Fast by Design. Simple by Choice.
Choosing gateway infrastructure is a long-term commitment. Here is the case for Ferrum Edge — in plain language, with the evidence to back it up.
Five Reasons in Thirty Seconds
Why Ferrum Edge Is Fast
No jargon required — three design decisions explain most of the speed.
Requests Never Wait in Line
In many gateways, every request briefly stops to check the current routing rules — like every customer in a store asking the same clerk for directions. Under heavy traffic, a queue forms. Ferrum Edge gives every request its own instant, read-only snapshot of the rules. There is no clerk, no queue, and no slowdown — even while the rules are being updated live.
No Cleanup Pauses
Gateways written in Go or Java rely on a garbage collector — a background process that periodically freezes the application to tidy up memory. Those freezes surface as random latency spikes for your users. Ferrum Edge is written in Rust, which manages memory precisely as it goes. There is no collector, so there are no pauses — response times stay consistent at any load.
No Middleman Layers
Several popular gateways are a scripting language running on top of an engine written in a different language, with translation happening on every request. Every layer adds time and complexity. Ferrum Edge is one language, top to bottom — the request path runs as native machine code with nothing lost in translation.
The result, in numbers
Over 102,000 requests per second on HTTP/1.1 and 108,000+ on raw TCP on a single machine — and when we loaded the gateway with 30,000 configured routes, each with authentication and access control, median latency moved from 1.0 ms to just 1.1 ms with zero failed requests. Full methodology and raw data are published on the benchmarks page.
Benchmarked Against the Field
Same hardware, same Docker setup, same test: authenticated API traffic through each gateway. Reproduction scripts are public.
| Gateway | Authenticated Requests/sec | Average Latency | vs. Ferrum Edge |
|---|---|---|---|
| Ferrum Edge | 27,979 | 3.44 ms | — |
| Envoy 1.37 | 26,787 | 3.64 ms | Ferrum 4% faster |
| Kong 3.14 | 25,009 | 3.91 ms | Ferrum 12% faster |
| Tyk v5.12 | 19,186 | 5.08 ms | Ferrum 46% faster |
How Ferrum Edge Compares
An honest look at where Ferrum Edge fits relative to the tools you may already know.
vs. Kong
Kong is a mature gateway built as a Lua scripting layer on top of nginx, with many advanced capabilities gated behind its enterprise edition or sourced from a plugin marketplace. Ferrum Edge ships its full 80+ plugin catalog in the core binary — including OIDC, OPA, WAF, and the complete AI suite — runs the request path as native code with no scripting layer, and was 12% faster on authenticated traffic in our published benchmarks.
vs. Envoy / Istio
Envoy is a powerful C++ proxy, but most teams experience it through a mesh like Istio: a multi-component control plane, a steep configuration model, and extensions that require WebAssembly or external services. Ferrum Edge delivers the same mesh patterns — sidecar, ambient, waypoints, east-west, egress — plus Istio resource compatibility, in one memory-safe binary with built-in plugins and dramatically simpler operations.
vs. Tyk / Apigee / Cloud Gateways
Managed API platforms trade control and cost predictability for convenience — per-call pricing, regional constraints, and limited protocol support (usually HTTP only). Ferrum Edge is self-hosted on your terms, proxies TCP, UDP, WebSocket, and gRPC alongside HTTP, and includes usage metering and chargeback plugins if you need to bill internal teams yourself.
vs. nginx / HAProxy / Caddy
Classic reverse proxies are excellent at moving bytes but leave authentication, rate limiting, AI governance, and dynamic configuration as exercises for the operator. Ferrum Edge covers the proxying layer with comparable throughput, then adds the full gateway feature set — live config updates with no reloads or dropped connections, a management API, and a web UI.
vs. Dedicated AI Gateways
Point solutions like LiteLLM or Portkey govern LLM traffic but leave you running a second gateway for everything else. Ferrum Edge's AI capabilities — 11-provider federation with streaming, token budgets, semantic caching, prompt and output guardrails, tool-call governance, MCP and A2A gateways — live in the same pipeline as your authentication, WAF, and observability. One policy surface for all traffic.
A note on fairness
Every product above is good software with real strengths, and the right choice depends on your workload. Our benchmarks are reproducible and our comparison harness is open source — we encourage you to run it against your own traffic patterns before deciding. We are confident in how that test turns out.
What's in the Box
Capabilities included in the single Ferrum Edge binary, no add-ons required.
| Capability | Ferrum Edge | Typical Alternative |
|---|---|---|
| HTTP/1.1, HTTP/2, HTTP/3, WebSocket, gRPC, SSE | Built in | HTTP/3 and WebSocket support varies widely |
| Raw TCP and UDP proxying with TLS/DTLS | Built in | Often requires a separate L4 load balancer |
| 10+ authentication methods (mTLS, OAuth2, OIDC, JWT, HMAC…) | Built in | OIDC frequently enterprise-tier only |
| WAF content threat detection | Built in | Separate product or paid module |
| AI gateway: 11-provider federation with streaming | Built in | Separate AI gateway product |
| Token budgets, semantic cache, prompt/output guardrails | Built in | Rare; usually third-party add-ons |
| MCP and Agent-to-Agent (A2A) gateways | Built in | Emerging; typically unavailable |
| Service mesh with SPIFFE identity and mTLS | Built in | Separate mesh (Istio, Linkerd) to operate |
| Kubernetes Gateway API + Istio resource translation | Built in | Partial or vendor-specific CRDs |
| Live config updates with zero dropped connections | Built in | Reload-based; may drop long-lived connections |
| Usage metering & chargeback for internal billing | Built in | Enterprise tier or external analytics |
| Secrets from Vault, AWS, GCP, Azure, or files | Built in | Varies; often manual integration |
Built for Teams of Every Size
Individual Developers
Download one binary, point it at a YAML file, and you have a production-grade gateway in two minutes — no database, no license key, no cloud account. Free for noncommercial use, with mock responses and fault injection built in for local API development.
Startups & Product Teams
One system covers your public API, your internal services, and your LLM spend — so a small team isn't operating three platforms. Token budgets and semantic caching keep AI costs contained; the web UI and Admin API keep day-two operations simple.
Enterprises
Control Plane / Data Plane distribution, multi-region failover, SPIFFE workload identity, OPA policy, WAF, compliance-grade AI transcript auditing, chargeback for internal cost allocation, and secrets integration with your existing vault — with commercial licensing and the entire codebase available for audit.
Every Protocol, One Gateway
Consolidate your infrastructure. One gateway for HTTP APIs, gRPC services, WebSocket connections, streaming, and raw TCP/UDP — with or without TLS.
See for Yourself
Start with the file-mode quick start — no database needed, running in minutes. Then benchmark it against whatever you use today.