API Gateway. AI Gateway.
Service Mesh.
One Rust-Powered Binary.
Every protocol. 80+ built-in plugins. Eight operating modes.
Ferrum Edge is a high-performance edge platform engineered in Rust. Route, secure, and observe HTTP, gRPC, WebSocket, TCP, and UDP traffic — govern LLM and agent traffic across 11 AI providers — and run a full SPIFFE-identity service mesh, all from a single ~30 MB binary.
Three Products in One Binary
Most teams run separate software for API management, AI traffic governance, and service-to-service networking. Ferrum Edge consolidates all three — same binary, same configuration model, same plugins.
API Gateway
Dynamic routing, 10+ authentication methods, rate limiting, WAF threat detection, transformation, caching, and full-stack observability for HTTP/1.1 through HTTP/3, gRPC, WebSocket, TCP, and UDP — with zero-downtime configuration reloads.
AI Gateway
One OpenAI-compatible endpoint routing to 11 providers with streaming and fallback. Token budgets, semantic caching, prompt firewalls, PII redaction, tool-call governance, compliance transcripts — plus dedicated MCP and Agent-to-Agent gateways for agent traffic.
Service Mesh
Six mesh topologies — sidecar, ambient, waypoints, east-west, and egress gateways — with SPIFFE identity, mutual TLS, HBONE, transparent DNS, mesh authorization policy, and Istio/Gateway API compatibility on Kubernetes.
Up and Running in Minutes
# Download the latest release (Linux x86_64)
curl -LO https://github.com/ferrum-edge/ferrum-edge/releases/latest/download/ferrum-edge-linux-x86_64
chmod +x ferrum-edge-linux-x86_64
sudo mv ferrum-edge-linux-x86_64 /usr/local/bin/ferrum-edge
# Create a minimal config
cat > config.yaml << 'EOF'
proxies:
- id: "my-api"
listen_path: "/api"
backend_scheme: http
backend_host: "localhost"
backend_port: 3000
strip_listen_path: true
EOF
# Start Ferrum Edge (auto-detects file mode from --spec)
ferrum-edge run --spec config.yaml -vEverything You Need at the Edge
Ferrum Edge is engineered from the ground up for speed and reliability — no garbage collection pauses, no lock contention on the request path, no compromises.
Lock-Free Request Path
Requests never wait in line to read configuration. Config updates are atomic swaps — in-flight requests finish on the old config while new requests instantly see the new one. Zero downtime, zero stalls.
80+ Built-in Plugins
Authentication, authorization, OPA policy, WAF, rate limiting, adaptive concurrency, AI/LLM governance, transformation, chaos testing, chargeback, and observability — all first-class, all priority-ordered, no marketplace required.
True Multi-Protocol
HTTP/1.1 through HTTP/3 QUIC, WebSocket over all three HTTP versions, gRPC and gRPC-Web, SSE streaming, raw TCP and UDP with TLS/DTLS termination, origination, or passthrough. One gateway, every protocol.
Full AI Traffic Governance
14 AI-focused plugins: provider federation with streaming, token-aware rate limiting, semantic firewall and cache, prompt PII shielding, tool-call governance, transcript audit, and gateways for MCP tools and Agent-to-Agent traffic.
Security in Depth
WAF content threat detection, OPA authorization, mTLS everywhere, SSRF-safe backend egress policy, anti-smuggling request validation, geo/IP/bot restrictions, and secrets loaded from Vault, AWS, GCP, or Azure.
Resilience & Scale
Six load-balancing algorithms, active and passive health checks, circuit breakers, retries with backoff, service discovery (DNS, Kubernetes, Consul, mesh), multi-CP and multi-DB failover, and graceful shutdown with request draining.
Eight Operating Modes
From a single-node file-based config to a globally distributed Control Plane / Data Plane architecture to a full Kubernetes service mesh — the same binary does it all.
File
YAML/JSON config with SIGHUP hot reload. Perfect for development, single-node, and GitOps deployments.
Database
PostgreSQL, MySQL, SQLite, or MongoDB backed. Full Admin API for dynamic runtime config management.
Control Plane
Centralized config authority. Distributes configuration to Data Planes over secure gRPC streams.
Data Plane
Horizontally scalable traffic processors with multi-CP failover and local config caching for resilience.
Mesh
Service-mesh data plane with six topologies, SPIFFE identity, HBONE, and native or xDS config.
Injector
Kubernetes admission webhook that injects mesh sidecars and traffic-capture init containers.
Node Agent
Per-node eBPF capture manager powering the ambient mesh — no proxy listeners, pure kernel-level plumbing.
Migrate
Runs database schema migrations or config-file upgrades then exits. Built for CI/CD pipelines.
One Endpoint. Eleven AI Providers.
Point your applications at a single OpenAI-compatible endpoint. Ferrum Edge routes each request — streaming or buffered — to OpenAI, Anthropic, Google Gemini/Vertex, Azure OpenAI, AWS Bedrock, Mistral, Cohere, xAI, DeepSeek, Meta Llama, or Hugging Face, normalizes the response, and fails over between providers automatically.
- Model routing, priority fallback, and per-provider circuit breakers
- True end-to-end SSE streaming with provider-format normalization
- Token budgets per consumer with Redis-coordinated enforcement
- Semantic caching, prompt firewall, PII shield, and output guardrails
- Tool-call governance and compliance-grade transcript audit
- MCP tool gateway and Agent-to-Agent (A2A) gateway for agent traffic
plugin_configs:
- id: "ai-gateway"
plugin_name: "ai_federation"
scope: proxy
config:
providers:
- name: openai
api_key: "${OPENAI_API_KEY}"
models: ["gpt-*"]
- name: anthropic
api_key: "${ANTHROPIC_API_KEY}"
models: ["claude-*"]
fallback:
enabled: true
- id: "token-budget"
plugin_name: "ai_rate_limiter"
scope: proxy
config:
limit_by: consumer
tokens_per_hour: 500000
sync_mode: redisBuilt to Be Invisible
Ferrum Edge delivers 102,183 RPS on HTTP/1.1 and over 108K on HTTP/2 and raw TCP — and in head-to-head Docker benchmarks it outpaced Envoy, Kong, and Tyk on authenticated API traffic. The goal: your backend is your bottleneck, not your gateway.
- 102,183 RPS on HTTP/1.1 (Apple Silicon, 200 concurrent)
- 108,841 RPS on raw TCP proxy; 103,830 RPS on WebSocket
- Authentication adds effectively zero overhead
- 4% faster than Envoy, 12% faster than Kong, 46% faster than Tyk on key-auth traffic
- Performance holds at 30,000 configured proxies
From Gateway API to Ambient Mesh
Ferrum Edge speaks the standards your cluster already uses — no proprietary CRD lock-in.
Rust-Native. Not Wrapped. Not Ported.
Unlike gateways that bolt scripting layers onto a C or Go core, Ferrum Edge is built in Rust from the ground up. Memory safety without garbage collection. Predictable latency at any load. A request path that never stops to wait for a configuration change.
80+ Plugins, Ready to Go
Every capability you need, built in and executed in a deterministic priority pipeline. No marketplace hunting, no compatibility nightmares, no supply-chain surprises.
Meet Ferrum Foundry
The admin panel for your Ferrum Edge gateway. Manage proxies, consumers, plugins, and upstreams through a modern web UI — with real-time metrics, circuit breaker alerts, and health monitoring built in.
- Full CRUD for proxies, consumers, plugins, and upstreams
- Real-time metrics dashboard with configurable auto-refresh
- Circuit breaker states and connection pool monitoring
- Multi-namespace support for tenant isolation
- Dark and light themes
kind: Consumer
spec:
id: app-mobile
namespace: ferrum
credentials:
api_key:
key: "${gh-env-secret:alloc=generate}"
# Open a PR → validation, policy review,
# and a change plan per environment.
# Merge → applied to every gateway.Prefer No UI? Ship Config by Pull Request.
GitForgeOps turns a plain GitHub repository into the control plane for your gateway fleet. Declare proxies, consumers, upstreams, and plugins as YAML — every change is validated, policy-checked, and reviewed in the pull request before it's applied to any environment.
- Multi-environment applies from one repo with per-environment overlays
- Policy-as-code reviews that block bad changes before they merge
- Encrypted credential brokering — no secrets in Git, no Vault required
- Nightly drift detection between declared and live configuration
- Full audit trail and one-command rollback via git history
- Runs entirely on GitHub's free tier — no external services
Ready to Try Ferrum Edge?
Download the pre-built binary, or explore the source on GitHub. Free for noncommercial use under the PolyForm Noncommercial license.