Kong's AI Gateway can turn APIs behind Kong Gateway into MCP servers and apply Kong's plugins for authentication, security, governance and observability to remote MCP traffic. Its Dev Portal can also generate MCP servers from published APIs. It is built around APIs you already run through Kong.
Who it suits
Organisations already running Kong that want to expose their own APIs as MCP servers under the same gateway policies.
Strengths
- Reuses Kong Gateway plugins for authentication, traffic control and security on MCP traffic.
- MCP traffic logs and metrics alongside your other API traffic.
- Self-hosted or through Kong's managed Konnect platform.
Limits
- Centred on exposing your own APIs as MCP; governing third-party MCP servers used by employees is not its focus.
- No shadow MCP discovery on devices.
- Check which plan includes the MCP features you need.
Scores on each criterion
| Criterion | Score | What we found |
|---|---|---|
| Authentication | Strong | Kong authentication plugins applied to MCP traffic. |
| Credential handling | Partial | Context propagation to upstream APIs; per-user OAuth to third-party tools varies by setup. |
| Policy depth | Strong | Kong plugins for security, governance and traffic control. |
| Audit | Partial | Traffic logs; audit depth depends on your logging plugins. |
| Observability | Strong | MCP traffic logs and metrics. |
| Deployment model | Strong | Self-hosted Kong Gateway or Konnect. |
| Shadow usage discovery | Not documented | Not documented. |
| Total | 10/14 | Ranked #4 of 8 |
Strong Built in and documented (2 points)Partial Present with gaps, or limited scope (1 point)Not documented Not found in the public docs we reviewed (0 points)
What it costs
Plans are listed at konghq.com/pricing; confirm which tier includes the AI Gateway MCP features.
Sources
Every score above comes from these public pages. Check them for changes since 11 November 2026.