What Kong AI Gateway actually is
Kong AI Gateway is a set of AI plugins that run on Kong Gateway, the Apache-2.0 API gateway with roughly 44,000 GitHub stars and active development as of August 2026, and on Konnect, Kong's hosted control plane. You can self-host, run your own data planes under Konnect in hybrid mode, or let Kong operate Serverless and Dedicated Cloud Gateways. In every mode you bring your own provider accounts and keys: there is no model marketplace and no unified token billing. The ai-proxy plugin speaks OpenAI-format to 15+ providers, including OpenAI, Azure OpenAI, Anthropic, Bedrock, Vertex AI, Mistral, and self-hosted vLLM or Ollama.
The release pace is fast. From October 2025 to April 2026, versions 3.12 through 3.14 added an MCP proxy with OAuth 2.1 resource-server flows, tool-level ACLs, circuit breakers, dynamic model routing keyed on the request body, and an Agent Gateway governing A2A traffic with RFC 8693 token exchange. Kong governs LLM, MCP, and A2A traffic more broadly than any other gateway we compare against.
Where Kong is genuinely strong
Three things stand out. First, operational maturity: platform teams already know how to run Kong, and a deep catalog of existing plugins for authentication, rate limiting, and transforms composes directly with AI routes. Second, the default privacy posture for self-hosters is strong: prompts flow through data planes you run, payload logging is off by default (log_payloads: false), and Kong documents that Konnect control-plane telemetry carries service-level metrics only, with no customer data. Third, compliance surface: Dedicated Cloud Gateways carry SOC 2 and PCI DSS 4.0, and Konnect offers six control-plane geos (AU, EU, ME, US, IN, SG). If your requirement is that prompts never leave infrastructure you operate, and you have the platform team to run it, self-hosted Kong is a legitimate answer.
The line between free and enterprise
Exactly six AI plugins ship in the Apache-2.0 repo: ai-proxy, ai-prompt-guard, ai-prompt-template, ai-prompt-decorator, and the request and response transformers. The differentiating features sit in the proprietary ai_gateway_enterprise tier: AI Proxy Advanced (the seven load-balancing algorithms, cross-provider fallback, circuit breakers), semantic caching, semantic prompt guarding, RAG injection, and PII sanitization. Free ai-proxy routes one model per route. The semantic features also need infrastructure you provision, meaning Redis/Valkey or Postgres with pgvector plus an embeddings model, and the PII sanitizer requires a separate Docker service pulled from Kong's private registry.
On price, the bases differ from ours, so compare carefully. Konnect Plus (as of August 2026, konghq.com/pricing) meters AI Gateway at $100 per month per unique LLM model, capped at five, on top of control-plane fees of $25 to $500 per month by gateway type and $200 per additional million API requests. Beyond five models you are into custom-priced Enterprise contracts, billed annually. Your model usage bills separately with your providers at your negotiated rates. TrustedRouter pricing for text and embeddings is a per-token fee: provider cost + 5.5% with a $0.01 per million token floor, and no seat or subscription fees. A per-model subscription and a per-token percentage are not comparable without your traffic shape; run your own volumes through both.
What TrustedRouter does differently
The trust model is the load-bearing difference. Kong's answer to who sees your prompts is deployment topology: run the data plane yourself and the question mostly disappears — though the enterprise AI plugins that touch prompts, such as the PII sanitizer and semantic cache, are closed source, so you cannot audit them, and there is no build attestation of what is running. Our answer is evidence on a hosted path: the gateway serving api.trustedrouter.com runs inside TEEs on GCP, AWS, and Azure, each publishing a live attestation endpoint that binds the running build to published source and release digests. A verifier script and Sigstore signatures are at trust.trustedrouter.com, and the boundary is documented at /security. Realtime inference keeps no durable prompt or output logs; what we retain is metadata — ids, model, token counts, latency, cost, region, key hash — listed at /privacy.
The second difference is the marketplace. One key covers 550+ model routes across roughly 49 providers (as of August 2026, live at /models) with prepaid billing, so there are no per-provider accounts to open. Privacy is routable: trustedrouter/zdr restricts to providers with contractual or policy zero-data-retention, trustedrouter/e2e to confidential-compute providers with end-to-end encryption, trustedrouter/eu to EU-focused providers, and per-request preferences compose with any of them.
What we do not claim
Our attestation covers our gateway, not the model providers behind it. Downstream handling rests on contractual and policy commitments we track per provider, except on trustedrouter/e2e routes, where the provider's own confidential-compute and E2EE mechanisms apply. Kong's core is genuinely open source under Apache-2.0; our gateway and control plane are source-available under BUSL-1.1, converting to Apache-2.0 four years after each release, with Apache-2.0 and MIT SDKs. Every line that touches your prompt is public, but the platform is not OSI open source. We are young: our repos went public between late April and early May 2026 and published benchmark history starts in June 2026. We have no published SOC 2 or HIPAA certification today; Kong's Dedicated Cloud Gateways do carry SOC 2 and PCI DSS 4.0. And Kong's MCP and A2A governance — tool-level ACLs, token exchange, agent-traffic policy — goes deeper than anything we ship; we support MCP (docs) but do not offer gateway-level agent-protocol governance.
Moving between them
Kong's AI ingress is already OpenAI-format on routes you defined, so client code mostly repoints the base URL and swaps Kong consumer credentials for TrustedRouter keys; model aliases configured in Kong plugins remap to ids on /models. Gateway-side policy does not travel: semantic caches, prompt guards, RAG injection, per-consumer AI rate limits, and MCP ACLs must be recreated on our side or consciously dropped. A common middle path keeps Kong for non-AI API traffic and points only the AI routes at TrustedRouter as an upstream. Start with one streamed request against trustedrouter/zdr and compare output, latency, provider selection, and billed usage before moving volume.