agentgateway vs BFE Ingress Controller
agentgateway
agentgateway.dev
BFE Ingress Controller
bfe-networks.netSide by side
| Figure | agentgateway | BFE Ingress Controller |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | Yes |
| Web | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Kubernetes Ingress Controllers | 9.1 (#1) | 9.0 (#2) |
| Integrations | Official integration categories cover identity providers, AWS, Google Cloud, Azure, LLM providers, MCP, networking tools, agent frameworks and NetBird. | Official documentation names Kubernetes, Prometheus, Jaeger, Fluentd and mainstream layer-4 load balancers as integrations. |
| Limit: operational complexity | A reviewer said the Kubernetes controller and policy model add too much machinery for a single service with one model provider and a fixed tool list. | Independent analysis says a fleet with API, UI and configuration management requires four separate deployments because the data plane and control-plane components are split. |
| Notable release | Release notes document OAuth token exchange using RFC 8693 and RFC 7523 plus new Microsoft Entra ID, Descope and authentik MCP authentication providers. | Baidu announced in October 2021 that API-Server, Conf-Agent and Dashboard were released under Apache 2.0 alongside the ingress controller. |
| Observability | Built-in observability exports OpenTelemetry metrics, logs and distributed traces. | Built-in metrics, logs and distributed tracing are provided for operations and troubleshooting. |
| Security | Listed security features include JWT and OIDC, API keys, authorization policies, TLS and mTLS with certificate rotation, and rate limiting. | The vendor says BFE is written in Go, a memory-safe language, and describes it as immune to buffer overflow vulnerabilities. |
| Support | The enterprise page lists partner-provided commercial support, including a Solo.io offer with 24×7 coverage, upstream collaboration, and best-practice guidance. | The project directs questions and issues to GitHub and lists CNCF Slack and WeChat community channels. |
| What it does | Agentgateway is a Rust data plane that connects, secures, routes and observes LLM, MCP, A2A and ordinary service traffic. | BFE Ingress Controller implements Kubernetes Ingress on top of the BFE layer-7 load balancer. |
Plans
In their own words
agentgateway
Agentgateway is a free, open-source HTTP and gRPC gateway for routing, securing, observing, and governing service, LLM, MCP, and agent-to-agent traffic. Its LLM gateway offers an OpenAI-compatible API for providers including OpenAI, Anthropic, Bedrock, Gemini, Vertex, and OSS Llama runs. Self-hosted inference routing supports vLLM, TGI, and Triton, with choices guided by latency, cost, and model. For MCP it supports server discovery, scoped tool calls, and audit trails; A2A routing connects runtimes such as LangChain, CrewAI, and ADK. Security features include JWT and OIDC, API keys, authorization policies, TLS and mTLS with certificate rotation, and rate limiting. Guardrails inspect MCP calls and responses for prompt injection and unsafe payloads, while prompt guards support checks and redaction. Observability includes OpenTelemetry, Prometheus token-usage histograms, Jaeger traces, and request logs with latency, token counts, and realized USD cost. It can run as a standalone binary, in Docker, or on Kubernetes. Commercial support is listed through a partner.
BFE Ingress Controller
BFE Ingress Controller is an open-source Layer 7 load balancer derived from Baidu’s proprietary Baidu Front End. It is self-hosted and supports Linux, macOS, Windows, and API use. BFE handles HTTP, HTTPS, SPDY, HTTP/2, WebSocket, TLS, gRPC, and FastCGI traffic; HTTP/3 is planned. Operators define content-based routing rules with a domain-specific language. Traffic features include global and distributed load balancing, zone-aware balancing, resilience to zone-level failures, and overload protection. Each tenant has an isolated configuration that is not visible to other tenants. A built-in plugin framework supports extensions for traffic management, security, and observability. For operations, BFE provides subsystem metrics, troubleshooting and analysis logs, and distributed tracing. The project lists integrations with mainstream Layer 4 load balancers and ecosystem projects such as Kubernetes, Prometheus, Jaeger, and Fluentd. It is licensed under Apache 2.0 and is a CNCF sandbox project. Documentation covers installation from source and through binary, Go, Snap, and Docker paths. The open-source plan is free.