Kong is a software company that builds the gateways and control plane organisations use to connect, secure and govern traffic between applications, APIs, event streams, large language models and AI agents. Its users are platform and API teams that need consistent authentication, rate limiting, guardrails and observability across every service they expose or consume.
The problem it solves is sprawl. As organisations add internal services, partner APIs, streaming platforms and now AI models and agents, each connection tends to get its own security and monitoring. Kong gives them one place to set those rules, managed through the Kong Konnect platform.
At A Glance
| Vendor | Kong Inc. |
|---|---|
| Category | API, AI and event gateway, service mesh and API management |
| Identities covered | API consumers, applications, services, MCP clients and AI agents |
| Deployment | SaaS (Konnect), self-hosted and hybrid |
| Agentic AI | AI Gateway, MCP tooling, MCP OAuth2 and A2A traffic controls |
| Customers | Vanguard, Cigna, TELUS, BMW, United Airlines |
| Funding | Series E of $175 million at a $2 billion valuation |
| Market classification | Application Security; also Authorisation |
What Kong Does
Every call between an application and an API, a service and another service, or an agent and a model, needs the same controls: who is calling, how often they may call, what they may send and what happened. Kong puts those controls in a gateway that sits in the traffic path, so teams set them once instead of building them into every service. The same model now extends to AI: a model call or an agent’s tool call is treated as one more kind of traffic, governed by the same policies as an API request. Kong reports more than 1 trillion API and AI requests a day running through the platform.
Products
Kong Konnect
Konnect is the SaaS control plane for organisations that want to manage the whole API and AI lifecycle, from design through monetisation, in one place. It brings together Gateway Manager, Cloud Gateways, Mesh Manager, the Developer Portal, analytics, Service Catalog, API observability, metering and billing, and Context Mesh. Control plane groups give separate teams isolated access to their own runtime infrastructure. The Developer Portal publishes APIs and services to internal developers and external agents.
Kong Gateway
Kong Gateway is the open-source API gateway at the centre of the portfolio, released under the Apache 2.0 licence with an enterprise licence for self-hosted use. It handles routing, authentication, rate limiting with sliding window controls, and traffic control on an NGINX-based engine. On Kubernetes it is configured through the Kong Ingress Controller. Kong Event Gateway brings the same controls to event-driven architectures and Kafka stream management, for teams whose streaming workloads need the same governance as their APIs.
Kong AI Gateway
AI Gateway is for teams that let applications and agents call several LLM providers and need to govern that use. It gives one API across the major model providers, with semantic caching, routing and load balancing, plus access control and token cost governance on every request. Built-in guardrail policies include AI Prompt Guard, AI Semantic Prompt Guard, AI Sanitizer for PII redaction and AI Semantic Response Guard. Teams already using a cloud provider’s trust and safety service can enforce it through the AWS, Azure or GCP guardrail plugins.
Kong Mesh
Kong Mesh secures traffic between microservices. Built on Kuma, Kong’s open-source service mesh, it provides built-in mTLS, service discovery and traffic management across multi-zone and multi-tenant topologies, on Kubernetes or on VMs and bare metal. Security standards and governance are applied from a single control plane.
Insomnia
Insomnia is a developer tool to design, test, mock and debug APIs and MCP servers. Its MCP client lets developers see and test the tools, resources and prompts a server exposes. Teams share projects and collections under role-based guardrails, and an open plugin architecture hosts more than 350 community-built plugins.
How It Works
Kong Gateway runs with or without a database, and in hybrid or cloud-hosted modes. Konnect supports cloud-managed, self-hosted and hybrid data planes.
| Component | What it does |
|---|---|
| Hybrid mode | A control plane manages configuration and data planes serve proxy traffic. Only the control plane connects to the database, and if it goes offline the data planes keep running on their last known configuration. |
| Traditional mode | A database stores entities such as routes, services and plugins, and each node acts as both control plane and data plane. |
| DB-less mode | Entities are held in memory, loaded from a declarative YAML or JSON file, and the Admin API is read only. |
| Konnect | In hybrid mode Konnect hosts the control plane, Dev Portal, analytics and Service Catalog, and pushes configuration to data planes that run as Kong-managed cloud nodes or on the customer’s own nodes. Dedicated cloud gateways run in infrastructure reserved for each Konnect organisation. |
| Kubernetes | Kong offers an Ingress Controller, an Operator and Helm-based deployment. |
| Plugins | Policies are applied through plugins grouped as AI, authentication, security, traffic control, serverless, analytics and monitoring, transformations, logging and monetisation. |
Identities And Systems Covered
The gateway controls how callers authenticate to the APIs, models and MCP servers behind it.
| API consumers | Key Auth, Basic Auth, HMAC and JWT, with OAuth 2.0, OpenID Connect, JWT signing and SAML 2.0 in the advanced tier, and limited LDAP. |
|---|---|
| Certificates and mTLS | Client certificate authentication at the gateway, and built-in mTLS between services in Kong Mesh. |
| Secrets | Vault authentication added to services or routes. |
| Identity providers | Any third-party OIDC provider, through the enterprise OpenID Connect plugin. |
| AI agents and MCP clients | OAuth2 for MCP server access, with agent tool calls scoped by OAuth2. |
| Platforms | Kubernetes on EKS, GKE, AKS and self-managed clusters, VMs and bare metal. |
Agentic AI Capabilities
MCP From Existing APIs
AI Gateway can generate MCP tools and servers on top of APIs that Kong already manages, and Konnect can discover existing APIs to compose their endpoints into tools. The AI MCP Proxy plugin converts APIs into MCP tools, proxies existing MCP servers and observes MCP traffic; it needs an AI licence.
MCP Access Control
The AI MCP OAuth2 plugin enforces authentication for MCP server access. The MCP Registry is where organisations discover, manage and govern the MCP servers they approve for production.
Agent-To-Agent Traffic
AI Gateway routes and secures agent-to-agent (A2A) traffic with protocol-aware observability and records A2A-specific metrics.
Integrations
| Area | Integrations |
|---|---|
| LLM providers | OpenAI, Anthropic, Cohere, Azure AI, Amazon Bedrock, Gemini, Vercel |
| AI guardrails | AWS Guardrails, Azure Content Safety, GCP Model Armor |
| Observability | Datadog, Prometheus |
| Cloud and serverless | AWS Lambda, AWS SigV4 request signing |
Company Background
| Founded | 2009 in Milan by Augusto Marietti and Marco Palladino. |
|---|---|
| Headquarters | San Francisco, California, United States. |
| Other offices | Chicago, Beijing, Shanghai, Tokyo, Milan, Bangalore, Pune, Budapest, Paris, London, Singapore and Sydney. |
| Leadership | Augusto Marietti, CEO; Marco Palladino, CTO; Bruce Felt, CFO; Joe Eskenazi, CRO. |
| Funding | A $100 million Series D at a $1.4 billion valuation in 2021, followed by the Series E. Investors include Andreessen Horowitz, Index Ventures, CRV, Goldman Sachs, Tiger Global and Balderton. |
| Acquisitions | Insomnia, the API testing tool, and OpenMeter in 2025 for usage metering and billing. |
| Recognition | Included in Gartner research for seven consecutive years and in the Forrester Wave: API Management Software. |
Note: This overview is compiled from Kong’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.