B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.

App connector · General

kong

🦍 The API and AI Gateway

Bottom line: Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code review.

Popularity score: 51/100
Rank: #97 of 500
GitHub stars: 44.3k

What it does

Kong is an open-source API gateway and platform that manages, routes, and secures API traffic with plugins for authentication, rate-limiting, and logging. When used as an MCP connector, it likely bridges AI agents to Kong-managed APIs, enabling agents to discover and call downstream services through a unified gateway.

Who it’s for

Platform engineers and architects who operate Kong gateways and want to expose API governance, routing rules, or service inventory to AI agents. Builders integrating AI agents into organizations with existing Kong infrastructure.

Copy-paste setup

Check these steps against the project’s own instructions before running anything.

Kong itself is a standalone gateway (Docker/Kubernetes/binary install). As an MCP server, verify against the Kong GitHub repo README (opens external site) for official MCP connector documentation—this repo may not yet ship an MCP implementation. If available, configuration typically involves:

json

{
  "mcpServers": {
    "kong": {
      "command": "[verify repo for binary/npm package]",
      "env": {
        "KONG_ADMIN_URL": "http://localhost:8001",
        "KONG_API_KEY": "[your-admin-api-key]"
      }
    }
  }
}

Action: Verify against the repo README for current MCP integration status and exact setup.

Risks

Credential scope: Admin API keys grant broad control over routes, plugins, and credentials; compromise could allow traffic hijacking or data interception.
Prompt injection via API definitions: Agents querying Kong configuration could be manipulated to misroute requests or expose sensitive upstream service URLs.
Data exfiltration via routing: Misconfigured agent-Kong integration could log or replay API payloads (PII, tokens) without encryption or audit controls.
Plugin supply-chain risk: Kong's plugin ecosystem is community-driven; malicious or unmaintained plugins could introduce vulnerabilities.
Rate-limit bypass: Agents may not respect Kong's rate-limiting, flooding upstream services if not properly scoped.

How to stay secure

Least-privilege permissions

Create dedicated Kong Admin API keys scoped to specific workspaces and endpoints (e.g., read-only for routes, no plugin management).
Restrict MCP connector identity to only query necessary Kong entities; disable access to credential storage, upstream services, and plugin configuration.
Rotate admin credentials every 30 days; revoke keys immediately if agent behavior deviates from expected patterns.
Use Kong RBAC roles to enforce separation between agent read operations and administrative write operations.

Network isolation

Deploy the MCP connector on a private network segment with outbound rules limiting Kong Admin API calls to a single endpoint.
Encrypt all MCP-to-Kong communication with mutual TLS; disable HTTP fallback.
Restrict Kong plugin execution to signed/pinned versions only; block dynamic plugin loading and community plugin repositories.
Implement egress filtering to prevent agents from reaching upstream service URLs directly; funnel all requests through Kong's routing layer.

Monitoring

Log all MCP connector queries to Kong Admin API with request body, response status, and queried resources; alert on non-read operations or unusual API paths.
Track agent-generated routing decisions and compare against known legitimate upstream services; flag misroutes or novel destinations.
Monitor Kong request/response sizes and latency for anomalies (exfiltration, replay attacks); set alerts for payloads exceeding baseline.
Audit Kong plugin inventory weekly for unauthorized, unmaintained, or community-contributed plugins; maintain a signed allowlist.

Red flags to watch for

Agent queries requesting full Kong configuration dumps, credential objects, or plugin bytecode instead of specific route metadata.
Rate-limit exceptions or repeated 429 responses ignored by the agent; upstream service degradation or errors during agent operation.
Unexpected routing changes or new upstream service URLs appearing in Kong after agent interactions; configuration drift from version control.
MCP connector making Admin API calls outside normal business hours or from unfamiliar network origins; failed auth attempts followed by successful privilege escalation queries.

Alternatives

AWS API Gateway — Managed API gateway with IAM, logging, and MCP integration potential; requires AWS lockdown.
Traefik — Lightweight reverse proxy with dynamic service discovery; smaller plugin ecosystem than Kong.
Apigee — Enterprise API management (Google Cloud) with built-in governance; higher cost and vendor lock-in.
Envoy Proxy — Low-level service proxy; steeper learning curve but more control.

Sources

github.com/Kong/kong