentation states this plainly and explains why — output guardrails need the complete response text, and streaming emits chunks as they are generated — with the documented workaround of setting stream to false. Input guardrails are unaffected. It is an honest disclosure, and worth checking against your own product, because token-by-token streaming is a common UX default.

The unit of governance is the call, not the agent. A reverse proxy sees a request. That is what makes its controls unbypassable by application code, and it is also the boundary: the proxy governs the LLM call and the MCP tool invocation, not the agent's decision to make that call, its multi-step plan, or the state it carries between steps. And anything that never traverses the gateway sits outside the perimeter — an agent calling a Python library directly, a coding assistant a developer installed last week, a browser AI extension on a laptop in another office.

Approval flows govern access, not actions. TrueFoundry's MCP Gateway page describes approval flows for controlling which roles can access each MCP server — provisioning-time approval. Across the product and platform pages and the guardrail and MCP documentation reviewed for this comparison, TrueFoundry does not describe a runtime hold that parks an individual destructive tool call for a human, nor tool-description drift detection across versions. Teams for whom either is a requirement should ask TrueFoundry directly rather than infer it from public pages.

What Waxell adds

Waxell starts from the other end. Observe installs with pip install waxell-observe, instruments an agent in two lines of code with no rebuilds, auto-instruments 200+ libraries, and evaluates every run against 50+ policy categories — Audit, Content, Control, Cost, Kill, LLM, Operations, Quality, Rate-Limit, Safety, Scheduling, Compliance, Delegation, Identity, Privacy, Reasoning — at 0.045ms p95 across 1000+ policies. The evaluation happens inside the agent process, so it does not depend on traffic being routed anywhere in particular, and it covers reasoning steps a proxy never sees. Those categories map to OWASP LLM Top 10, NIST AI RMF, ISO 42001, EU AI Act, GDPR, and HIPAA, so the same enforcement that stops a bad action produces the attestation an auditor asks for.

The MCP Gateway covers the ground TrueFoundry's does — one URL per tenant in front of 160+ upstream connectors, three auth modes, 30-second policy propagation — and adds two controls aimed at the specific failure modes of third-party tools: tool descriptions are scanned for prompt injection at fingerprint time, before any agent calls them, and every tool is tracked through a five-state trust model of Pending, Drift, Trusted, Blocked, and Removed, so a server that quietly rewrites its own tool definitions is flagged as drift rather than trusted by inertia. Destructive actions park for a human, with the MCP connection held open during the approval. Offboarding revokes every upstream OAuth grant in one transaction.

Past the request path, Runtime gates each step of financial, clinical, and infrastructure workflows with isolated execution, kill switches at every level, durable checkpoint-and-resume, and US or EU data residency. Endpoints discovers AI across employee machines — 60+ provider domains, signed macOS and Windows agents, MDM-deployable through Jamf, Intune, Kandji, Hexnode, and Mosyle, reading the TLS handshake hostname rather than decrypting traffic, with capture off by default.

Feature comparison

Three scenarios, two different centers of gravity

Scenario: you are standing up model infrastructure and want the gateway in the same platform. TrueFoundry, comfortably. Model serving, fine-tuning, GPU orchestration, 1,600+ models, and a governed gateway from one vendor in your own VPC is a coherent buy, and the Seldon acquisition deepens the inference side further. Waxell does not compete for this.

Scenario: everything your agents do already routes through one gateway, and you want it policed. Either platform works. TrueFoundry's guardrail engine is well documented, its auth model is thorough, and its pricing is published — read the feature grid and confirm which tier carries audit logs, SSO, and the guardrails you need before you budget.

Scenario: your governance has to cover agents you build, assistants you didn't build, and laptops you don't watch. Waxell. Policy evaluates in-process before the step runs across 50+ categories that ship with the platform, the same policy set covers gateway tool calls with drift detection and human holds, Runtime gates high-stakes workflows step by step, and Endpoints finds the shadow AI. One control plane, one audit trail, no routing prerequisite.

When to use TrueFoundry

• You need AI infrastructure and governance from one vendor — model serving, fine-tuning, GPU orchestration, and a gateway in your own cloud.

• Air-gapped or on-prem deployment is a hard requirement and you are buying at the Enterprise tier anyway.

• Your agents already call models and tools through a central gateway, so the request path is a sufficient control point.

• You want a documented guardrail engine with a wide choice of third-party detectors and published, self-serve pricing.

When to use Waxell

• Enforcement has to work whether or not traffic is routed through a gateway — two lines of SDK instrumentation, 200+ libraries, no rebuilds.

• You want 50+ policy categories shipping with the platform and available from the free tier, not gated behind a $499 or $2,999 plan.

• Third-party MCP tools are a real risk surface and you need tool-description injection scanning, five-state drift detection, and human holds on destructive actions.

• Your perimeter includes employee devices and assistants nobody on your team built.

• You want mapped compliance evidence — OWASP, NIST AI RMF, ISO 42001, EU AI Act, GDPR, HIPAA — falling out of the same enforcement that stops the action.

How Waxell handles this: Waxell is an AI control plane where enforcement is the primitive and observability is what enforcement produces. Observe instruments the agents you build in two lines of code, auto-instrumenting 200+ libraries, and evaluates every run against 50+ policy categories at 0.045ms p95 across 1000+ policies — cost ceilings that halt execution, PII redaction, content and safety gates, kill switches — mapped to OWASP LLM Top 10, NIST AI RMF, ISO 42001, EU AI Act, GDPR, and HIPAA so the same enforcement yields an audit you can hand over. The MCP Gateway governs tool calls across 160+ upstream connectors with prompt-injection scanning of tool descriptions at fingerprint time and five-state trust tracking that catches a server silently changing its definitions. Runtime gates each step of workflows where being wrong is expensive, and Endpoints finds the AI running on employee machines. A dashboard after the fact is not governance. It's an autopsy.

FAQ

Is Waxell a TrueFoundry alternative?

For governance, yes. Waxell covers agent instrumentation, execution-level policy enforcement across 50+ categories, MCP tool-call governance with drift detection, and endpoint shadow-AI discovery in one control plane. TrueFoundry is the better choice if you also need the ML infrastructure underneath — model serving, fine-tuning, and GPU orchestration are TrueFoundry products and not Waxell ones. The two overlap heavily on gateway governance and diverge on everything outside the request path.

Does TrueFoundry actually block agent actions, or only monitor them?

It blocks, and the documentation is specific. Guardrails run in either validate mode, which inspects and blocks, or mutate mode, which rewrites data such as redacting PII and can also block. The enforce strategy blocks on violation and on guardrail error; enforce-but-ignore-on-error blocks violations but fails open if a provider is down; audit logs only. For MCP, pre-invoke guardrails check tool arguments before the tool runs. This is one of the more clearly documented enforcement stories in the category, with one stated exception: output guardrails do not run on streamed responses.

What does TrueFoundry cost, and what does each tier include?

TrueFoundry publishes four tiers: Developer at $0 with 50k requests and 3 users, Pro at $499 per month with 1M requests and 10 users, Pro Plus at $2,999 per month with 25 users, and custom Enterprise pricing for 10M+ requests. Role-based access control, budget limiting, rate limiting, and Partner Guardrails integration begin at Pro. SSO, audit logs, org management, custom guardrail hooks, virtual MCP servers, and GDPR/HIPAA-ready deployments begin at Pro Plus. VPC, on-prem, and air-gapped deployment are Enterprise-only.

What is the difference between TrueFoundry's AI Gateway, MCP Gateway, and Agent Gateway?

They are three layers of the same platform. The AI Gateway is the model layer — routing, fallbacks, caching, budgets, and rate limits across 1,600+ models. The MCP Gateway is the tool layer — registering upstream MCP servers, resolving authentication inbound and outbound, and applying RBAC to which servers and tools a caller can reach. The Agent Gateway is the newest layer and applies OAuth2, RBAC, and metadata-based policies to every tool invocation, with quotas scoped per agent, workflow, or environment.

What can Waxell govern that a gateway cannot?

Anything that never crosses the gateway. Waxell's SDK evaluates policy inside the agent process, so it sees reasoning steps and library calls a proxy never observes, and it works without re-routing traffic. Runtime gates individual steps of a durable workflow rather than individual requests. Endpoints governs AI on employee machines — 60+ provider domains across signed macOS and Windows agents, MDM-deployable — which is where assistants nobody on the platform team installed actually run.

Sources

• TrueFoundry, Agent Gateway: A Unified Control Layer For AI Agents in Production — accessed July 30, 2026.

• TrueFoundry, Enterprise MCP Gateway — accessed July 30, 2026.

• TrueFoundry, Enterprise AI Gateway — accessed July 30, 2026.

• TrueFoundry, Pricing — accessed July 30, 2026.

• TrueFoundry Docs, Guardrails: Introduction — accessed July 30, 2026.

• TrueFoundry Docs, Configure Guardrails — accessed July 30, 2026.

• TrueFoundry Docs, MCP Gateway: Authentication and Security — accessed July 30, 2026.

• TrueFoundry, TrueFoundry Acquires Seldon AI to Accelerate Agentic AI Capabilities for Enterprise Customers — June 24, 2026.

Your gateway sees the request. Who is watching the agent? Get started with Waxell.