Managed or self-host Open core

Kong AI Gateway Managed gateway

Name: Kong AI Gateway
Author: Kong Inc.

Kong AI Gateway is a managed LLM gateway with an OpenAI-compatible API in front of 17 upstream providers; it publishes no model count. Its fees are not published. It is open-core, so it can be self-hosted or used as a managed service. SOC 2 is published; zero data retention and a HIPAA BAA are not. You can point it at your own provider accounts. Beyond chat it also serves embeddings.

Last verified August 29, 2026 · 34 of 113 fields dated · 46 sources

Built by Kong Inc., founded 2009 · US company

Compare with others Estimate cost Visit site ↗

Access at a glance

Whether this product can work for you at all, before features matter: who pays the model bill, where it can run, and which of your existing API calls keep working. Every value is the vendor’s own claim, linked to the page it came from.

A routing/governance proxy layered on an API gateway: "Connectivity and governance layer for modern AI-native applications built on top of Kong Gateway" that "routes AI requests to various providers through a provider-agnostic API"; the AI Proxy plugin "lets you transform and proxy requests to a number of AI providers and models" (Kong AI Gateway, AI Proxy plugin).

Who pays the model bill

Your keys only

You contract with each model provider directly and hold those accounts. The gateway never resells inference.

Kong sells software/subscription, not model tokens; credentials are the customer's own provider keys, managed centrally ("Use Konnect Config Store to store and reference your LLM provider API keys", "Centralized AI provider credential management") (Kong AI Gateway, AI Gateway providers). The term "BYOK" itself is not used.

Merchant of record: The upstream provider or cloud, since the customer's own keys/IAM are used (Azure Managed Identity, AWS "IAM credentials or assumed roles") (AI Gateway providers). Kong itself is positioned to help you bill your own consumers: "Meter, bill, and monetize the entire AI connectivity data path… automate invoicing with Stripe or ERP integrations" (Kong AI Gateway).

Key handling: Keys are stored/referenced through Konnect Config Store, or replaced by cloud identity (Azure azure_use_managed_identity, azure_client_id; AWS IAM credentials/assumed roles); request-level API keys or bearer tokens can override static plugin values when config.auth.allow_override is true (Kong AI Gateway, AI Gateway providers, AI Proxy plugin). Because the data plane can be customer-hosted — "Running privately and self-hosted for full control and compliance" — request content need not leave the customer's infrastructure (Kong AI Gateway).

Where it can run

4 of 5 shapes documented

Vendor-hosted
Self-host
Your VPC
On-premise
Air-gapped

Dimmed shapes are not documented by the vendor, which is not the same as unsupported.

Hosted control plane (Konnect SaaS), self-hosted traditional, hybrid, DB-less, and Kubernetes via Kong Ingress Controller — "AI plugins are supported in all deployment modes, including Konnect, self-hosted traditional, hybrid, and DB-less, and on Kubernetes via the Kong Ingress Controller"; an on-prem demo instance is launched with curl -Ls https://get.konghq.com/ai/v1 | bash (Kong AI Gateway). Air-gapped: not documented on pages fetched.

Konnect provides "a unified control plane" while customers "Decide where you want to host your Data Plane nodes, and whether you want Kong to host them or host them yourself" (Kong AI Gateway) — i.e. customer-cloud data planes with a SaaS control plane, plus fully self-managed Kong Gateway. Feature gating is by Kong Gateway version rather than deployment (retries/fallback in load balancing require v3.10+; REST-style responses/files/assistants/batches require v3.11+; native llm_format pass-through requires v3.10+) (Kong AI Gateway, AI Proxy plugin). Provider availability also varies: "Some providers may not be available depending on your Kong Gateway version" (AI Gateway providers).

API surfaces your code can keep using

7 of 7 documented

OpenAI chatPOST /v1/chat/completionsYes *
yes in effect: the plugin accepts requests in "defined and standardized OpenAI formats", uses "the OpenAI format by default", and exposes route type llm/v1/chat mapped to OpenAI Chat completions; the literal /v1/chat/completions path is the customer's own Kong route, not a fixed vendor path (AI Proxy plugin).
Anthropic messagesPOST /v1/messagesYes *
yes as native pass-through: setting config.llm_format to anthropic proxies requests upstream "without payload format conversion"; the literal /v1/messages path is not stated (AI Proxy plugin).
OpenAI ResponsesPOST /v1/responsesYes
Route type llm/v1/responses, mapped to OpenAI "Responses" (v3.11+ for the REST-based full-text responses set) (AI Proxy plugin).
EmbeddingsPOST /v1/embeddingsYes
Route type llm/v1/embeddings (AI Proxy plugin).
ImagesPOST /v1/images/generationsYes
image/v1/images/generations and image/v1/images/edits (plus video/v1/videos/generations) (AI Proxy plugin).
AudioPOST /v1/audio/*Yes *
yes, both: audio/v1/audio/speech (TTS), audio/v1/audio/transcriptions (STT), audio/v1/audio/translations (AI Proxy plugin).
Batch jobsPOST /v1/batchesYes
llm/v1/batches and llm/v1/files support "asynchronous bulk LLM requests" with CRUD via POST/GET/DELETE (v3.11+) (AI Proxy plugin).

An asterisk marks a qualified verdict: support that is indirect (SDK compatibility or provider passthrough rather than a native endpoint), or a gap that is narrower or wider than the label suggests. Read the note before porting.

Not a base-URL-swap SaaS: you configure the plugin on your own Kong routes, then call your gateway with an OpenAI-compatible SDK ("You can combine these parameters with an OpenAI-compatible SDK…") or a provider-native SDK in native llm_format mode (AI Proxy plugin). Native formats supported: anthropic, bedrock, cohere, gemini, huggingface (AI Proxy plugin). Caveats: "some providers don't support all route types"; provider-specific params must go in extra_body; streaming is listed as a supported capability area without further detail (AI Proxy plugin, AI Gateway providers).

How much it reaches

ModelsNot published

Upstream providers17

Providers: Counted from the vendor’s own published list; no aggregate total is published.

n.a.: "Number of models: not mentioned" on the plugin page (AI Proxy plugin); Kong ships no model catalog of its own on pages fetched.

No vendor total stated; the AI Proxy plugin page lists 17 providers (OpenAI, Azure OpenAI, Amazon Bedrock, Anthropic, Gemini, Vertex AI, Cohere, Mistral, Hugging Face, Llama, xAI, Alibaba Cloud DashScope, Cerebras, DeepSeek, Ollama, Databricks, vLLM) and the providers index lists the same 17 names; both pages undated (AI Proxy plugin, AI Gateway providers).

Whose models: Entirely third-party/self-hosted upstreams: Kong routes to "various providers" and "upstream LLMs", including self-hosted models fulfilled "using select supported format transformations" (Kong AI Gateway, AI Proxy plugin). No Kong-operated models.

Your own endpoints: yes in practice: Ollama, vLLM, Llama and Hugging Face are first-class provider options and the plugin explicitly fulfils requests to "self-hosted models" (AI Proxy plugin, AI Gateway providers). A generic "register any private URL" flow is not spelled out on the pages fetched.

How it behaves in production

What happens when an upstream model is slow, wrong, or down — and what you can see and stop while it happens. Reliability features are recorded as where you configure them, not whether the vendor lists them, because almost every product here lists all of them.

5 of 6 reachable from code4 of 4 can block7 documented destinations

When something goes wrong

Each row says where the knob is, not whether the feature is on the marketing page. A control you can only reach by hand in someone else’s dashboard cannot be reviewed or version-controlled.

Request timeoutIn config
Changing it means editing configuration and shipping it, so behaviour is uniform across traffic until you redeploy.
Upstream/service timeouts connect_timeout, read_timeout, write_timeout are configurable, and timeout is a first-class failover condition (Kong AI Proxy Advanced).
RetriesIn config
Key retries, which retries on both error and timeout. Default retry count and backoff strategy are not stated on the fetched pages: n.a. (Kong AI Proxy Advanced).
Fallback to another modelIn config
ORDERED and WEIGHTED are both available — the AI Proxy Advanced plugin's target list supports weight (documented example 70/25/5), and failover is controlled by failover_criteria, which defaults to error and timeout and can add http_429, http_500 and non_idempotent (Kong AI Gateway load balancing, Kong AI Proxy Advanced).
Load balancingIn config
Weights supported (weight on upstream targets). Strategies include lowest-latency with latency_strategy (tpot default, or e2e) and peak-EWMA, plus consistent hashing via hash_on_header (default header X-Kong-LLM-Request-ID) (Kong AI Gateway load balancing).
Upstream health trackingIn config
config_file, and it is a real circuit breaker: from v3.13+ config.balancer.max_fails with config.balancer.fail_timeout ejects a failing upstream for a period (Kong AI Gateway load balancing). Kong Gateway itself lists "health checking" as configurable through the admin API or declarative config (Kong/kong).
Cross-region failoverNot documented
The vendor does not document this, so any behaviour you observe today is unversioned and may change.
not_documented as a named feature. You self-host the data plane wherever you like (Linux, Docker, Kubernetes, or Konnect's managed control plane), but no cross-region failover config is documented (Kong Gateway install).

Fallback chain: Weighted split — Traffic splits by percentage across targets, so you can shift 5% to a new model and watch it before committing.

Kong is the only product here where the LLM-specific reliability config inherits a mature general-purpose proxy stack (upstream entities, retries, circuit breaker, consistent hashing), and the hybrid control-plane/data-plane deployment model is documented (Kong/kong).

How fast the hop is

Interpreted proxy

Runs on an interpreted or JIT runtime (Lua, Python, Node). Overhead is higher than a compiled binary and more sensitive to concurrency, though a Lua-on-nginx proxy and a Python one are far apart.

Repo language breakdown: Lua 89.2%, Perl 5.2%, Raku 3.1% (Kong/kong).

You can run the request path yourselfYes

StreamingYes

Prebuilt deb and rpm packages, official Docker Hub images including a distroless image (AMD64 and ARM64), and Helm charts for Kong Gateway and Kong Ingress Controller (Kong Gateway install).

Streaming caveats: Supported, including WebSocket realtime traffic. Documented caveat: the lowest-latency balancing algorithm is "less suitable for long-lived connections like WebSockets" (Kong AI Gateway load balancing).

This vendor publishes no latency or throughput figure for the routing layer. That is the most common case here, and it is why the architecture class above carries the comparison instead of a number.

No figures published (Kong AI Gateway).

What it will stop

4 of 4 can block

Two separate questions per control: can it stop a request at all, and what does it do before you change any settings? A control that inspects and forwards is a logging feature, however it is named.

Personal data in promptsCan block the request
Out of the box: Blocks out of the box
The AI PII Sanitizer plugin sends payloads to a customer-run ai-pii-service anonymiser covering ~20 categories, replaces matches with placeholders or synthetic values, and can restore originals on the response path; audit logs record ai.sanitizer.pii_identified, pii_sanitized, and per-entity original/redacted pairs (AI Sanitizer plugin, AI audit log reference)
Prompt injection and jailbreaksCan block the request
Out of the box: Blocks out of the box
Kong itself ships regex prompt guarding; injection/jailbreak classification comes from plugged-in services such as Lakera Guard, whose input_block_reason / output_block_reason audit fields record blocked requests (AI audit log reference, Kong AI Gateway)
Harmful contentCan block the request
Out of the box: Blocks out of the box
The AI Azure Content Safety plugin "analyzes the request against configured moderation categories and allows or blocks the request", and does the same for responses; GCP Model Armor input/output block reasons are also logged (AI Azure Content Safety, AI audit log reference)
Your own policiesCan block the request
Out of the box: You pick the action when configuring
ai-prompt-guard takes PCRE allow and deny pattern lists and returns HTTP 400 on a deny match; Azure Content Safety blocklist IDs and per-category thresholds are also configurable (AI Prompt Guard, AI Azure Content Safety)

Where checks runEither, your choice

If the guardrail itself failsNot documented

Almost no vendor in this catalogue documents what happens when the guardrail service itself times out. If the control matters to you, this is a question worth asking before you sign.

not_documented — no fail-open/fail-closed statement on the fetched guardrail plugin pages (AI Azure Content Safety, AI AWS Guardrails reference)

Calls out to: AWS Bedrock Guardrails, Azure Content Safety, Google Model Armor, Lakera. Each is a separate vendor relationship and a separate hop on the request path.

Kong is the clearest example of guardrails as first-class request-path plugins with an audit trail designed for them: every guardrail writes structured block-reason fields into the AI audit log, which is exactly what an auditor wants (AI audit log reference).

What you can see

Exports widely

What gets loggedYour choice

You decide whether bodies are captured, by setting or by header.

You can turn bodies offYes

Payload logging is a plugin config toggle, so metrics can be kept without bodies (AI audit log reference)

TracesOpenTelemetry

OpenTelemetry is native to Kong: the opentelemetry plugin exports OTLP-over-HTTP spans (with AI span attributes and metrics in the AI Gateway) and supports full request-lifecycle tracing (Kong AI Gateway)

AI plugin logging of statistics and payloads is controlled per plugin; Kong's AI audit log records guardrail verdicts and, for the sanitizer, the original and redacted entity values (AI audit log reference)

Where telemetry can go

OpenTelemetry
Prometheus
Datadog
StatsD
HTTP log
Kafka
Loki

OpenTelemetry collectors/OTLP-HTTP endpoints for traces and metrics; Kong's AI audit log is emitted through Kong's logging plugins (Kong AI Gateway, AI audit log reference). A full enumerated destination list was n.a. on the fetched pages.

Records user feedbackNo

Scores live trafficNo

n.a. — No feedback/score API documented (Kong AI Gateway)

n.a. — No eval/online-scoring feature documented (Kong AI Gateway)

Depends on the vendor’s SaaS: No — Kong runs in the customer's infrastructure and exports telemetry to the customer's own OTel/metrics stack (Kong AI Gateway)

Retention: n.a. — Retention is a property of whatever sink the customer ships to; not stated (AI audit log reference)

Whether it fits how you work

How much work stands between you and a first call, how different that is from running it in production, and whether it slots into the stack you already have. Recorded as the shape of the work rather than a number of minutes — how long it takes you depends on which accounts and quota you already hold, which no comparison can know.

to try: cli or containerto run: infrastructure rolloutfits 5 of 10 common stacks

Getting to a first call

3 numbered steps

Shape of the workRun something locally first

Nothing works until you have a process running. Fine on a laptop, but it means there is no zero-install way to try it.

Read off: the vendor’s own quickstart — 3 numbered steps.

Before step one

Your own provider keyRequired
You need an upstream provider account and key before anything works. That is a prerequisite, not a step.
For the documented walkthrough: prerequisites include "OpenAI account and API key" (How to: Get started with AI Gateway); keys can be centralised via "Konnect Config Store to store and reference your LLM provider API keys" (Kong AI Gateway)
Payment methodNot documented
n.a. (not documented). No credit-card, free-tier or trial wording appears on the AI Gateway landing page (Kong AI Gateway); the get-started page refers to "conserve your free trial credits or avoid unnecessary charges" without stating a payment requirement (How to: Get started with AI Gateway)
Gate before models answerNot documented
The docs do not say, so budget for a surprise on the first model you actually want.
n.a. (not documented). No model approval, enablement, quota, or waitlist step appears (How to: Get started with AI Gateway, Kong AI Gateway)

Everything you need first: Konnect personal access token; Kong Gateway Enterprise; decK v1.65.2+; an OpenAI account and API key; a licence for Kong Gateway Enterprise (for the self-managed path). No credit card, cloud account or cluster stated (How to: Get started with AI Gateway)

Running it in production

The same scale applied to the path the vendor recommends for production traffic. Kept separate from the quickstart because for several products here the two are barely related pieces of work.

Shape of the workDeploy it on your infrastructure

This is an infrastructure project, not an integration. Expect charts or Terraform, networking, secrets and someone who owns the deployment.

Getting to production is a step up in kind from the quickstart, not just more of the same.

What production needs: A Konnect personal access token and a Konnect Control Plane plus local Data Plane for the hybrid path, or Kong Gateway Enterprise with a licence exported as KONG_LICENSE_DATA for self-managed; decK v1.65.2+ and cURL. The page refers production users to the Install page and does not itself specify database/Redis/cluster/load-balancer requirements (How to: Get started with Kong Gateway). Planning topics listed include "AI Gateway resource sizing guidelines," "Deployment topologies," and "Hosting options" (Kong AI Gateway)

Can you run it yourself

Install command publishedInstall command published

There is a command you can copy and run, so you can evaluate the self-hosted path yourself today.

curl -Ls https://get.konghq.com/quickstart | bash -s -- -e KONG_LICENSE_DATA (self-managed Enterprise); destroy with curl -Ls https://get.konghq.com/quickstart | bash -s -- -d; the AI-specific demo is curl -Ls https://get.konghq.com/ai/v1 | bash (How to: Get started with Kong Gateway, Kong AI Gateway)

How it fits your stack

5 of 10

Each row is a thing you might already run. “With a caveat” means it works but not the way the vendor’s marketing implies — read the reason, because that is usually where the surprise lives.

With a caveatThe OpenAI SDKOpenAI-compatible paths are documented, but not as a general drop-in.
NoThe Vercel AI SDKNo AI SDK route documented.
NoCloudflare WorkersNo Workers guidance published.
FitsKuberneteskong/ingress and kong/kong from https://charts.konghq.com
FitsTerraform or OpenTofuKong/kong-gateway, konnect, konnect-beta and kong-mesh
FitsAn existing API gatewayThis is that gateway — AI traffic becomes a plugin, not a new hop.
FitsCloud IAM I already runReuses IAM roles, workload identity or managed identities.
With a caveatLangChain or LlamaIndexLangChain only.
FitsMCP servers to governActs as an MCP gateway or registry.
With a caveatNothing — plain Node or PythonYou have to run a process locally before any call works.

Reading this the other way round — pick what you already run and see every product scored against it.

The integration surfaces behind those answers

Vercel AI SDKNot documented
Nothing published. Assume the OpenAI-compatible route and verify it yourself.
n.a. (not documented)
Cloudflare WorkersNot documented
No Workers guidance either way. If you are edge-first, verify fetch-only compatibility yourself.
n.a. (not documented)
KubernetesOfficial Helm chart
A named, published chart. You can read its values file before committing to anything.
Named: kong/ingress and kong/kong from https://charts.konghq.com
Kong provides official Kubernetes Helm charts from https://charts.konghq.com, including kong/ingress and kong/kong. Kong’s Kubernetes integration uses the Kong Ingress Controller; kong/ingress is recommended for new installations, while kong/kong supports hybrid and unmanaged Kong instances. (Kong Helm charts)
TerraformOfficial Terraform provider
You can manage this product as first-class Terraform resources, versioned on the Registry.
Named: Kong/kong-gateway, konnect, konnect-beta and kong-mesh
Kong documents the official Terraform providers konnect, konnect-beta, kong-gateway, and kong-mesh. The Terraform Registry provider source for the Kong Gateway provider is Kong/kong-gateway; the registry documentation states that Terraform 0.13+ is required. (Kong Terraform documentation)
Existing API gatewayIt is the API gateway
This product is the gateway. If you already run it for your other APIs, AI traffic becomes a plugin rather than a new hop.
Kong AI Gateway is implemented through Kong Gateway plugins, including AI Proxy and AI Proxy Advanced, with a minimum Kong Gateway version of 3.6. The AI MCP Proxy is an additional Kong Gateway plugin for connecting Kong-managed services to MCP, available from Kong Gateway 3.12 and supporting hybrid, DB-less, and traditional topologies. (Kong AI Gateway overview)
Cloud identityReuses your cloud identity
Authenticate with the identity you already run — IAM roles, workload identity or managed identities. No long-lived key to rotate.
Kong documents Azure authentication through an Azure Compute resource’s Managed Identity or User-Assigned Identity, configured with config.auth.azure_use_managed_identity and optionally config.auth.azure_client_id. Amazon Bedrock authentication can use AWS IAM credentials or assumed roles. (Kong AI provider documentation)
MCPMCP gateway or registry
It sits in front of many MCP servers and governs access to them. This is the shape you want if MCP sprawl is the problem you are solving.
Kong’s AI MCP Proxy bridges MCP and HTTP, supports MCP tool discovery and invocation, proxies MCP requests, aggregates tools, and can convert REST API paths into MCP tools. Kong also provides mcp-konnect, an MCP server with tools for querying analytics and managing Konnect resources, usable with MCP clients such as Claude Desktop and Cursor. (Kong AI MCP Proxy plugin)

Python frameworks

LangChain

Kong documents LangChain integration using the langchain-openai package and the ChatOpenAI class. Custom tools use langchain_core.tools and its tool decorator; LlamaIndex is not documented. (Kong LangChain integration guide)

First-party client libraries None — you call it with an OpenAI-compatible client in whatever language you like

The documentation explicitly names the OpenAI SDK and Gemini SDK. The LangChain guide documents Python usage of langchain-openai and ChatOpenAI; official Kong client-library names and a broader supported-language list are not documented. (Kong AI provider documentation)

Agent features: Kong documents function calling and custom tool use, including Gemini function declarations, OpenAI llm/v1/chat function calling, and LangChain bind_tools usage. AI Gateway also provides an A2A traffic gateway for securing, governing, and observing agent-to-agent traffic. (Kong AI Gateway overview)

AI features are Kong Gateway plugins: "You can enable the AI Gateway features through a set of modern and specialized plugins," and the landing page instructs "Run the Kong Gateway quickstart and enable the AI Proxy plugin." Configuration is applied with decK state piped to deck gateway apply; Kong Gateway version shown is 3.15.0.5. Config tooling spans AI Gateway editor, decK, Terraform, KIC, Admin API, and Control Plane Config API (Kong AI Gateway, How to: Get started with Kong Gateway)

Kong AI Gateway supports Konnect, self-hosted traditional, hybrid, and DB-less deployment modes, and Kubernetes deployment through the Kong Ingress Controller. Kong also documents fully self-hosted deployments on cloud, bare metal, containers, or Kubernetes, alongside Konnect’s managed SaaS control plane. (Kong AI Gateway overview)

Silence in the docs: 4 of the integration questions on this card have no published answer either way. That is recorded as undocumented, not as a no — but it does mean you would be verifying it yourself.

What it does well

Battle-tested NGINX/OpenResty core with 44k GitHub stars and a decade of production plugin patterns
Deep AI feature set: semantic caching and routing, RAG injector, prompt templates, MCP and A2A gateways
Strong data-protection tooling: PII sanitizer across 20 categories and 9 languages, plus Azure/AWS/GCP/Lakera guardrail integrations
Clear compliance posture: SOC 2 Type 2, GDPR, CCPA, PCI DSS, CSA STAR Level 1, NIST 800-218
Reuses existing Kong auth, rate limiting, logging and OpenTelemetry pipelines for LLM traffic

Where it falls short

No pricing transparency: Plus is quoted per gateway per month with no published amount and Enterprise is custom
Plus caps the AI Gateway at 5 unique LLM models, pushing broader model access to Enterprise
Its headline performance advantage comes from a Kong-run benchmark against mock LLMs; a third-party guide says independent tests show far smaller gaps
Third-party reviews report the free OSS build lacks semantic caching, analytics and compliance features

Choose it when

Enterprises already standardized on Kong for API management that want AI traffic governed by the same gateway, plugins and ops tooling.

Look elsewhere when

You want a lightweight LLM-first proxy with published prices and hundreds of models available out of the box without an enterprise contract.

Managed gateway: A hosted control plane in front of the models: routing, caching, guardrails, spend limits, and logs. You trade a little simplicity for governance.

How hard is it to leave?

Derived from six published facts, not from an opinion. The weights are fixed and the same for every product — see the arithmetic.

100/100Easy to leave

Portability score breakdown for Kong AI Gateway
What helps you leave	Points	Source
Works with standard OpenAI codeSwitching away is a base-URL change rather than a rewrite of every call site.	22/22	vendor page
No vendor-specific SDK requiredA proprietary client library spreads through your codebase and has to be torn out again.	10/10	vendor page
Can use your own provider accountsYour keys and billing relationship stay yours, so removing the gateway does not cut off model access.	20/20	vendor page
Can be self-hostedYou can run it yourself instead of accepting a pricing or policy change.	20/20	—
Configuration lives in version controlRouting and budget rules are a file you keep, not dashboard state you would have to rebuild.	16/16	vendor page
Your request history can be exportedYou leave with your own logs instead of abandoning them.	12/12	vendor page

All six inputs are published, so this is scored against the full 100. This measures technical switching cost only. It does not price the engineering time to re-test prompts against a different routing stack.

Full specification

Every field we track. Blank fields say "Not published" rather than "No" — we do not infer an absence from silence. Switch to Technical in the header for the precise field names and the low-level details.

Overview

What kind of product Category: Managed gateway Not verified; Marketplaces resell many providers behind one key. Gateways add governance on top. Open-source projects you run yourself. Cloud platforms are hyperscaler surfaces. Inference providers host models on their own hardware.
Who runs it Deployment model: Managed or self-host Not verified; Managed means the vendor operates it. Self-host means you run it on your own infrastructure. Both means you can choose.
Licence Licence: Open core Verified 3 days ago; Proprietary products cannot be inspected or forked. Open licences such as MIT and Apache-2.0 let you audit, modify, and run the code without permission.
Company Company: Kong Inc. Verified 3 days ago; The organisation that maintains the product.
Who you would be signing with Vendor status: Independent company Not verified; Whether the product is still an independent company, has been acquired, is a large cloud vendor’s product line, is run by a software foundation, or has been put into maintenance mode. Maintenance mode means bug fixes and security patches only — no new features.
Last shipped an update Latest release: 2026-08-26 Not verified
Kong Gateway 3.14.0.14. The open-source Kong/kong repository moves more slowly: latest tag 3.9.3 on 17 June 2026.; The date of the most recent release or version tag. A product that has not shipped in a year is a different risk from one that shipped last week, regardless of what its marketing site says.
GitHub stars GitHub stars: 44,100 Verified 3 days ago; A rough proxy for community size on open-source projects. Not a quality measure.

Cost

Markup on model prices Token markup: Not published Not verified; How much the product adds on top of what the underlying model provider charges. Zero means you pay the same per-token price you would pay the model provider directly.
Fee to add funds Credit purchase fee: Not published Not verified; A percentage charged when you top up your balance, separate from token prices. It is easy to miss because it does not appear on the per-token price list.
Monthly cost per person Seat fee: Not published Not verified; A recurring per-user platform charge that applies regardless of how much you use the models.
Can use your own provider accounts BYOK supported: Yes Verified 3 days ago; Bring Your Own Key: you keep direct contracts with OpenAI, Anthropic and others, and the gateway only routes traffic. This preserves negotiated rates and committed-spend discounts.
Cost of using your own accounts BYOK terms: You supply your own upstream LLM credentials, stored centrally in Kong's config store; Kong charges for gateways, not tokens. Not verified; What the product charges to route traffic through your own provider keys.
Free tier Free tier: 30-day Konnect free trial with enterprise functionality; separately, Kong Gateway core is Apache-2.0 and free to self-host. Verified 3 days ago; What you can do without paying, useful for evaluation.
Enterprise plan from Enterprise plan from: Not published Not verified; Annual entry price for the enterprise tier, where one is published or credibly reported.
Cost to run it yourself Self-host cost: Kong Gateway core is Apache-2.0 and self-hostable at infra cost only. The Plus plan is billed per gateway per month with the amount not published; fully self-hosted gateways plus audit logs and SSO require the custom-priced, annually billed Enterprise plan. Third-party reviews note the OSS build lacks semantic caching, analytics and compliance features found in Enterprise. Verified 3 days ago; What self-hosting actually costs once you account for infrastructure and any paid tier.
How the vendor makes money Pricing model: Flat monthly platform fee Not verified; The shape of the vendor’s bill: does the routing layer charge a percentage on top of tokens, a flat monthly fee, both, neither (because inference is the product), or nothing at all (open source with no paid tier).
How pricing works, briefly Pricing model detail: Flat per-gateway platform fee (Konnect Plus, no dollar figure published) + enterprise-only annual quote. Kong does not resell inference. Plans billed on a calendar month basis in arrears. Not verified; A one-paragraph description that covers the caveats a pricing category cannot: introductory rates, per-feature meters, tier gating, and pricing that resets on a specific date.
Minimum commitment Minimum commitment: Enterprise 'billed annually' with duration set out in the individual Order Form; no minimum amount stated. Plus is monthly. Not verified; Whether the vendor requires a minimum contract term, a minimum spend, or a provisioned-capacity purchase to get its published rate.
Charges that fire after you go over an allowance Overage terms: No metered overage billing published. Plus enforces soft limits via email + in-app notifications prompting you to reduce usage or upgrade. Not verified; The line items that scale with usage after an included allowance is exhausted — log storage, extra requests, per-feature meters, data export — which is where cost estimates usually go wrong.
Prompt cache offered Cache mechanism: Semantic cache Not verified; Whether the gateway offers its own response cache, what kind of match it does (exact request, prefix, semantic), or simply passes provider caching through unchanged.
Discount on cached input Cache-read discount: Not published Not verified; How much cheaper cached tokens are than fresh input, when the vendor publishes a single figure. Bundled-inference clouds usually price this per model instead of as one number.
Premium on cache writes Cache-write premium: Not published Not verified; How much more the first write of a cached prefix costs versus a plain input token. A high write premium and a low hit rate can leave you paying more than you save, so this matters as much as the read discount.
Who captures the cache saving Cache economics: Semantic caching included in Plus under 'Cost Control'. Exact-match and provider passthrough not stated. Kong prices no tokens, so semantic cache hits save on the customer's provider bill; cached requests may still count toward Plus request/analytics limits. Not verified; Whether the customer keeps the full saving from caching or the vendor captures part of it — and any conditions attached (write premium, storage fees, best-effort hits).
What you can split spend by Cost attribution: Plus includes 'AI Observability: token-level tracking and real-time cost analytics'. Per key/user/team/tag/customer splits not stated. Not verified; The dimensions the vendor documents for splitting spend — per key, per user, per team, per tag, per customer. Matters if you need to chargeback internally or bill an end customer.
How you get cost data out Cost export: None stated on the pricing page. Not verified; The mechanisms the vendor publishes for exporting cost and usage data: CSV, an API, webhooks, S3, a data warehouse, or nothing at all. Any per-unit price is included.
Who pays the model bill BYOK mode: Your keys only Not verified; Whether you bring your own provider accounts (BYOK), buy inference from this vendor, or can do either. This is the single biggest commercial difference between these products: it decides who holds the contract with the model provider and who carries the spend.

Spend governance in detail

Seven signals matter when a bill starts to hurt: who can spend, how much, on what, and who gets paged when it goes wrong. Everything below is drawn from the vendor’s own pricing and docs pages — how we read these.

Virtual or scoped keysNot published
Keys that carry their own budget and rate-limit policy, so an intern experiment cannot spend against a production budget.
Not stated.
Budget caps per keyNot published
A dollar or token ceiling attached to an individual key. Where enforcement is soft, one over-limit request still completes before the block kicks in.
Not stated.
Budget caps per team or workspaceNot published
A ceiling applied at a higher scope than one key — a team, a workspace, a customer, or an entire environment.
Not stated.
Rate limiting as a cost controlYes — plus
Configurable request-per-time-window caps. Platform-set rate limits do not count as spend controls; user-configurable ones do.
Token-based rate limiting, enforced pre-request, included in Plus.
Model allowlistsNot published
A policy that constrains which models a key or team can call, keeping expensive frontier models out of the wrong hands.
Not stated. Nearest published control is 'LLM access control and auth' plus a 5-unique-model Plus ceiling.
Spend alertsNot published
Alerts fired as spend approaches a threshold. Alerts that only fire after the meter has rolled over are marked as such.
Not stated (only resource-limit email/in-app notices).
Webhook notificationsNot published
Programmatic notifications on spend events, so budget breaches can page an on-call or open a ticket.
Not stated.

Enforcement:Enforced before each request

Catalog

Models available Models available: Not published Not verified; How many models you can call, shown as a range because several vendors publish different totals on different pages. Vendor-reported either way, so counts are not directly comparable — some count every provider variant of the same model separately.
Model providers reachable Upstream providers: 17 Not verified; How many distinct model providers or labs you can reach, shown as a range where the vendor’s own pages disagree. More providers usually means better redundancy when one has an outage.
Works with standard OpenAI code OpenAI-compatible API: Yes Verified 3 days ago; If yes, you can usually switch to it by changing one base URL, and switch away just as easily. This is the main defence against lock-in.
OpenAI chat endpoint POST /v1/chat/completions: Yes Not verified; The endpoint almost every application ports first. "Not documented" means the vendor never states it, which is different from a documented no.
Anthropic messages endpoint POST /v1/messages: Yes Not verified; Whether Anthropic-shaped calls work without rewriting them. Several products support this only as SDK compatibility or provider passthrough rather than a native endpoint — the detail page says which.
OpenAI Responses endpoint POST /v1/responses: Yes Not verified; The newer stateful OpenAI surface. Support is much thinner across this market than chat completions.
Embeddings endpoint POST /v1/embeddings: Yes Not verified; Whether you can generate vectors through the same gateway, or need a second integration for retrieval workloads.
Image generation endpoint POST /v1/images/generations: Yes Not verified; Whether image models are reachable through the same surface as text.
Audio endpoints POST /v1/audio/*: Yes Not verified; Speech-to-text and text-to-speech. Frequently the first gap in an otherwise complete gateway.
Batch jobs endpoint POST /v1/batches: Yes Not verified; Asynchronous bulk processing, usually at a discount. Commonly undocumented, and commonly the reason a migration stalls late.
Needs the vendor’s own code library Requires a vendor-specific SDK: No Verified 3 days ago; A proprietary client library spreads through your codebase and has to be torn out again if you leave. “No” is the better answer here, and it means the standard OpenAI client works.
You can export your request history Logs / usage data export: Yes Verified 3 days ago; Whether you can get your own request logs, traces, or usage records back out — through an API, a bulk export, or a download. Decides whether you leave with your history or abandon it.
Settings can live in version control Declarative config-as-code: Yes Verified 3 days ago; Whether routing, fallback, and budget rules can be declared in a file you keep in Git, rather than existing only as settings clicked into a hosted dashboard.
Embeddings Embeddings: Yes Verified 3 days ago; Text-to-vector models, needed for search and retrieval features.
Image generation Image generation: Not published Not verified; Whether image models are reachable through the same interface.
Speech and audio Speech and audio: Not published Not verified; Text-to-speech or transcription models through the same interface.
Video generation Video generation: Not published Not verified; Whether video models are reachable through the same interface.
Batch processing Batch processing: Not published Not verified; Submitting large jobs for cheaper, slower processing. Often 50% off for work that is not time-sensitive.

Routing & reliability

Uptime it promises in writing Contractual SLA uptime: 99.9% Not verified; The uptime percentage in a published, contractual service level agreement. A public status page is not an SLA — it reports what happened, it does not promise anything or pay you back when it breaks.
Automatic failover Automatic failover: Yes Verified 3 days ago; When a model provider goes down or rate-limits you, traffic moves to a backup automatically instead of returning errors to your users.
Load balancing Load balancing: Yes Verified 3 days ago; Spreads requests across several providers or keys to raise your effective rate limit.
Rule-based routing Conditional routing: Yes Verified 3 days ago; Send different requests to different models based on rules — for example a cheap model for free users and a strong model for paying ones.
Response caching Response caching: Not published Not verified; Reuses the answer when the exact same request comes in again, which cuts both cost and latency.
Similar-question caching Semantic cache: Yes Verified 3 days ago; Reuses an answer when a new question means roughly the same thing as an earlier one. Saves far more than exact-match caching but can return subtly wrong answers if tuned loosely.
Where you set the timeout Request timeout surface: In config Not verified
Upstream/service timeouts `connect_timeout`, `read_timeout`, `write_timeout` are configurable, and timeout is a first-class failover condition ([Kong AI Proxy Advanced](https://developer.konghq.com/plugins/ai-proxy-advanced/)).; Where a request timeout can be set: per request, in a config file, in the vendor dashboard, or nowhere. Nine of the twenty products documented here do not describe a request timeout at all, so the worst case of a hung upstream call is unknowable from the docs.
Where you set retries Retry policy surface: In config Not verified
Key `retries`, which retries on both error and timeout. Default retry count and backoff strategy are not stated on the fetched pages: `n.a.` ([Kong AI Proxy Advanced](https://developer.konghq.com/plugins/ai-proxy-advanced/)).; Where retry count and backoff are configured. Worth knowing alongside billing: a retried streaming call can be charged more than once.
Where you set fallbacks Fallback surface: In config Not verified
ORDERED and WEIGHTED are both available — the AI Proxy Advanced plugin's target list supports `weight` (documented example 70/25/5), and failover is controlled by `failover_criteria`, which defaults to error and timeout and can add `http_429`, `http_500` and `non_idempotent` ([Kong AI Gateway load balancing](https://developer.konghq.com/ai-gateway/load-balancing/), [Kong AI Proxy Advanced](https://developer.konghq.com/plugins/ai-proxy-advanced/)).; Where the fallback chain is defined. Almost every product claims fallback; the useful question is whether you can change it from code or only by hand in a dashboard.
Shape of the fallback chain Fallback shape: Weighted split Not verified; An ordered list tries targets in sequence; a weighted split sends a percentage of traffic to each, which is what you need to trial a new model on 5% of requests. Weighted splits are much rarer than the marketing implies.
Upstream health tracking Health checks / circuit breaking: In config Not verified
`config_file`, and it is a real circuit breaker: from v3.13+ `config.balancer.max_fails` with `config.balancer.fail_timeout` ejects a failing upstream for a period ([Kong AI Gateway load balancing](https://developer.konghq.com/ai-gateway/load-balancing/)). Kong Gateway itself lists "health checking" as configurable through the admin API or declarative config ([Kong/kong](https://github.com/Kong/kong)).; Whether the product notices a failing upstream and stops sending traffic to it, and whether you can tune the thresholds. This is what turns a provider outage into a blip rather than a sustained error rate, and only four of the twenty expose it.
Cross-region failover you control Multi-region failover surface: Not documented Not verified
`not_documented` as a named feature. You self-host the data plane wherever you like (Linux, Docker, Kubernetes, or Konnect's managed control plane), but no cross-region failover config is documented ([Kong Gateway install](https://developer.konghq.com/gateway/install/)).; Whether you can define what happens when a region degrades. A vendor running many regions is not the same as a vendor letting you configure failover between them; only three document a user-controlled mechanism.
Where you set load balancing Load balancing surface: In config Not verified
Weights supported (`weight` on upstream targets). Strategies include lowest-latency with `latency_strategy` (`tpot` default, or `e2e`) and peak-EWMA, plus consistent hashing via `hash_on_header` (default header `X-Kong-LLM-Request-ID`) ([Kong AI Gateway load balancing](https://developer.konghq.com/ai-gateway/load-balancing/)).; Where traffic distribution across upstreams or keys is configured.

Operations

Usage dashboards and logs Observability: Yes Verified 3 days ago; Built-in visibility into what was sent, what came back, what it cost, and how long it took.
Spending limits Budget controls: Not published Not verified; Hard caps that stop spend before it becomes a surprise invoice. The single most valuable control for a small team.
Rate limits Rate limits: Yes Verified 3 days ago; Caps on request volume per key or per user, useful for protecting against abuse and runaway loops.
Separate keys per team or app Virtual keys: Not published Not verified; Issue scoped keys with their own budgets and permissions so you can attribute cost and revoke access without rotating everything.
Prompt versioning Prompt management: Yes Verified 3 days ago; Store and version prompts outside your code so they can be changed without a deploy.
Quality testing Evals: Not published Not verified; Built-in tooling to score model output against test cases, so you can tell whether a model swap made things better or worse.
MCP support MCP support: Yes Verified 3 days ago; Native support for the Model Context Protocol, the emerging standard for connecting models to external tools.
What gets logged Logged content: Your choice Not verified
AI plugin logging of statistics and payloads is controlled per plugin; Kong's AI audit log records guardrail verdicts and, for the sanitizer, the original and redacted entity values ([AI audit log reference](https://developer.konghq.com/ai-gateway/ai-audit-log-reference/)); Whether full prompts and responses are stored, only metadata, or nothing. Full-body logging is the most useful debugging feature here and the one most likely to need a conversation with your compliance team.
You can turn logging off Body-logging opt-out: Yes Not verified
Payload logging is a plugin config toggle, so metrics can be kept without bodies ([AI audit log reference](https://developer.konghq.com/ai-gateway/ai-audit-log-reference/)); Whether prompt and response bodies can be suppressed while still keeping usage metrics. Nineteen of the twenty document a way to do this; the mechanisms range from a per-request header to an organisation-wide setting.
Traces you can take elsewhere Distributed tracing: OpenTelemetry Not verified
OpenTelemetry is native to Kong: the `opentelemetry` plugin exports OTLP-over-HTTP spans (with AI span attributes and metrics in the AI Gateway) and supports full request-lifecycle tracing ([Kong AI Gateway](https://developer.konghq.com/ai-gateway/)); Whether the product emits OpenTelemetry, a proprietary format, or nothing. OpenTelemetry means the traces land in the tooling you already run instead of only in the vendor’s dashboard.
Where telemetry can go Export destinations: OpenTelemetry, Prometheus, Datadog, StatsD, HTTP log, Kafka, Loki Not verified
OpenTelemetry collectors/OTLP-HTTP endpoints for traces and metrics; Kong's AI audit log is emitted through Kong's logging plugins ([Kong AI Gateway](https://developer.konghq.com/ai-gateway/), [AI audit log reference](https://developer.konghq.com/ai-gateway/ai-audit-log-reference/)). A full enumerated destination list was `n.a.` on the fetched pages.; Documented sinks for logs and metrics. This is a good proxy for how replaceable the vendor’s own dashboard is: around twenty destinations means you never have to depend on it, while a CSV download means you do.
Can record user feedback Feedback capture API: No Not verified
`n.a.` — No feedback/score API documented ([Kong AI Gateway](https://developer.konghq.com/ai-gateway/)); Whether there is an API to attach a rating or score to a logged request, which is what lets production traffic feed quality work later.
Scores live traffic Online eval hooks: No Not verified
`n.a.` — No eval/online-scoring feature documented ([Kong AI Gateway](https://developer.konghq.com/ai-gateway/)); Whether automated scorers can run against real production requests, rather than only against a test set you assemble yourself.

Performance

Delay it adds Proxy overhead: 12 ms Verified 3 days ago; Extra time the product itself adds to each request, on top of however long the model takes. Usually irrelevant next to multi-second model latency, but it matters for high-volume or streaming-sensitive workloads.
Requests per second ceiling Throughput: 8,200 rps Verified 3 days ago; Published sustained request rate before the product becomes the bottleneck. Only relevant at genuinely high volume.
What the request path runs on Architecture class: Interpreted proxy Not verified
Repo language breakdown: Lua 89.2%, Perl 5.2%, Raku 3.1% ([Kong/kong](https://github.com/Kong/kong)).; The comparable way to talk about latency here. An edge worker, a compiled Go or Rust binary, and a Python proxy have different overhead floors no matter which figures each vendor publishes. Products that never disclose their runtime are recorded as undisclosed rather than assumed.
You can run the request path yourself Self-hostable data plane: Yes Not verified
Prebuilt `deb` and `rpm` packages, official Docker Hub images including a distroless image (AMD64 and ARM64), and Helm charts for Kong Gateway and Kong Ingress Controller ([Kong Gateway install](https://developer.konghq.com/gateway/install/)).; Whether the component that actually carries your prompts can run on your own infrastructure. Distinct from a vendor offering a self-hosted control plane while still proxying traffic through their network.
Streaming responses Streaming support: Yes Not verified
Supported, including WebSocket realtime traffic. Documented caveat: the lowest-latency balancing algorithm is "less suitable for long-lived connections like WebSockets" ([Kong AI Gateway load balancing](https://developer.konghq.com/ai-gateway/load-balancing/)).; Whether token-by-token streaming is documented. The caveats matter more than the yes: some products cannot cancel a stream without still being billed, and several timeout and fallback mechanisms stop applying once the first token has been sent.

Security & compliance

Does your prompt reach their servers Prompt transits vendor: Depends how you deploy it Not verified
The data plane is yours to run, or Kong-hosted as serverless or dedicated cloud gateways. Konnect's control plane is Kong-hosted in a geography you pick.; Whether the text you send passes through this company’s own infrastructure. If it does, every other promise on this page is a policy commitment rather than a physical impossibility. Self-hosted products can answer no outright.
What they keep if you change nothing Logging default: Nothing stored by default Not verified
The AI Proxy plugin ships with statistics and payload logging both set to false, so nothing about your prompts is recorded until you turn it on and point it at a sink you own.; Defaults matter more than options. A product that stores full prompts and replies unless you find the right header will have stored them by the time you read the docs.
How long they keep it Default content retention (days): 30 days Not verified
Thirty days for Konnect analytics and seven for audit logs. Prompt bodies are not retained at all unless you enable payload logging.; Default retention for request content, in days. Zero means nothing is kept. Read the note: several products keep nothing as a rule but make timed exceptions for abuse review or specific models.
Could they train on your prompts Training on customer data: Not published — silence, not a no Not verified
Nothing on the trust center or subprocessor page addresses training.; Whether the vendor may use your prompts and outputs to train models. “Not published” means we could not find any position, which is not the same as a no — ask for it in writing.
Where it runs, and what you can pin Region and residency control: Konnect control-plane geographies in Australia, the EU, the Middle East, the US, India and Singapore, with dedicated data planes across roughly 17 AWS, 13 Azure and 11 Google regions. Self-hosted and on-premises data planes are supported. Not verified; Which regions are offered and whether you can force processing to stay in one. A global endpoint that silently picks a region is a different compliance story from an endpoint you pin yourself.
Where safety filters run Guardrail execution location: In your own infrastructure Not verified
The PII sanitizer calls an anonymizer service you run yourself, typically in a Docker container, so redaction happens inside your boundary.; A filter that strips personal data only helps if it runs before the data leaves your boundary. If guardrails execute in the vendor’s cloud, the vendor has already received whatever you wanted redacted.
Who else touches the data Subprocessor list: https://konghq.com/legal/subprocessors Not verified; The published list of third parties the vendor passes your data to. No list means you cannot know the full chain, which most data-protection agreements require you to.
SOC 2 audited SOC 2 audited: Yes Verified 3 days ago; An independent audit of security controls. Enterprise buyers and their procurement teams routinely require it.
Will sign a HIPAA agreement HIPAA BAA: Not published Not verified; Required before you may send protected health information through the service. Without a signed BAA, healthcare data is off limits.
GDPR commitments GDPR commitments: Yes Verified 3 days ago; Published data processing terms for handling personal data of people in the EU and UK.
Can keep data in the EU EU data residency: Not published Not verified; Requests can be processed inside the EU rather than routed to US infrastructure. Often the deciding constraint for European customers.
Does not retain your data Zero data retention: Not published Not verified; Prompts and responses are not stored after the request completes. Sometimes a paid add-on rather than the default.
Strips personal data PII redaction: Yes Verified 3 days ago; Detects and removes identifiers such as names, emails, and card numbers before the request reaches the model provider.
Content guardrails Content guardrails: Yes Verified 3 days ago; Policy checks on inputs and outputs — blocking unsafe content, enforcing formats, or catching prompt-injection attempts.
Runs fully disconnected Air-gapped deployment: Not published Not verified; Can be deployed in a network with no internet access, which some regulated and defence environments require.
Blocks personal data in prompts PII / DLP enforcement: Can block the request Not verified
The AI PII Sanitizer plugin sends payloads to a customer-run `ai-pii-service` anonymiser covering ~20 categories, replaces matches with placeholders or synthetic values, and can restore originals on the response path; audit logs record `ai.sanitizer.pii_identified`, `pii_sanitized`, and per-entity original/redacted pairs ([AI Sanitizer plugin](https://developer.konghq.com/plugins/ai-sanitizer/), [AI audit log reference](https://developer.konghq.com/ai-gateway/ai-audit-log-reference/)); Whether personal data detection sits on the request path and can stop the call, merely inspects and forwards it, or is not documented. A control that only reports is a logging feature, not a policy control.
Blocks prompt injection Injection / jailbreak enforcement: Can block the request Not verified
Kong itself ships regex prompt guarding; injection/jailbreak classification comes from plugged-in services such as Lakera Guard, whose `input_block_reason` / `output_block_reason` audit fields record blocked requests ([AI audit log reference](https://developer.konghq.com/ai-gateway/ai-audit-log-reference/), [Kong AI Gateway](https://developer.konghq.com/ai-gateway/)); Whether injection and jailbreak detection can stop a request. Most products offering this call a partner classifier rather than shipping their own.
Blocks harmful content Toxicity / moderation enforcement: Can block the request Not verified
The AI Azure Content Safety plugin "analyzes the request against configured moderation categories and allows or blocks the request", and does the same for responses; GCP Model Armor input/output block reasons are also logged ([AI Azure Content Safety](https://developer.konghq.com/plugins/ai-azure-content-safety/), [AI audit log reference](https://developer.konghq.com/ai-gateway/ai-audit-log-reference/)); Whether hate, violence, sexual and self-harm categories are checked inline and can stop a request, in either direction.
Your own policy rules Custom policy hooks: Can block the request Not verified
`ai-prompt-guard` takes PCRE allow and deny pattern lists and returns HTTP 400 on a deny match; Azure Content Safety blocklist IDs and per-category thresholds are also configurable ([AI Prompt Guard](https://developer.konghq.com/plugins/ai-prompt-guard/), [AI Azure Content Safety](https://developer.konghq.com/plugins/ai-azure-content-safety/)); Whether you can add your own rule — a regex, a webhook, or your own classifier — rather than choosing from the vendor library.
Where guardrails run Guardrail execution location: Either, your choice Not verified; Whether guardrail evaluation happens inside your infrastructure or on the vendor’s servers. This decides whether the prompt you are trying to protect leaves your network in order to be checked.
If the guardrail itself fails Guardrail failure mode: Not documented Not verified
`not_documented` — no fail-open/fail-closed statement on the fetched guardrail plugin pages ([AI Azure Content Safety](https://developer.konghq.com/plugins/ai-azure-content-safety/), [AI AWS Guardrails reference](https://developer.konghq.com/plugins/ai-aws-guardrails/reference/)); What happens when the guardrail service times out or errors: does the request proceed unchecked, or is it blocked? This is the worst-documented field in the entire catalogue — only two vendors state it plainly, which means most teams are running a control whose failure behaviour they cannot know.
Third-party guardrail vendors Guardrail integrations: AWS Bedrock Guardrails, Azure Content Safety, Google Model Armor, Lakera Not verified; Named external guardrail services the product can call. A long list means the product is a router for policy engines rather than a policy engine itself — which also means another vendor bill and another hop.

Compliance evidence

Graded by how strong the evidence is, not whether the word appears on the vendor’s website. An audited report and a marketing claim are different things, and only one of them will satisfy your own auditor.

SOC 2 Certified Type 2, via trust center
ISO 27001 Not published
GDPR DPA Certified listed on the trust center
HIPAA BAA Not published
FedRAMP Not published
ITAR Not published

Vendor source

Fit & integration

Work to try it Evaluation work shape: Run something locally first Not verified; The shape of the work on the vendor’s own quickstart, from swapping one base URL through to deploying infrastructure. An ordinal class rather than a duration, because elapsed time depends on accounts and quota we cannot see.
Work to run it Production work shape: Deploy it on your infrastructure Not verified; The same scale applied to the vendor’s recommended production path. For several products this is much heavier than the quickstart, which is exactly why both are recorded.
Steps on the quickstart Numbered quickstart steps: 3 Not verified; A literal count of numbered steps on the vendor’s quickstart, recorded as evidence beside the work shape. Zero means the page publishes no numbered procedure at all. Large counts usually mean interleaved language tracks rather than more work.
Can you self-host it today Self-host install documentation: Install command published Not verified
`curl -Ls https://get.konghq.com/quickstart | bash -s -- -e KONG_LICENSE_DATA` (self-managed Enterprise); destroy with `curl -Ls https://get.konghq.com/quickstart | bash -s -- -d`; the AI-specific demo is `curl -Ls https://get.konghq.com/ai/v1 | bash` ([How to: Get started with Kong Gateway](https://developer.konghq.com/gateway/get-started/), [Kong AI Gateway](https://developer.konghq.com/ai-gateway/)); Whether an install command is actually published. Several products advertise self-hosting while publishing no command to start from, which a plain yes/no would hide.
Works with the OpenAI SDK OpenAI SDK drop-in: Partly Not verified
Kong documents connecting the LangChain OpenAI adapter without code changes. The documented setting is `base_url=f'{kong_url}/{kong_route}'`, with `kong_url="http://127.0.0.1:8000"`, `kong_route="gpt4o"`, and `api_key="NONE"` or a Kong consumer key. ([Kong LangChain integration guide](https://docs.jp.konghq.com/gateway/latest/ai-gateway/llm-library-integration-guides/langchain/)); Whether an existing OpenAI-compatible client can be pointed at it by changing the base URL and key.
Vercel AI SDK support AI SDK provider package: Not documented Not verified
n.a. (not documented); Whether a first-party AI SDK provider package exists, or only a community package, a documented workaround, or the generic OpenAI provider pointed at a custom base URL.
Python framework integrations Documented Python frameworks: LangChain Not verified
Kong documents LangChain integration using the `langchain-openai` package and the `ChatOpenAI` class. Custom tools use `langchain_core.tools` and its `tool` decorator; LlamaIndex is not documented. ([Kong LangChain integration guide](https://docs.jp.konghq.com/gateway/latest/ai-gateway/llm-library-integration-guides/langchain/)); LangChain, LangGraph, LlamaIndex and similar orchestration frameworks with a documented integration.
Callable from Cloudflare Workers Cloudflare Workers support: Not documented Not verified
n.a. (not documented); Whether the docs show calling this product from your own Worker. Deliberately separated from the several products whose own gateway runs on Workers, which is a fact about their infrastructure and not about your edge compatibility.
Kubernetes install Helm chart availability: Official Helm chart Not verified
Kong provides official Kubernetes Helm charts from `https://charts.konghq.com`, including `kong/ingress` and `kong/kong`. Kong’s Kubernetes integration uses the Kong Ingress Controller; `kong/ingress` is recommended for new installations, while `kong/kong` supports hybrid and unmanaged Kong instances. ([Kong Helm charts](https://charts.konghq.com/)); Whether a named, published Helm chart exists, versus Helm being referenced with no chart named, versus generic cluster documentation that has nothing to do with this product.
Terraform support Terraform provider or modules: Official Terraform provider Not verified
Kong documents the official Terraform providers `konnect`, `konnect-beta`, `kong-gateway`, and `kong-mesh`. The Terraform Registry provider source for the Kong Gateway provider is `Kong/kong-gateway`; the registry documentation states that Terraform 0.13+ is required. ([Kong Terraform documentation](https://developer.konghq.com/terraform/)); Whether you can declare this in code: an official provider, official modules, resources inside a hyperscaler’s provider, a community provider, or only Terraform code shipped in a repo.
Reuses your cloud identity Cloud IAM reuse: Reuses your cloud identity Not verified
Kong documents Azure authentication through an Azure Compute resource’s Managed Identity or User-Assigned Identity, configured with `config.auth.azure_use_managed_identity` and optionally `config.auth.azure_client_id`. Amazon Bedrock authentication can use AWS IAM credentials or assumed roles. ([Kong AI provider documentation](https://developer.konghq.com/ai-gateway/ai-providers/)); Whether you can authenticate with IAM roles, workload identity or managed identities instead of another long-lived API key. Distinguished from products that only accept static upstream provider credentials.
Fits behind your API gateway API gateway integration: It is the API gateway Not verified
Kong AI Gateway is implemented through Kong Gateway plugins, including **AI Proxy** and **AI Proxy Advanced**, with a minimum Kong Gateway version of `3.6`. The **AI MCP Proxy** is an additional Kong Gateway plugin for connecting Kong-managed services to MCP, available from Kong Gateway `3.12` and supporting hybrid, DB-less, and traditional topologies. ([Kong AI Gateway overview](https://developer.konghq.com/ai-gateway/)); Whether AI traffic can go through a gateway you already run, and who documented that — the product’s vendor or the gateway’s.
MCP support MCP surface shape: MCP gateway or registry Not verified
Kong’s AI MCP Proxy bridges MCP and HTTP, supports MCP tool discovery and invocation, proxies MCP requests, aggregates tools, and can convert REST API paths into MCP tools. Kong also provides `mcp-konnect`, an MCP server with tools for querying analytics and managing Konnect resources, usable with MCP clients such as Claude Desktop and Cursor. ([Kong AI MCP Proxy plugin](https://developer.konghq.com/plugins/ai-mcp-proxy/)); Which kind of MCP support this is: a gateway that governs many MCP servers, a hosted MCP server you connect to, MCP tools accepted inside the completion API, or client tooling. These are different products behind one acronym.
Needs your own provider key Upstream provider key required: Required Not verified
Yes for the documented walkthrough: prerequisites include "OpenAI account and API key" ([How to: Get started with AI Gateway](https://developer.konghq.com/ai-gateway/get-started/)); keys can be centralised via "Konnect Config Store to store and reference your LLM provider API keys" ([Kong AI Gateway](https://developer.konghq.com/ai-gateway/)); Whether an upstream provider account and key must exist before your first call works. A prerequisite rather than a step, and it can differ between the hosted and self-hosted forms of the same product.
Gate before models work Model access gate: Not documented Not verified
n.a. (not documented). No model approval, enablement, quota, or waitlist step appears ([How to: Get started with AI Gateway](https://developer.konghq.com/ai-gateway/get-started/), [Kong AI Gateway](https://developer.konghq.com/ai-gateway/)); Whether an enablement click, a quota grant, a paid tier or an approval form stands between a valid key and a working model call.
Official client languages First-party client SDK languages: Not published Not verified
The documentation explicitly names the **OpenAI SDK** and **Gemini SDK**. The LangChain guide documents Python usage of `langchain-openai` and `ChatOpenAI`; official Kong client-library names and a broader supported-language list are not documented. ([Kong AI provider documentation](https://developer.konghq.com/ai-gateway/ai-providers/)); Languages with a first-party client library. An empty list can still mean the product is usable from any language via an OpenAI-compatible SDK.

How pricing actually works

Kong Gateway core is Apache-2.0 and self-hostable at infra cost only. The Plus plan is billed per gateway per month with the amount not published; fully self-hosted gateways plus audit logs and SSO require the custom-priced, annually billed Enterprise plan. Third-party reviews note the OSS build lacks semantic caching, analytics and compliance features found in Enterprise.

Common questions

Answered from the fields above, so these move when the catalog moves. Every figure quoted here appears in the specification with its source.

Does Kong AI Gateway charge a markup on model prices?

Kong AI Gateway does not publish a token markup figure.

Can Kong AI Gateway be self-hosted?

Yes. Kong AI Gateway can be run on your own infrastructure or used as a managed service. The licence is Open core.

Is Kong AI Gateway SOC 2 audited, and will it sign a HIPAA BAA?

A SOC 2 report is available for Kong AI Gateway but it does not publish a HIPAA business associate agreement. It offers a GDPR data processing agreement. Each of these is linked to the vendor's own page in the compliance section below.

Does Kong AI Gateway retain your prompts?

Kong AI Gateway does not publish a zero-data-retention position. Whether prompt and response bodies are logged is configurable. Logging can be turned off. Stated retention is 30 days.

Can you use your own provider keys with Kong AI Gateway?

Yes. Kong AI Gateway can route through your own accounts with the underlying model providers, so inference is billed to you directly. You supply your own upstream LLM credentials, stored centrally in Kong's config store; Kong charges for gateways, not tokens.

How many models does Kong AI Gateway support?

Kong AI Gateway publishes no total model count. It reaches 17 upstream providers. No total model count is published; the Konnect Plus plan caps the AI Gateway at 5 unique LLM models, with more available on Enterprise.

Official links

44,100 GitHub stars — a proxy for community size, not for quality.

Independent coverage

Third-party analysis, walkthroughs and operator threads. We link criticism as readily as praise. Nothing here is written or published by the vendor, by a competitor listed on this site, or by an SEO content farm — how we vet these.

Written reviews and analysis 2

Kong's updated AI Gateway helps to secure AI model production deployments SiliconANGLE · Apr 2025 Independent coverage of AI Gateway 3.10's RAG injector and PII-sanitization plugins and what they mean for teams putting model traffic through Kong in production.
Kong's new open source AI Gateway makes building multi-LLM apps easier TechCrunch · Feb 2024 Trade-press analysis of the AI Gateway launch, explaining how Kong bolted multi-LLM routing, credential management and request/response transformers onto its existing gateway.

Video 1

KONG AI GATEWAY | MODEL ABSTRACTION YouTube - Rajib Deb · Dec 2025 Independent engineer configures Kong AI Gateway from scratch, wires up OpenAI/Anthropic/Azure providers, and shows load balancing, the prompt-decorator plugin and analytics.

Practitioner discussion 2

LiteLLM alternatives after prod outage, anyone running TrueFoundry or Kong for 3+ months? Reddit - r/LLMDevs · Jul 2026 9-comment thread from teams evaluating Kong as a LiteLLM replacement after a multi-hour routing outage, with operators reporting real cluster sizes and upgrade pain.
Migrating Away from the Kong Enterprise Stack Reddit - r/kubernetes · May 2026 15-comment postmortem of a Kong Enterprise/Kong Mesh exit: shockingly high CPU/memory under API-key rate limiting and ~$70k/year saved after a month-long migration to Envoy Gateway.

What has changed here

Aug 29, 2026 catalog entry catalog entry Not published Added to the catalog source ↗

See this in the full changelog Back to top ↑

Read the head-to-head

These pairs have a written verdict, not just a table.

Kong AI Gateway vs Apache APISIX AI Gateway Read the verdict → Kong AI Gateway vs Portkey Read the verdict →

Usually weighed against

Kong AI Gateway vs Braintrust Gateway Compare → Kong AI Gateway vs Helicone Compare → Kong AI Gateway vs Orq.ai Router Compare →