Identity at the edge
Chain OIDC, LDAP, mTLS, OAuth2 introspection, JWT/JWKS, JWE, HMAC, and API keys per route. Map every verified credential to a consumer, group, or tenant.
Enterprise API gateway
One gateway for enterprise APIs and AI traffic
Tygress is a self-hosted enterprise API gateway built in Rust on Pingora. Route, secure, govern, and observe REST, gRPC, WebSocket, LLM, MCP, and A2A traffic from one data plane and one policy model.
Tygress is currently in development. Early access is not yet generally available.
Every workload
REST/api/v1/orders
gRPCpayments.Charge
LLM/v1/chat/completions
MCPtools/call
One Rust data plane
Tygress
One route model and one policy chain for API, model, tool, and agent traffic.
IdentityRate limitsAI guardrailsCost budgetsAuditOpenTelemetry
Every upstream
APIs & microservices
OpenAI & Anthropic
Bedrock & Gemini
MCP & A2A agents
Platform capabilities
The controls an enterprise gateway must own
A reverse proxy moves traffic. An enterprise gateway makes that traffic identifiable, governable, observable, and recoverable across teams and environments.
Traffic management
Use distributed rate limits, concurrency limits, circuit breakers, retry budgets, traffic splitting, health checks, and weighted or least-request load balancing.
Protocol coverage
Proxy HTTP/1.1, HTTP/2, REST, gRPC, gRPC-Web, WebSocket, and gRPC-JSON transcoding without creating protocol-specific gateway silos.
High availability
Run one all-in-one node or separate control and data planes. NATS JetStream distributes immutable snapshots with last-known-good behavior for the fleet.
Observability and audit
Export Prometheus metrics, OpenTelemetry traces, and structured access logs. Add durable configuration history and audit records when required.
Extensibility without lock-in
Configure 45+ built-in policies, write native Rust plugins, run sandboxed proxy-wasm modules, or add inline Rhai and JavaScript logic.
Architecture checklist
Built for the failure modes enterprises actually face
The data plane keeps serving traffic even when management systems are unavailable. Policy is validated before publication, distributed as immutable snapshots, and applied without taking routes offline.
- Deploy anywhere
- Docker, Kubernetes, VPC, on-premises, or fully air-gapped
- Separate management from traffic
- Split control plane and data plane with outbound-only configuration sync
- Keep data sovereign
- Prompts, credentials, API payloads, and policy stay inside your infrastructure
- Recover predictably
- Health checks, circuit breaking, retries, draining, and last-known-good configuration
- Prove policy
- Consumer identity, route-level enforcement, immutable audit, and open telemetry
- Support AI traffic
- LLM, MCP, and A2A governance on the same gateway as REST and gRPC
APIs are becoming AI systems
Do not add a second gateway when models and agents arrive
Tygress adds provider failover, virtual keys, AI DLP, prompt guardrails, semantic caching, token accounting, MCP, and A2A to the same enterprise gateway.
FAQ
Enterprise API gateway questions
What is an enterprise API gateway?
An enterprise API gateway is the policy and traffic control point in front of an organization's APIs. Beyond reverse proxying, it handles identity, authorization, rate limiting, resilience, protocol translation, observability, audit, high availability, and multi-tenant governance. Tygress extends that same control plane to LLM, MCP, and AI agent traffic.
Can Tygress replace Kong or Apigee?
Tygress is designed for the same enterprise API gateway role while adding native AI gateway capabilities in the same Rust data plane. It supports REST, gRPC, WebSocket, enterprise authentication, traffic management, extensibility, and observability. Tygress is pre-launch, so production migrations should be planned around release and validation requirements.
Does Tygress run in an air-gapped environment?
Yes. Tygress is self-hosted by design and can run inside a private VPC, on-premises, or fully air-gapped. A minimal all-in-one deployment is one binary; NATS, Postgres, and Redis are added only for the topologies or features that need them.
Which API protocols does Tygress support?
Tygress supports HTTP/1.1, HTTP/2, REST, gRPC, gRPC-Web, WebSocket, and gRPC-JSON transcoding. The same route and plugin model also governs OpenAI-compatible LLM traffic, MCP tool servers, and A2A agents.
How is an enterprise API gateway different from an AI gateway?
An API gateway secures and manages application and service traffic. An AI gateway adds model routing, virtual keys, cost accounting, semantic caching, guardrails, and agent protocol controls. Tygress combines both, so teams do not need separate policy systems for APIs and AI.
Enterprise control without the extra data plane
Put Tygress in front of every workload
Join the waitlist for deployment guides, early access, and product updates.