Smartflow vs. Stacklok: Agent Platform vs. Request Path

Stacklok bills itself as the Kubernetes-native AI agent platform. Its open-source ToolHive "runs every MCP server in an isolated container" and, with an identity provider connected, enforces identity and access policy on each request; Stacklok Enterprise adds a Connector Gateway for MCP tools and an AI Gateway for model calls, all self-hosted in the customer's own cluster. Smartflow enforces policy inline on every model call and MCP tool call routed through it, on the customer's own infrastructure, including air-gapped. Both run inside your boundary and attribute each call to an identity, and they diverge on what happens when a person must decide, what the record is built to prove, and what the model path does when a provider fails.

The short version

Stacklok's ToolHive is an Apache 2.0 runtime for MCP servers, and Stacklok Enterprise builds on it: an approved catalog, a console, a Connector Gateway that governs which tools each caller can use, and an AI Gateway that governs which models they can call and what they spend. Everything runs in the customer's Kubernetes cluster.

Smartflow sits on the request path for the model calls and MCP tool calls routed through it. When policy requires a person, the action pauses until an approver decides, and the record shows who decided.

The differences that decide it are narrow: how a person approves a risky action, what a single record proves to an examiner, and what the gateway does when a model provider stops answering.

Feature Comparison

Both run inside your boundary

Deployment is close to even. Stacklok Enterprise is fully self-hosted and needs an existing Kubernetes environment, and its docs describe an air-gapped install: mirror the chart and images into a private registry, then install from there. Smartflow runs on-premises and air-gapped, Kubernetes-native. A buyer choosing on deployment alone will not find the deciding difference here.

One documented dependency is worth checking. Stacklok's PII and payment-data scanning runs in the cluster, but its prompt injection screening sends user-authored text to an AWS Bedrock Guardrail in the customer's AWS account. A team planning an enclave install should confirm how that screen runs without a route to AWS. Configured with local embeddings and a local model, Smartflow's policy, cache and audit make no call to us or anyone else.

Both products are gateways, so both share the same trade: a call has to be pointed at the gateway.

Who decides, and what the record shows

Stacklok's gateways decide by policy. ToolHive evaluates Cedar policies "on every request, denying anything not explicitly permitted," and a rule can read identity provider claims, groups and tool arguments. Where the logic lives in another system, ToolHive can hand each tool call to a validating webhook that allows or denies it, with a timeout of up to 30 seconds. Mecatl, Stacklok's open-source agent harness, adds a person: an interactive client shows the call and lets the operator allow it once, allow it for the session, or deny it. Its docs note that headless deployments have "no human approval channel," so their access is set before work starts.

In Smartflow, an action that needs a person pauses as an approval ticket: pending until someone with approval rights approves or denies it, redeemed once when the action runs, and expired after 24 hours. With step-up, set per action, the approver re-verifies their identity before the approval counts, and the record shows who decided. A firm that separates duties should ask each vendor who may approve, and how the approver's identity is checked at that moment.

The records differ in what they are built to prove. With audit logging on, Stacklok's gateways write a structured JSON event for each MCP request and each model interaction to standard output, where the customer's log pipeline collects it. AI Gateway events carry the fields NIST SP 800-53 requires under AU-2, AU-3 and AU-8, and they never carry prompts or completions. For MCP events, Stacklok's docs leave retention and tamper evidence to the customer, configured "in your log pipeline and storage." Smartflow's records are hash-chained, carry RFC 3161 timestamps from a public timestamp authority or the customer's own, and are written to the customer's SIEM, with an optional write-once archive in the customer's account. Ask each vendor to show how a third party verifies a single record.

The model path

Stacklok's AI Gateway connects six providers: OpenAI, OpenRouter, Anthropic, Claude on AWS Bedrock, Google AI Studio and Google Vertex AI. It enforces budgets per user and per group, limits which models each caller can use, and retries a failed connection up to twice, always against the same provider. The docs say it has "no failover to a second provider." The legacy gateway, still documented for platforms that run it, supports priority failover. Response caching is not documented.

Smartflow routes and fails over across model providers, including any OpenAI-compatible cloud or local endpoint, with caching on the same gateway that enforces policy.

Where Stacklok is strong

Stacklok's CEO and CTO co-created Kubernetes, and the platform is built for teams that already run it. The platform ships as Helm charts, an operator and custom resources, so MCP servers, registries, authorization policies and gateways are declared and reviewed like any other workload. Stacklok is a maintainer of the official MCP registry and a charter member of the Agentic AI Foundation.

The MCP runtime is the deepest in this comparison. Each server runs in its own container with a permission profile for file system and network access, and the ToolHive CLI turns network isolation on by default. The registry verifies provenance and signs servers, and tool filtering cuts what the model has to read. RFC 8693 token exchange records both the user and the agent acting for them, and a workload can sign in with the identity its platform already issued.

ToolHive is Apache 2.0 and runs without a subscription, and Stacklok says a customer that ends its Enterprise subscription can downgrade to the open-source version at any time. Releases are signed with Sigstore Cosign and ship with SBOMs; Enterprise adds SLSA build provenance, hardened base images and backported security patches. Administrators can switch off either gateway with a kill switch.

For a platform team that wants MCP servers isolated, cataloged and governed by the same identity provider and policy engine as the rest of its Kubernetes estate, Stacklok is a strong choice.

When to choose Smartflow

• A person decides, on the record: the paused action waits for someone with approval rights, step-up re-verifies the approver per action, and the record shows who decided
• A record built for examination: each decision hash-chained, time-stamped under RFC 3161 and written to your SIEM, with an optional write-once archive
• Examination evidence: packages and model inventory for FINRA 3110, HIPAA, SOX and the EU AI Act, generated from enforcement records
• The model path itself: routing, failover and caching across model providers on the same gateway that enforces policy

Running both

The two do different jobs, and a platform team can divide the work between them. ToolHive runs each MCP server in its own container, with a permission profile and network isolation. Smartflow governs the model calls and MCP tool calls routed through it, pauses an action for an approver where policy requires one, and writes the record. APERION has not tested or published a configuration of the two together, so scope any combined deployment with each vendor before planning around it. The cost is two policy surfaces to keep aligned.

Common questions

Is ToolHive open source? Yes, under Apache 2.0. ToolHive Community runs MCP servers locally or on Kubernetes without a subscription. Stacklok Enterprise adds an approved catalog, central access and policy, turnkey Okta and Entra ID integration, the Connector Gateway, the AI Gateway and SLA-backed support.

Can Stacklok run air-gapped? Yes. Stacklok Enterprise is fully self-hosted on Kubernetes, and its docs describe an air-gapped install that mirrors the chart and images into a private registry.

Does Stacklok govern model calls? Yes, through the AI Gateway in Stacklok Enterprise. It serves OpenAI, Anthropic and Gemini client APIs, enforces budgets per user and group, limits which models each caller can use, and screens requests. The current gateway has no failover to a second provider; the legacy gateway, still documented, supports it. Response caching is not documented.

Can a person approve a tool call before it runs? In ToolHive and the gateways, Cedar policy allows or denies each call, and ToolHive can hand the decision to an external webhook. Mecatl, Stacklok's open-source agent harness, can prompt an operator in an interactive client; headless deployments set their access before work starts.

How does ToolHive isolate an MCP server? Each server runs in its own container. A permission profile sets its file system and network access, and with the ToolHive CLI network isolation is on by default, limiting the server to the hosts and ports its profile declares.

Related reading

MCP security · Model Context Protocol · Docker, MCP and containerized tool orchestration · Step-up approval for AI agents · AIDA agent identity guide · Tamper-evident audit log · Examination readiness · Policy as code · Enterprise AI gateway guide · All comparisons

Verified against each vendor's published documentation in November 2026. Vendor capabilities change. If something here is out of date, tell us and we will correct it.

Stacklok sources: stacklok.com and its solutions/gateway, solutions/ai-gateway, solutions/mcp-runtime, industry/financial-services, company, security-center and llm-info pages, and its November 3, 2026 blog post on gateway kill switches; docs.stacklok.com: the Stacklok Enterprise overview, the air-gapped install, the AI Gateway overview, model providers, model routing, prompt injection screening, PCI/PII controls and audit logs, the Connector Gateway overview and audit logs, and ToolHive's Cedar policies, custom permissions, network isolation, webhook authorization, token-exchange delegation and JWT-bearer workload assertions; github.com/stacklok/toolhive and github.com/stacklok/mecatl; and mecatl.dev's permissions documentation.