Fast by Design. Simple by Choice.
Choosing gateway infrastructure is a long-term commitment. Here is the case for Ferrum Edge — in plain language, with the evidence to back it up.
Five Reasons in Thirty Seconds
Why Ferrum Edge Is Fast
No jargon required — three design decisions explain most of the speed.
Requests Never Wait in Line
In many gateways, every request briefly stops to check the current routing rules — like every customer in a store asking the same clerk for directions. Under heavy traffic, a queue forms. Ferrum Edge gives every request its own instant, read-only snapshot of the rules. There is no clerk, no queue, and no slowdown — even while the rules are being updated live.
No Cleanup Pauses
Gateways written in Go or Java rely on a garbage collector — a background process that periodically freezes the application to tidy up memory. Those freezes surface as random latency spikes for your users. Ferrum Edge is written in Rust, which manages memory precisely as it goes. There is no collector, so there are no collector pauses; what remains is your CPU headroom, the plugins you enable, and your backends.
No Middleman Layers
Several popular gateways are a scripting language running on top of an engine written in a different language, with translation happening on every request. Every layer adds time and complexity. Ferrum Edge is one language, top to bottom — the request path runs as native machine code with nothing lost in translation.
The result, in numbers
In the October 6, 2026 benchmark run, over 104,000 requests per second on HTTP/1.1 and 108,000+ on raw TCP on a single machine — and when we loaded the gateway with 30,000 configured routes, each with authentication and access control, median latency moved from 0.54 ms to just 0.56 ms with zero failed requests. Full methodology and raw data are published on the benchmarks page.
Benchmarked Against the Field
Historical local results: same hardware, same Docker setup, same test — authenticated API traffic through each gateway. The run predates the current release; reproduction scripts are public.
| Gateway | Authenticated Requests/sec | Average Latency | vs. Ferrum Edge (this run) |
|---|---|---|---|
| Ferrum Edge | 27,979 | 3.44 ms | — |
| Envoy 1.37 | 26,787 | 3.64 ms | Ferrum 4% faster |
| Kong 3.14 | 25,009 | 3.91 ms | Ferrum 12% faster |
| Tyk v5.12 | 19,186 | 5.08 ms | Ferrum 46% faster |
How Ferrum Edge Compares
An honest look at where Ferrum Edge fits relative to the tools you may already know.
vs. Kong
Kong is a mature gateway built as a Lua scripting layer on top of nginx, with many advanced capabilities gated behind its enterprise edition or sourced from a plugin marketplace. Ferrum Edge ships its full 80+ plugin catalog in the core binary — including OIDC, OPA, WAF, and the complete AI suite — runs the request path as native code with no scripting layer, and recorded 12% higher authenticated throughput in our historical published benchmark run.
vs. Envoy / Istio
Envoy is a powerful C++ proxy, but most teams experience it through a mesh like Istio: a multi-component control plane, a steep configuration model, and extensions that require WebAssembly or external services. Ferrum Edge delivers the same mesh patterns — sidecar, ambient, waypoints, east-west, egress — plus Istio resource compatibility, in one memory-safe binary with built-in plugins and dramatically simpler operations.
vs. Tyk / Apigee / Cloud Gateways
Managed API platforms trade control and cost predictability for convenience — per-call pricing, regional constraints, and limited protocol support (usually HTTP only). Ferrum Edge is self-hosted on your terms, proxies TCP, UDP, WebSocket, and gRPC alongside HTTP, and includes usage metering and chargeback plugins if you need to bill internal teams yourself.
vs. nginx / HAProxy / Caddy
Classic reverse proxies are excellent at moving bytes but leave authentication, rate limiting, AI governance, and dynamic configuration as exercises for the operator. Ferrum Edge covers the proxying layer with comparable throughput, then adds the full gateway feature set — live config updates with no reloads or dropped connections, a management API, and a web UI.
vs. Dedicated AI Gateways
Point solutions like LiteLLM or Portkey govern LLM traffic but leave you running a second gateway for everything else. Ferrum Edge's AI capabilities — 11-provider federation with streaming, token budgets, semantic caching, prompt and output guardrails, tool-call governance, MCP and A2A gateways — live in the same pipeline as your authentication, WAF, and observability. One policy surface for all traffic.
A note on fairness
Every product above is good software with real strengths, and the right choice depends on your workload. Our comparison harness is source available under PolyForm Noncommercial or a commercial license. The displayed figures are historical; follow the audited harness instructions to measure your own traffic patterns before deciding.
What's in the Box
Capabilities included in the single Ferrum Edge binary, no add-ons required.
| Capability | Ferrum Edge | Typical Alternative |
|---|---|---|
| HTTP/1.1, HTTP/2, HTTP/3, WebSocket, gRPC, SSE | Built in | HTTP/3 and WebSocket support varies widely |
| Raw TCP and UDP proxying with TLS/DTLS | Built in | Often requires a separate L4 load balancer |
| 10+ authentication methods (mTLS, OAuth2, OIDC, JWT, HMAC…) | Built in | OIDC frequently enterprise-tier only |
| WAF content threat detection | Built in | Separate product or paid module |
| AI gateway: 11-provider federation with streaming | Built in | Separate AI gateway product |
| Token budgets, semantic cache, prompt/output guardrails | Built in | Rare; usually third-party add-ons |
| MCP and Agent-to-Agent (A2A) gateways | Built in | Emerging; typically unavailable |
| Service mesh with SPIFFE identity and mTLS | Built in | Separate mesh (Istio, Linkerd) to operate |
| Kubernetes Gateway API + Istio resource translation | Built in | Partial or vendor-specific CRDs |
| Live config updates with zero dropped connections | Built in | Reload-based; may drop long-lived connections |
| Usage metering & chargeback for internal billing | Built in | Enterprise tier or external analytics |
| Secrets from Vault, AWS, GCP, Azure, or files | Built in | Varies; often manual integration |
Built for Teams of Every Size
Individual Developers
Download one binary, point it at a YAML file, and you have a production-grade gateway in two minutes — no database, no license key, no cloud account. Free for noncommercial use, with mock responses and fault injection built in for local API development.
Startups & Product Teams
One system covers your public API, your internal services, and your LLM spend — so a small team isn't operating three platforms. Token budgets and semantic caching keep AI costs contained; the web UI and Admin API keep day-two operations simple.
Enterprises
Control Plane / Data Plane distribution, multi-region failover, SPIFFE workload identity, OPA policy, WAF, compliance-grade AI transcript auditing, chargeback for internal cost allocation, and secrets integration with your existing vault — with commercial licensing and the entire codebase available for audit.
Every Protocol, One Gateway
Consolidate your infrastructure. One gateway for HTTP APIs, gRPC services, WebSocket connections, streaming, and raw TCP/UDP — with or without TLS.
See for Yourself
Start with the file-mode quick start — no database needed, running in minutes. Then benchmark it against whatever you use today.
Benchmark Provenance
These are historical local Apple Silicon results recorded in the repository performance summary. That summary does not record a run date or tested commit; these figures are not a v0.9.5 performance certification. Payload, concurrency, protocol, hardware, and configuration affect results. Use the linked repository harnesses for current measurements.