What is agentgateway?
agentgateway is an open-source proxy written in Rust that sits between AI agents and everything they call: model providers, MCP tool servers and other agents over Google's A2A protocol. Solo.io started it in March 2025, gave it to the Linux Foundation in August 2025, and in June 2026 it became a Growth-stage project of the Linux Foundation's Agentic AI Foundation (AAIF), the body that also hosts MCP.
As an LLM gateway it offers an OpenAI-compatible API in front of OpenAI, Anthropic, Gemini, Bedrock and others, with spend controls, cost tracking, failover and "virtual models" that route by weight, condition or a call to your own routing service. As an MCP gateway it federates several tool servers behind one endpoint, bridges stdio, SSE and Streamable HTTP, turns OpenAPI specs into MCP tools and handles OAuth. Authentication covers JWT, API keys and OIDC, with per-tool authorisation written as CEL policies, plus guardrails, rate limits and OpenTelemetry.
It runs two ways: as a single binary driven by a YAML file and a built-in web UI, or on Kubernetes with its own controller implementing the Gateway API. It began life as the AI data plane for kgateway, Solo.io's CNCF-hosted Envoy gateway; kgateway 2.2 split the two into separate charts and APIs, and the controller now ships from this repository. The whole repository is Apache 2.0. Solo.io sells Solo Enterprise for agentgateway, a hardened build with extra MCP governance features and 24x7 support, at prices given only on request.
Is agentgateway worth it?
agentgateway is the strongest open-source answer to a problem LiteLLM and Bifrost treat as a side feature: governing what agents do with tools, not just which model they call. MCP and A2A are first-class here, with per-tool authorisation in CEL, session-aware MCP routing and OAuth token exchange, and the LLM gateway sits on the same proxy rather than beside it. Neutral governance strengthens the case. The project left Solo.io for the Linux Foundation five months after it was created and joined the AAIF in June 2026, and its announcement counts more than 300 active contributors across more than 60 organisations, including Red Hat, Microsoft and Salesforce.
It is fast by its own account. The project's benchmark against LiteLLM, run against a mock backend, reports 36,933 requests a second at a P99 of 1.97 ms against LiteLLM's 3,198 at 32.19 ms, with agentgateway under 30 MB of memory and LiteLLM near 12 GB; a later round against LiteLLM's Rust mode claims about 36 times the throughput. These measure proxy overhead only and come from the project itself, and LiteLLM publishes different numbers. Even discounted, a Rust proxy on Tokio and Hyper adding sub-millisecond latency is plausible, and it matters more for chatty agent loops than for single chat calls.
The Kubernetes story is its other edge. The controller implements the Gateway API, so teams already routing HTTP with Gateway resources add LLM and MCP backends with the same objects and policies, and v1.7.0 ships Helm charts for the controller, the CRDs and a standalone chart. The cost is history: kgateway 2.2 renamed the controller, moved the APIs to a new agentgateway.dev group and published a migration guide for anyone who ran the earlier integration. Breaking changes still arrive monthly; v1.7.0 on 27 October 2026 turned on MCP session encryption in standalone mode, widened prompt guards to inspect tool output by default, and blocked dynamic backends from loopback and cloud metadata addresses.
The security record is short but pointed. Seven advisories have been published, one rated high: in July 2026 stateful MCP sessions could cross routes and overwrite the authorisation policy, and in October the same flaw class reappeared for MCP guardrails alongside an invalid tool-call ID that bypassed MCP authorisation. That is the feature the project sells, so pin versions and read release notes. Next to LiteLLM, it has less provider breadth and a smaller ecosystem of integrations, about 6,100 stars against roughly 62,000; next to Bifrost it is less a cost dashboard and more a policy engine for agent traffic.
Where it earns its place
A platform team exposing 20 internal MCP servers to coding agents across a 400-person engineering organisation
Give agents one MCP endpoint and decide which teams may call which tools
Federate the servers behind one agentgateway route, authenticate users with OIDC and write per-tool CEL rules, so a support agent can read tickets but not call the deploy tool. Free in the open-source build; pin releases because two 2026 advisories let MCP sessions bypass those rules.
An SRE team already running the Kubernetes Gateway API for HTTP services
Add OpenAI, Anthropic and Bedrock routes with failover without adopting a separate gateway
Install the agentgateway CRD and controller Helm charts, then add LLM backends and AgentgatewayPolicy objects next to existing HTTPRoutes. One control plane and one set of OpenTelemetry traces, at the price of a monthly upgrade cadence with breaking changes.
A head of platform at a bank weighing open source against a vendor contract
Decide whether the free build is enough or Solo Enterprise is worth buying
The open-source build already includes MCP federation, CEL authorisation, guardrails and cost tracking. Solo Enterprise adds a hardened distribution, extra MCP governance and 24x7 support, quoted on request with no published price, so the decision turns on whether you need a support contract more than features.
Before you commit
- Setup
- curl -sL https://agentgateway.dev/install | bash installs the binary; running agentgateway with no config writes ~/.config/agentgateway/config.yaml and serves the UI and API on port 4000, where a wizard adds a model. On Kubernetes, Helm charts from cr.agentgateway.dev install the CRDs and controller.
- Integrations
- OpenAI-compatible chat API in front of OpenAI, Anthropic, Gemini, Bedrock, Perplexity and others; MCP over stdio, SSE and Streamable HTTP plus OpenAPI-to-MCP; A2A; guardrails via OpenAI Moderation, Bedrock Guardrails, Google Model Armor, Azure Content Safety and webhooks; OpenTelemetry metrics, logs and traces; Kubernetes Inference Gateway extensions for self-hosted models.
- Data and privacy
- Self-hosted; prompts go only to the providers and guardrail APIs you configure, and the docs do not mention any telemetry to the project. Since v1.7.0 prompt guards also send tool output to vendor guardrail APIs by default. Seven security advisories published, one high.
- Cost at scale
- The project's benchmark shows the proxy under 30 MB of memory at about 37,000 requests a second, so gateway hardware is rarely the bill; the cost is the operators' time on monthly upgrades. Solo Enterprise is priced per deployment on request.
- Limits
- 313 open issues and pull requests; monthly releases with breaking changes; the earlier kgateway integration needs a migration; fewer providers and third-party integrations than LiteLLM.
What’s good
- MCP, A2A and LLM traffic under one policy engine
- Per-tool authorisation and guardrails written in CEL
- Kubernetes Gateway API controller as well as a single binary
- Apache 2.0 under Linux Foundation governance
What’s not
- Repeated MCP authorisation bypasses in 2026 advisories
- Monthly releases with breaking changes
- Performance numbers are the project's own
- Enterprise pricing not published
Best for
Platform teams on Kubernetes that must put authentication, authorisation and audit in front of MCP tool servers and agents, not only model APIs.
agentgateway alternatives
agentgateway: common questions
- Is agentgateway worth it?
- The gateway to run when agents, tools and models all need one policy layer, especially on Kubernetes, as long as you keep up with a monthly release train and its MCP authorisation fixes. We rate it 4.2 out of 5.
- How much does agentgateway cost?
- Free and open source under Apache 2.0. Solo Enterprise for agentgateway (hardened build, extra MCP governance, 24x7 support) is quoted on request; no price is published.
- What are the downsides of agentgateway?
- Repeated MCP authorisation bypasses in 2026 advisories; monthly releases with breaking changes; performance numbers are the project's own; enterprise pricing not published.
- Who is agentgateway best for?
- Platform teams on Kubernetes that must put authentication, authorisation and audit in front of MCP tool servers and agents, not only model APIs.
- How much does agentgateway cost for a team or in production?
- The project's benchmark shows the proxy under 30 MB of memory at about 37,000 requests a second, so gateway hardware is rarely the bill; the cost is the operators' time on monthly upgrades. Solo Enterprise is priced per deployment on request.
- Is agentgateway safe for company data?
- Self-hosted; prompts go only to the providers and guardrail APIs you configure, and the docs do not mention any telemetry to the project. Since v1.7.0 prompt guards also send tool output to vendor guardrail APIs by default. Seven security advisories published, one high.
- What are the best agentgateway alternatives?
- The closest alternatives we have reviewed are LiteLLM, Bifrost, Portkey AI Gateway and vLLM Semantic Router.
Answers checked Nov 9, 2026.
Make agentgateway? Show this rating on your site
