Tetrate builds application and agentic networking products on the open source Envoy project. Platform and security teams use it to route, secure and observe traffic between services, and between AI agents, models and tools, across multi-cloud and on-premises environments.
The problem it addresses is control. Once agents can call any model or tool, and services talk to each other across many clusters, teams need one place to decide what may connect to what, under whose identity and at what cost.
At A Glance
| Vendor | Tetrate, Silicon Valley, United States |
|---|---|
| Category | AI gateway, MCP gateway and service mesh |
| Identities covered | Workloads and services (mTLS), AI agents, developers and API keys |
| Deployment | Own VPC, on-premises or air-gapped |
| Agentic AI | AI Gateway, MCP Gateway, AI Guardrails, Agent Router |
| Customers | Informatica, Ory, Bloomberg |
| Certifications | SOC 2 Type II, ISO 27001, FIPS-validated solutions |
| Market classification | Workload Identity; also Network Security, Agentic AI Identity |
What Tetrate Does
Enterprises adopting AI end up with agents calling many model providers and tool servers, each with its own keys, costs and risks, while their microservices already need consistent security and traffic control. Tetrate puts both kinds of traffic through one Envoy based networking layer, with policy enforced in the request path. Tetrate Platform Services acts as a single control and management plane across that layer, so the same team can govern application and agent traffic in one place instead of running separate tools for each.
Products
Agent Router And AI Gateway
Agent Router Enterprise gives organisations an approved model list with unified access and automatic fallback across providers. Smart Routing lets the user, a policy or the gateway itself pick the model, always within policy. Cost and token visibility attributes spend to a person, team or application, and the Developer On-Ramp centralises API keys, scoped access profiles and SSO onboarding, so developers get model access without handling provider keys themselves. Agent call chains are traced, and inline token budgets and rate limits stop looping agents.
MCP Gateway
MCP Gateway sits between agents and MCP tool servers, giving security teams a curated server list and MCP profiles with their own authentication. A profile can select individual tools from any server in the catalogue and can be revoked from the admin console. The gateway, rather than the agent, holds the tool credentials, so revoking a profile cuts an agent off without rotating any keys, and tool changes take effect at the next request.
AI Guardrails
AI Guardrails applies runtime policy to AI traffic, keeping agent behaviour consistent and preventing data loss through PII redaction, prompt filtering and blocking of risky transactions.
Tetrate Service Bridge
Tetrate Service Bridge is a mesh and management plane built on Istio and Envoy that connects, monitors and secures microservices. It brings centralised governance, traffic management and observability to teams running services across many clusters.
Gateway And Istio Products
Tetrate Enterprise Gateway for Envoy is a FIPS-verified Envoy Gateway for Kubernetes ingress, alongside Tetrate Application Gateway. Tetrate Istio Subscription and Subscription Plus provide supported, hardened builds of upstream Istio and Envoy for teams that run open source Istio themselves.
How It Works
Envoy based proxies and gateways sit in the request path and are managed from a control plane. Builds can run in the customer’s own VPC, on-premises or in air-gapped environments, with CVE-protected builds.
| Component | What it does |
|---|---|
| Gateway data plane | Agent Router and AI Gateway sit between applications or agents and model providers, so every model request passes through policy before it leaves the customer’s environment. |
| MCP layer | MCP Gateway sits between agents and tool servers. Internal MCP servers can be self-hosted behind the customer’s firewall, and traces and logs are exported over OTLP. |
| Service mesh | Tetrate Service Bridge handles certificate management and mTLS enforcement for service to service traffic across containers, VMs and serverless environments. |
Identities And Systems Covered
| Workloads and services | Certificates and mTLS for all service to service communication |
|---|---|
| Human administrators | Role-based access control tied to the customer’s identity provider, with identity-aware authorisation |
| AI agents | Least privilege at the tool layer through MCP profiles; sub-agents cannot exceed the permissions of the user they act for |
| Developers and API keys | Centralised API keys and scoped access profiles |
| Environments | Kubernetes ingress, Amazon EKS, containers, VMs and serverless |
Integrations
| Area | Integrations |
|---|---|
| AI coding tools | Claude Code, Codex, Cline, Cursor |
| Observability | OpenTelemetry (OTLP traces and logs) |
Company Background
| Founded | 2018, by engineers from the Istio project |
|---|---|
| Headquarters | Silicon Valley, United States, with a worldwide remote workforce |
| Leadership | Co-founders Jeyappragash JJ (CEO) and Varun Talwar (CTO) |
| Funding | A reported $40 million round in March 2021 |
| Open source | Helps lead and maintain Envoy. Tetrate and Bloomberg started the open source AI gateway project together, and its maintainers later donated it to the Agentic AI Foundation (Linux Foundation) as Agent Router, under the Apache 2.0 licence |
Note: This overview is compiled from Tetrate’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.