MCP Server Pricing in 2026: Managed vs Self-Hosted vs DIY — Real Cost Comparison

The TL;DR

Three deployment models, three cost profiles. Modeled 1-year TCO for a representative mid-size org (100 engineers, moderate MCP usage, Okta IdP already in place):

Honest headline: managed SaaS wins on TCO for most orgs, despite the highest sticker. The reason is engineering-time cost, which dominates every other line item. The exception is a security-regulated org that must self-host anyway for compliance reasons — where self-hosted via a mature OSS gateway is the clean pick.

The three deployment models

Before pricing, name what each actually is. These aren't marketing categories; they're three different ways to put an MCP gateway between your AI clients and your MCP servers.

Managed SaaS is a hosted service (Diagrid Catalyst, Lyzr Governance, Cloudflare MCP Gateway, Kong Konnect) where the vendor runs the gateway and the governance tooling. You configure policy; they run infrastructure. Billing is typically per-user, per-call, or a mix.

Self-hosted is an open-source gateway (Kong AI Gateway OSS, community MCP gateways) that you deploy on your own infrastructure. You pay for compute, storage, bandwidth, your engineering time, and (optionally) a support contract. License itself is free; everything else isn't.

DIY from scratch is building the gateway yourself — your engineering team writes the approval catalog, scoping engine, EMA integration, audit pipeline. Rarely the right call anymore (the gap between "good enough OSS" and "rebuild it yourself" is wide) but included for completeness because some teams still choose it.

All three solve the same problem (route AI client traffic to MCP servers with approval, scoping, enforcement, audit — see our governance checklist). They solve it with wildly different cost profiles.

What actually costs money

The honest TCO calculation adds up six line items. Different approaches shift the weight between them but none of them disappears.

Engineering time dominates. A single senior engineer in a US metro is ~$200K fully loaded (salary, benefits, equipment, overhead); in London or Dublin, similar; in Berlin or Toronto, ~$150K; in Rawalpindi, Bangalore, or Jakarta, ~$30-50K. The TCO numbers below assume US fully-loaded engineering cost; adjust proportionally for your region.

The hidden-cost reality: a $70K/year SaaS subscription that saves 0.5 FTE of engineering ($100K) is net positive. Most governance SaaS falls into this shape, which is why "managed is more expensive" is almost always wrong when you count engineering time honestly.

Managed SaaS pricing (October 2026)

The main hosted options and their pricing shapes. Public pricing where available; estimated where it's custom (noted).

Three patterns worth noticing:

Diagrid and Lyzr are purpose-built for MCP governance and command the highest sticker because they ship the full governance stack (approval catalog, scoping, EMA integration, audit) out of the box.

Cloudflare's MCP Gateway is dramatically cheaper because it's a thin layer over Cloudflare Workers — good value if you're already a Cloudflare shop and willing to assemble governance tooling around it.

Kong Konnect sits in the middle — mature API gateway bones plus MCP support — and makes sense for orgs already running Kong for traditional API management.

Expect prices to drop 20-30% through 2027 as competition intensifies; expect the floor for "serious enterprise MCP governance" to settle around $50-80K/year by end of 2027.

Self-hosted pricing

Open-source gateways carry zero license cost; everything else isn't free. Realistic cost structure for a 100-engineer mid-size org:

• Gateway software: Kong AI Gateway OSS or community MCP gateway — $0 license.
• Compute infrastructure: 3-5 moderately-sized instances (production, staging, failover) — $1,200-3,000/mo on AWS/GCP/Azure for a 100-engineer load profile.
• Storage & bandwidth: Audit logs, request/response storage, egress — $300-800/mo.
• Observability (SIEM pipeline): Datadog, Splunk, or self-hosted ELK for the log destination — typically already paid for in a mid-size org, marginal MCP addition $500-1,500/mo.
• Engineering time (ongoing): 0.3 FTE for maintenance, upgrades, policy changes, incident response. At US fully-loaded cost, $60K/year.
• Optional commercial support: Kong Konnect-managed support or similar — $10K-30K/year for a 100-engineer org, often worth it.

Rolled up: ~$68K/year for a 100-engineer org, dominated by the 0.3 FTE engineering line. Add $20K if you take commercial support; add another $30K/year for a dedicated security engineer if your compliance posture requires it.

DIY pricing (building it yourself)

DIY looks cheap on a spreadsheet because the big-ticket items (license, SaaS subscription) are zero. It's almost never cheap in reality because engineering time is enormous.

Realistic breakdown for a 100-engineer org building its own MCP governance stack:

• License: $0.
• Infrastructure: Similar to self-hosted — ~$18K/year.
• Initial build (year 1): Approval catalog, scoping engine, EMA integration, audit pipeline, admin UI — a solid 1.5 FTE for 6 months = ~$150K.
• Ongoing maintenance (year 1+): Keeping up with spec changes (2026-07-28 won't be the last revision), supporting new providers, patching security issues — 1.0 FTE = $200K/year.
• Audit tooling and SIEM integration: You build it — $25K/year infrastructure plus the engineering already counted.

Rolled up: ~$280K year 1, ~$220K year 2+. DIY only makes sense if you have specific requirements no vendor can meet or regulatory constraints that preclude both managed and OSS.

TCO: 20-engineer team

Small shop, light-to-moderate MCP usage, no dedicated security team.

At 20-engineer scale, managed is the obvious winner by a wide margin. Even if you're a technical team that could self-host, the opportunity cost of 20-30 engineering days a year on gateway maintenance is bigger than the subscription saved.

TCO: 100-engineer team (the baseline case)

Mid-size org, moderate MCP usage across many servers, existing Okta/Entra IdP.

Managed still wins at 100-engineer scale, but the gap to self-hosted narrows. The decision at this size usually isn't cost — it's whether you have the engineering bandwidth and whether your security team is comfortable with vendor data flow.

TCO: 500-engineer organization

Large org, heavy MCP usage, strong security requirements, dedicated platform team.

At 500-engineer scale the picture inverts: self-hosted catches up and overtakes managed on year-2+ run-rate. The reason is subscription scaling — per-user and per-call charges grow linearly with the org, while self-hosted engineering cost doesn't. Beyond ~400 engineers, self-hosted via a mature OSS gateway is typically the cheaper path if your security team is set up for it.

DIY stays expensive at every scale. The only time DIY wins is when regulatory constraints forbid both managed and OSS gateways in your environment — a narrow case.

Hidden costs people forget

Four line items that get missed in first-draft TCO calculations and usually show up by month 6.

IdP integration time. EMA (Enterprise-Managed Authorization) is now standard, but wiring your IdP (Okta, Entra, Workspace) to a new gateway takes real IT and security time — typically 40-80 hours of combined admin and engineering effort regardless of which gateway you pick. Budget it.

Shadow-server migration. Every org with existing MCP usage has shadow servers running outside governance. Discovering, inventorying, and either formalizing or shutting them down is 2-6 weeks of focused work. Managed vendors sometimes help; self-hosted leaves it entirely on you.

Audit log storage growth. MCP tool calls produce a lot of logs. At 100 engineers with moderate usage, expect ~500GB/year of audit data. SIEM license costs that scale with volume (Splunk especially) can add $20-50K/year that nobody budgeted.

Vendor spec drift. The MCP spec itself is evolving (2026-07-28 was the latest major revision as of this writing). Managed vendors absorb this cost; self-hosted and DIY teams inherit it. Expect 2-4 weeks of engineering per major spec revision to update your deployment — roughly one annually right now.

Decision framework

The right choice depends on three questions. Answer them in order.

Q1: Is your org regulated such that data flowing through a third-party gateway is forbidden? If yes, self-hosted or DIY. Managed is off the table regardless of cost.

Q2: If managed is on the table, is your team under 300 engineers? If yes, managed is almost always the right pick on TCO once you count engineering time honestly. Default to Diagrid or Lyzr for governance-first needs; Cloudflare if you're already on CF and willing to assemble governance around it; Kong Konnect if you're already running Kong.

Q3: If you're over 300 engineers or regulated-away from managed, do you have the platform team to run OSS infrastructure? If yes, self-hosted (Kong AI Gateway OSS or community MCP gateway) with optional commercial support. If no, consider managed anyway even if the sticker is higher, because unmaintained self-hosted gateway infrastructure becomes a liability.

DIY from scratch only enters the picture for the narrow case of "regulated, large, with highly specific policy requirements no vendor meets." If you're outside that triangle, DIY is almost certainly the wrong call.

FAQ

Are these numbers accurate for my specific org?

Directionally yes, exactly no. US fully-loaded engineering cost is the biggest variable — adjust proportionally for your geography. Vendor pricing changes quarterly; always get a current quote. The ratios between the three approaches hold more consistently than the absolute dollar amounts.

Where does the per-call cost actually hurt?

Heavy agentic workloads (always-on background agents, orchestration layers calling 10+ tools per request). At the 100-engineer baseline with mostly-interactive usage, per-call costs are a small line item. If your org is running a 24/7 autonomous agent fleet, re-model with your actual call volume — Diagrid or Lyzr can get expensive fast at million-calls-per-day scale, where self-hosted catches up sooner.

Does Enterprise-Managed Authorization change this math?

Yes, slightly — EMA (standardized June 2026, see our EMA deep dive) means every major managed vendor now integrates with Okta, Entra, and Workspace natively. For orgs with existing EMA-capable IdPs, managed vendors look even better because the integration time drops. For orgs still on legacy IAM, the IdP upgrade cost gets added either way.

Can I start managed and migrate to self-hosted later?

Yes, and this is a common path. Start managed at year 1-2 when you're learning your usage patterns and policy needs; migrate to self-hosted at year 3+ when you've stabilized and are over the scale threshold where self-hosted pays off. Most managed vendors offer policy-export so your scoping config transfers.

What about the open-source governance tools (Diagrid's free tier, Lyzr Community Edition)?

Both exist and are usable for small-scale internal use. The feature gaps vs the paid tiers are typically audit retention, SSO integration depth, and enterprise support. For a 5-20 engineer team self-serving, free tiers work. For anything with real production MCP usage and real audit requirements, plan for paid.

Is Cloudflare's cheap pricing a trap?

Not a trap, but a different product. Cloudflare's MCP Gateway is a thin layer over Workers; you get the routing and the auth, but less of the governance tooling (approval catalog, scoping admin UI, enterprise audit dashboards). If your team is comfortable assembling those pieces around the gateway, the cost savings are real. If you want them turnkey, pay for Diagrid or Lyzr.