AI Defense Stack

LLM firewalls & guardrails

Kong AI Gateway: AI gateway built on Kong Gateway

Kong AI Gateway is an AI gateway built on Kong Gateway from Kong. It is open source under the Apache-2.0 license and is offered as: Self-hosted, SaaS, API.

  • Last reviewed
Visit Kong AI Gateway (opens in a new tab) Documentation (opens in a new tab) Source code (opens in a new tab)
Open sourceApache-2.0 Layer 6: Runtime guardrails

Best for

Teams that already run Kong as an API gateway and want LLM routing and prompt controls on the same data plane

Consider instead if

  • You want an AI gateway whose guardrail code is fully MIT licensed on GitHub. See Portkey.
  • You already use Cloudflare and want a managed gateway on its network. See Cloudflare AI Gateway.

What Kong AI Gateway does

Kong AI Gateway is the AI layer of Kong's API gateway. The documentation describes one API for several LLM providers with failover, an AI Prompt Guard that blocks prompts matching disallowed topics or keywords, an AI Semantic Prompt Guard for jailbreak and prompt injection attempts, an AI Sanitizer that redacts PII before prompts go upstream, spend-based rate limiting, semantic caching and observability through audit logs and OpenTelemetry. Kong Gateway itself is open source under Apache-2.0, but Kong's pricing page lists AI Gateway paid plugins as add-ons or inclusions in paid plans, so not every feature here is in the open-source build. Check Kong's plugin pages for the edition of each feature.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Kong Source, checked October 21, 2026: developer.konghq.com (opens in a new tab)
Status
Active Source, checked October 21, 2026: api.github.com (opens in a new tab)
Open source
Yes: Apache-2.0 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Repository
github.com Source, checked October 21, 2026: api.github.com (opens in a new tab)
GitHub stars
44,287 as of October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest push
October 19, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release
October 12, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Deployment
Self-hosted, SaaS, API Source, checked October 21, 2026: developer.konghq.com (opens in a new tab)
Pricing model
Usage-based: Konnect Plus (AI Management): from $25/month plus usage, with a 30-day free trial and no credit card required. Enterprise: custom, billed annually. Kong Gateway OSS is linked as open source. (as listed on October 21, 2026; check the vendor for current pricing) Source, checked October 21, 2026: konghq.com (opens in a new tab)
Website
developer.konghq.com Source, checked October 21, 2026: developer.konghq.com (opens in a new tab)
Documentation
developer.konghq.com Source, checked October 21, 2026: developer.konghq.com (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
Not documented in the sources we checked
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where Kong AI Gateway fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Kong AI Gateway covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L6 Runtime Runtime guardrails Primary Screen what goes into and comes out of a model in live traffic, and limit abuse of the model endpoint. Follows its category, LLM firewalls & guardrails
L5 Data Data protection Also covers Documents an AI Sanitizer plugin that redacts personal data in prompts. Redacts PII from prompts before they reach the upstream LLM provider with the AI Sanitizer

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Kong AI Gateway, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection The AI Semantic Prompt Guard targets jailbreak and prompt injection attempts. Detects jailbreak and prompt injection attempts by meaning with the AI Semantic Prompt Guard; Catches jailbreak attempts phrased in natural language with the AI Semantic Prompt Guard
LLM02 Sensitive Information Disclosure The AI Sanitizer redacts PII before prompts reach the upstream provider. Redacts PII from prompts before they reach the upstream LLM provider with the AI Sanitizer
LLM10 Unbounded Consumption AI Rate Limiting Advanced enforces spend limits per request cost. Enforces spend limits based on each request's calculated cost

Not mapped in our analysis: LLM05, LLM07, LLM09. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in LLM firewalls & guardrails, ranked within the category by Coverage Score.

NVIDIA NeMo Guardrails

NVIDIA

Open sourceApache-2.0
  • Library
  • Self-hosted
  • API

Adds programmable input, dialog, retrieval, execution and output rails to LLM applications.

Best for: Teams that want to script rules for one LLM application in Python and run them in their own infrastructure

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM06 Excessive Agency

Reviewed

Portkey AI Gateway

Palo Alto Networks (Portkey)

Open sourceMIT Freemium Now Prisma AIRS AI Gateway
  • SaaS
  • Self-hosted
  • API

Routes LLM traffic through one gateway API and runs input and output guardrail checks on each request.

Best for: Teams that want a single gateway for several LLM providers with guardrail checks, available as open source or as a hosted service

Coverage Score 69 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM09 Misinformation

Reviewed

Amazon Bedrock Guardrails

Amazon Web Services

Commercial
  • API
  • Cloud-native
  • Managed service

AWS service that filters harmful content, prompt attacks, denied topics and PII in model inputs and outputs.

Best for: Teams that already build on AWS and want managed filters they can apply to Bedrock models or to other models through an API call

Coverage Score 60 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM09 Misinformation

Reviewed

Kong AI Gateway FAQ

Is Kong AI Gateway open source?

Partly. Kong Gateway is Apache-2.0 on GitHub, but Kong's pricing page lists some AI Gateway plugins as paid add-ons or paid-plan inclusions. Check each plugin's edition.

What guardrails does it offer?

Kong's documentation lists an AI Prompt Guard for disallowed topics and keywords, an AI Semantic Prompt Guard for jailbreak and prompt injection attempts, and an AI Sanitizer for PII.

How is it priced?

Kong's pricing page lists Konnect Plus from $25 per month plus usage with a 30-day free trial, and custom Enterprise pricing billed annually.

Key facts you can cite

We have no commercial relationship with Kong.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.