Pomerium: MCP vendor profile
Pomerium is an identity-aware proxy that puts internal or third-party MCP servers behind one gateway, runs downstream OAuth 2.1 and upstream OAuth for them, and limits tool calls by policy, as documented by the vendor. Pomerium service accounts let CI pipelines and autonomous agents call MCP tools as a specific user without an interactive login (www.pomerium.com).
At a glance
| Type | Gateways and proxies |
|---|---|
| Also covers | auth provider |
| Home | www.pomerium.com |
| Price | per user per month |
| Read | 5 November 2026 |
What it does for this layer
Pomerium places internal MCP servers behind its gateway so external clients such as Claude, ChatGPT and VS Code can reach them, handling authentication, authorization and TLS termination (www.pomerium.com). Pomerium authenticates the user through the organisation's identity provider with downstream OAuth 2.1 and manages the upstream OAuth flow, caching and refreshing tokens and injecting them into proxied requests (www.pomerium.com). Pomerium's upstream OAuth pipeline supports pre-registered credentials for providers such as GitHub and Google and full auto-discovery via RFC 9728 for MCP servers that advertise their own metadata (www.pomerium.com).
Pomerium Policy Language has an mcp_tool criterion that matches tool names by exact name, prefix, suffix or list, so admins can block patterns such as admin_* tools (www.pomerium.com). Pomerium logs every MCP tool call with the method, tool name and parameters (www.pomerium.com). For local development, ssh -R 0 pom.run exposes a local MCP server over HTTPS through Pomerium (www.pomerium.com).
Pomerium pricing lists Zero Personal free and Zero Business at 9 USD per user a month (7 USD billed annually), with Enterprise for self-hosting both planes (www.pomerium.com).
Products and plans
| Product | What it does | Price |
|---|---|---|
| Pomerium Zero | Managed control plane with the data plane in the customer's environment. | per user per month; from 9 USD; Zero Personal free; Business 9 USD per user a month (source, as of 5 November 2026) |
| Pomerium Enterprise | Self-hosted control and data planes. | price not read |
Standards
| Standard | Part of it | Status | What the page says | Source |
|---|---|---|---|---|
| MCP | protected resource metadata | Supports | Auto-discovers upstream servers via RFC 9728. | www.pomerium.com |
| MCP | OAuth 2.1 for clients | Supports | Downstream OAuth 2.1 through the identity provider. | www.pomerium.com |
Checks on its own domain
| Check | Domain | Result | Scanned | Method |
|---|---|---|---|---|
| Ora cached score | pomerium.com | 59 of 100, grade C | 30 August 2026 | how it was taken |
| Cloudflare agent-readiness scan | pomerium.com | 20 of 100, L1 Basic Web Presence; 3 of 15 counted checks passed | 5 November 2026 | how it was taken |
What it does not do
- Pomerium runs no MCP server code for customers; the servers stay on the customer's own infrastructure or the third party's.
- Pomerium is not a public directory of MCP servers.