Envoy AI Gateway vs Kong AI Gateway

Why

Both of these are AI layers bolted onto a general-purpose gateway rather than standalone products, so the first question is who owns the layer underneath. Kong AI Gateway is a set of Kong Gateway plugins — AI Proxy and AI Proxy Advanced, minimum Kong Gateway 3.6, with AI MCP Proxy from 3.12 — on a Lua and OpenResty data plane whose repository carries 44,100 stars. Envoy AI Gateway is an extension server and ext_proc filter on top of Envoy Gateway, which its own goals document calls "an additive layer", with 1,987 stars on the AI Gateway repository itself. The star gap is a gap between a decade-old API gateway and a project that reached 1.0 in June 2026, not between two comparable communities.

The commercial shapes are opposites and the pricing is where it bites. Kong is open core with a Konnect SaaS control plane, customer-hosted or Kong-hosted data planes, and a flat per-gateway platform fee whose amount is not published; Enterprise is a custom annual quote, the free entry point is a 30-day Konnect trial, and the Plus tier caps the AI Gateway at five unique LLM models, which pushes any real multi-model deployment into an Enterprise conversation. Third-party reviews also report that the free Kong build lacks semantic caching, analytics and compliance features, so the Kong you can install for nothing is not the Kong being described. Envoy AI Gateway has no pricing page and no account: there is no sign-up or billing step anywhere in the install path, and the managed product built on the same data plane is Tetrate Agent Router Service, sold separately and appearing in the project's own documentation only as one more upstream provider you can route to.

That difference propagates straight into the compliance columns, and it is the reason this pair resolves cleanly. Kong publishes SOC 2 Type 2 and a GDPR DPA on its trust center, a 99.9% uptime SLA, a subprocessor list, and 30-day retention for Konnect analytics with seven days for audit logs. Envoy AI Gateway publishes none of that, and its record explains why rather than apologising: SOC 2 is not published because the project is software you run yourself, no DPA or controller-processor language exists because the project never receives your data, and no BAA is possible because there is no vendor service to sign one with. If your procurement process needs a counterparty, that is a disqualification and no amount of engineering quality fixes it. If your procurement process is your own cluster, it is the entire point.

On features, the asymmetry runs the other way, and it is stark. Envoy AI Gateway has no content guardrails at all — no PII, moderation, injection or custom-evaluator surface appears anywhere in its documentation — and no gateway-side cache; its prompt caching is passthrough of Anthropic-style cache_control breakpoints, minimum 1,024 cacheable tokens and at most four breakpoints, so any discount is the provider's. Kong ships the AI PII Sanitizer across roughly 20 categories against an anonymiser service you run yourself, regex prompt guarding, integrations with Azure Content Safety, AWS Bedrock Guardrails, Google Model Armor and Lakera, semantic caching, prompt templates and asynchronous batch endpoints, and it writes structured block-reason fields into an AI audit log built for exactly that. What Envoy gives back is 19 provider configurations against Kong's 17, an unusually wide endpoint surface for an infrastructure project, OpenTelemetry GenAI metrics you scrape yourself, and a v1beta1 control-plane API with an explicit promise not to break it. If you want the Apache-2.0 licence and a cache and guardrails, Higress is the entry to read instead.