Arcjet vs Kong AI Gateway

Arcjet vs Kong AI Gateway

Kong AI Gateway is a set of AI plugins on Kong Gateway that proxy, secure, and meter traffic between your applications and model providers, with extensions for MCP and agent-to-agent traffic. Arcjet is an AI agent runtime security platform that enforces policy in the path of the action: in your code before a tool call runs, and in the hooks that Claude Code, GitHub Copilot, Cursor, and OpenAI Codex fire before a shell command, file access, URL fetch, or MCP call. The key difference is what each one governs. Kong AI Gateway governs the connection between a client and a model provider, MCP server, or A2A agent, and Arcjet governs the action at the point where it runs, with the arguments that will run. Choose Kong AI Gateway if you already run Kong and want model traffic governed alongside your APIs, choose Arcjet to decide whether an agent's action runs, and use both when you need each.

Arcjet publishes this comparison. Competitor details come from Kong's public documentation, reviewed on September 25, 2026.

Arcjet vs Kong AI Gateway at a glance

Arcjet differs from Kong AI Gateway in where it enforces, which detectors it includes, and which features need an Enterprise plan. The following table compares the two products by area.

What does Kong AI Gateway do?

Kong describes Kong AI Gateway as a connectivity and governance layer for AI-native applications, built on Kong Gateway. Kong AI Gateway is delivered as plugins that you attach to Kong services and routes, which suits teams that already run Kong for their APIs.

The following plugins cover model traffic:

• Routing. AI Proxy and AI Proxy Advanced route requests to model providers, with load balancing in the advanced plugin.
• Prompt filtering. AI Prompt Guard uses regular expressions to allow or block prompts in user-role chat messages. AI Semantic Prompt Guard permits or blocks prompts by similarity to a list, and is available only in AI Gateway Enterprise.
• Third-party guardrails. Plugins for Lakera Guard, AWS Guardrails, and Azure Content Safety evaluate requests and responses that pass through Kong.
• PII. The AI PII Sanitizer sends request and response bodies to an AI PII Anonymizer Service, which runs as a separate container, and replaces sensitive values before forwarding. The AI PII Sanitizer is available only in AI Gateway Enterprise.
• Cost control. AI Rate Limiting Advanced limits by total, prompt, or completion tokens, or by calculated cost. AI Rate Limiting Advanced is available only in AI Gateway Enterprise.
• Caching. AI Semantic Cache returns cached responses for semantically similar requests, in AI Gateway Enterprise.

Beyond model traffic, the AI MCP Proxy plugin translates between MCP and HTTP, so MCP clients can call existing REST APIs as tools or reach upstream MCP servers through Kong. The AI MCP Proxy requires AI Gateway Enterprise and Kong Gateway 3.12 or later, and per-tool ACLs were added in 3.13. Kong's A2A support routes and observes agent-to-agent traffic, with authentication, rate limiting, and audit logging.

For coding agents, Kong documents routing Claude Code through AI Gateway by pointing ANTHROPIC_BASE_URL at the gateway so that model requests pass through it. Kong's Claude Code governance post describes centralized authentication, token-based budgets, prompt and response logging, and PII detection on that traffic, and extends governance to MCP traffic.

Kong pricing lists a 30-day Konnect trial, a Plus plan that charges AI Gateway at $100 a month per unique LLM model for up to five models, and custom Enterprise pricing. Kong Gateway itself is open source.

What does Arcjet do?

Arcjet is an AI agent runtime security platform that discovers the agents running in your organization, enforces policy across every action, prompt, and tool call, and keeps the evidence of what happened. Arcjet enforces in the path of the action rather than on the network.

• Coding agents. Arcjet enforces policy on Claude Code, GitHub Copilot, Cursor, and OpenAI Codex through the hooks each agent already fires, with no SDK and no code change. One policy covers all four, and each policy runs on a tool call, a prompt, or a model switch. Twelve starter policies cover destructive commands, rewriting git history, protected paths, credential access, piped installers, an MCP server allowlist, an egress allowlist, destination threats, a model allowlist, sensitive information, prompt injection, and npm publish. Administrators install the hooks through managed settings or MDM.
• Custom agents. The JavaScript, TypeScript, Python, and Go SDKs call guard() for tool calls, queues, MCP handlers, and any action with no HTTP request, and protect() for HTTP routes.
• Policy. Guard policies are centrally managed, written in Rego or a builder, and published from the Arcjet Console or MCP server. Guard policies run in dry run before they go live and take effect in real time.
• Detectors. Prompt injection, sensitive information, destination threat analysis, token and spend budgets, and rate limits.
• Evidence. The Arcjet Console records every decision and session. SIEM export to Datadog, Splunk, SentinelOne, Panther, and Amazon S3 is available on the Enterprise plan.

Key differences between Kong AI Gateway and Arcjet

Arcjet differs from Kong AI Gateway in four ways: what each one governs, whether it covers coding-agent actions on the developer's machine, where its detectors come from, and which MCP servers it covers.

Connectivity layer versus the action

Kong AI Gateway governs the connection between a client and an upstream: a model provider, an MCP server, or an A2A agent. Arcjet governs the action at the point where it runs. The agent's runtime executes a tool call that a model proposes, after the model response has passed through the gateway. Arcjet's guard() runs at that point, with the arguments that will run. For more information about where each enforcement point sits, see AI agent security architecture.

Coding agents on the developer's machine

Kong's Claude Code integration changes where the agent sends model requests. Shell commands, file reads, and URL fetches run on the developer's machine and don't pass through the gateway as model traffic, and Kong's public documentation doesn't describe evaluating those actions before they run. Arcjet evaluates each one from the agent's own hook, before the tool runs, and covers Claude Code, GitHub Copilot, Cursor, and OpenAI Codex with one policy. For more information, see how to secure AI coding agents.

Where the detectors come from

Kong's prompt and PII controls combine its own regex and semantic plugins with third-party guardrail plugins and a separate anonymizer service. AI Semantic Prompt Guard and the AI PII Sanitizer are AI Gateway Enterprise features. Arcjet includes its own prompt-injection, sensitive-information, and destination threat detectors, and Arcjet's SDK-local sensitive-information detection keeps the raw body in your process.

MCP servers you route versus MCP servers developers add

The AI MCP Proxy covers MCP servers and tools that you expose through Kong. A developer who adds an MCP server to their coding agent's configuration connects to it directly. Arcjet's MCP allowlist runs in the agent's hook on every MCP call, so it applies whichever server the developer adds. For more information, see rogue MCP server detection.

When to choose Kong AI Gateway, Arcjet, or both

Choose Kong AI Gateway if you already run Kong and want model traffic governed with your APIs, Arcjet to decide agent actions before they run, and both when you need each. The following sections list the signals for each choice.

When to choose Kong AI Gateway

Choose Kong AI Gateway if any of the following apply:

• You already run Kong Gateway or Konnect and want model traffic governed with the same tooling as your APIs.
• You want to expose existing REST APIs as MCP tools through a gateway.
• You need token and cost limits, prompt filtering, and PII sanitization on model traffic across teams.
• You want A2A traffic routed and observed through the same gateway.

When to choose Arcjet

Choose Arcjet if any of the following apply:

• You need to stop a coding agent's shell command, file access, URL fetch, or MCP call before it runs.
• You want one policy across Claude Code, GitHub Copilot, Cursor, and OpenAI Codex, installed so developers can't remove it.
• You need a decision at the executed tool call, with the arguments that will run.
• You want built-in prompt-injection, sensitive-information, and destination threat detectors without running a gateway.
• You also need bot detection, rate limiting, and a WAF on your HTTP routes.

Using Kong AI Gateway and Arcjet together

Kong AI Gateway and Arcjet cover different points in the same workflow. Keep Kong AI Gateway on model, MCP, and A2A traffic for routing, keys, limits, and prompt and response filtering. Add Arcjet hooks to coding agents and guard() calls to your own agents so that each action is decided before it runs.

A model allowlist or team token limit fits Kong. A rule about a command, a path, an MCP server, or a destination host fits Arcjet. For more information about layering a gateway with Arcjet, see AI gateway vs Arcjet.

Kong AI Gateway alternatives

If you're looking for a Kong AI Gateway alternative, the right one depends on whether you need a gateway or action-level enforcement:

• Arcjet. Enforces policy on agent actions in code and in coding-agent hooks, with no proxy. Choose it for security on tool calls, and pair it with a gateway if you also need routing.
• Portkey. A managed AI gateway with MCP and agent gateways, acquired by Palo Alto Networks in 2026. For more information, see Arcjet vs Portkey.
• LiteLLM. An open-source Python SDK and self-hosted proxy with virtual keys, budgets, and guardrails. For more information, see Arcjet vs LiteLLM.
• Cloudflare AI Gateway. A managed gateway on Cloudflare's network with caching, spend limits, Guardrails, and DLP. For more information, see Cloudflare vs Arcjet.