agentgateway: The Data Plane for Agentic Traffic

TL;DR - agentgateway is an open-source Rust gateway that treats MCP tool calls, Agent-to-Agent messages, and LLM inference as first-class traffic, alongside ordinary REST and gRPC. Donated by Solo.io, it joined the Agentic AI Foundation in June 2026 as its fourth hosted project and the first addition since launch. If the other three AAIF projects define how agents speak, agentgateway governs that speech in production.

Here's a problem every team hits about a week after their agent prototype starts working.

The agent calls tools. It queries a model. It hands work to another agent. All of that traffic leaves your infrastructure, and none of your existing tooling can see any of it. Your API gateway understands HTTP verbs and REST paths. It has no concept of which tool an agent invoked, so you cannot rate limit that tool, attribute its cost, or write a policy that says "this agent may read from the CRM but never write to it."

The traffic is real, it's expensive, and it's invisible.

What agentgateway actually is#

agentgateway is an open-source gateway built for how AI systems actually route traffic. It provides a single operational layer for MCP traffic, Agent-to-Agent communication, LLM inference, REST APIs, and gRPC services.

It's written in Rust for low-latency, high-throughput proxying, and splits into a control plane and a proxy data plane. It runs on bare metal, virtual machines, containers, and Kubernetes.

   agents ---> +------------------------------+ ---> MCP servers / tools
   apps   ---> |        agentgateway          | ---> LLM providers
               |  policy - authz - observ.    | ---> REST / gRPC services
               |  Rust proxy + control plane  |
               +------------------------------+

What it adds on top of raw agent traffic#

• MCP virtualization - present many backing MCP servers as one surface, so agents see a stable endpoint while you reorganize what's behind it.
• Model-agnostic LLM routing - switch providers without touching application code.
• Tool-level access policies - authorize per tool, not per endpoint. This is the capability a conventional gateway structurally cannot offer.
• Prompt guards - inspect and block on request and response content.
• Rate limiting and budget controls - real cost attribution for token spend.
• Observability - traces that follow a request across the agent, tool, and model hops.

Why it joined AAIF, and why that matters#

The Agentic AI Foundation launched in December 2025 with three donated projects: MCP from Anthropic, goose from Block, and AGENTS.md from OpenAI. Those cover how agents use tools, how agents run, and how agents understand a codebase.

None of them covers what happens when that traffic hits production at scale. agentgateway's arrival in June 2026 filled that gap, and the sequencing is telling: the industry standardized the protocols first, then came back for the governance layer once real deployments made the need obvious.

It arrived with a community already attached: 300+ active contributors across 60+ organizations, including CoreWeave, Red Hat, Solo.io, Adobe, Salesforce, Amdocs, and Microsoft. That is not a project looking for adoption; it's one formalizing the adoption it already had.

How it's governed#

agentgateway operates under a formal Technical Charter as part of LF Projects, LLC. The Technical Steering Committee is initially the project's Maintainers, and TSC meetings are intended to be open to the public. Roles follow the standard Linux Foundation split: Contributors, meaning anyone submitting code, documentation, or other artifacts, and Maintainers.

The charter states the mission plainly:

to create a secure, scalable, and standardized foundation for AI agents to discover, communicate with, and leverage external tools and services, enabling seamless cooperation between agents, models, and APIs across organizations and ecosystems.

Where it sits next to Kubernetes#

This is the part that matters if you already run cloud-native infrastructure.

kagent, a CNCF Sandbox project, runs AI agents inside Kubernetes as first-class objects and speaks MCP natively. agentgateway is the layer that governs the traffic those agents generate on the way out. One project puts agents in your cluster; the other makes their behaviour observable and enforceable.

That combination is the concrete link between the two foundations. CNCF supplies the runtime, AAIF supplies the standards, and agentgateway is where the two meet in the data path. For a platform team that already has Kubernetes, GitOps, and RBAC, agentgateway is the piece that extends those existing controls to cover agent traffic rather than asking you to invent a parallel governance story.

How to contribute#

It's the youngest of AAIF's four projects, which historically is when a contributor can still meaningfully shape direction.

• Rust core - proxy, control plane, protocol handling.
• UI - the web workspace, with ESLint and its own test suite.
• Protocol and API work - buf-generated API and schema definitions.
• Docs, examples, and architecture notes.

The gates: make lint and make test must pass, and new functionality needs tests. Commits follow Conventional Commits. The flow is fork, add an upstream remote, branch, rebase on upstream/main, then open a pull request.

For the full on-ramp across all four AAIF projects and the house rules each one enforces, see How to Contribute to AAIF. For foundation context, see What Is the Agentic AI Foundation.

Frequently asked#

What is agentgateway?#

agentgateway is an open-source gateway, written in Rust, that provides a unified policy, security, and observability layer for AI agent traffic: MCP tool calls, Agent-to-Agent messages, LLM inference, REST, and gRPC. It was donated by Solo.io and is now a hosted project of the Agentic AI Foundation.

When did agentgateway join the Agentic AI Foundation?#

June 2026. It was the fourth hosted project and the first added since AAIF launched in December 2025 with MCP, goose, and AGENTS.md.

How is agentgateway different from a normal API gateway?#

A conventional API gateway understands HTTP verbs and REST paths but has no concept of an MCP tool call or an agent-to-agent message. agentgateway adds tool-level access policies, MCP virtualization, model-agnostic LLM routing, prompt guards, and token budget controls, so agent traffic can be governed with the same rigour as ordinary API traffic.

Where does agentgateway run?#

On bare metal, virtual machines, containers, and Kubernetes. It splits into a control plane and a Rust proxy data plane.

Written by Aman Mundra - founder of Welzin and the Welzin Open Source Software (WOSS), which contributes upstream to the open agentic-AI ecosystem.