open-gw
Already there
One control point
Identity, rate limits, and audit are production controls. Open Gateway uses them.
Open Gateway
The gateway you already run.
Enterprises already govern API traffic at Apigee, Kong, Apache APISIX, and Azure API Management. Open Gateway publishes open specifications and drop-in extensions so new work lands on that gateway, instead of on a second platform beside it.
Why
The gateway is already certified, already audited, and already on the request path. Auth, quotas, and logs live there. A new control plane has to earn that trust again, and then the two policies drift.
The pressure
New work, old edge
Agents, MCP tools, and open telemetry arrive faster than gateway vendors ship them.
The mistake
A second plane
A sidecar with its own policy has to be certified, operated, and reconciled with the gateway.
How
Each initiative is a separate repository. The method is the same: say what the gateway must know, ship it as something that gateway already runs, and leave enforcement on the gateway.
Declare
Write the contract in the open, usually as OpenAPI or a short specification the interface owner can review.
Extend
Deliver a Java callout, a Lua plugin, a policy fragment, or a sidecar the existing gateway can host.
Enforce there
OAuth, quotas, and audit stay on the gateway. Open Gateway does not ship a replacement policy plane.
Initiatives
Open Gateway is the organization. These are the public initiatives. Consequence tiering is one of them.
Governance
Consequence tiers
ctier classifies an operation by what happens if the call is wrong, and ctier-engine enforces that class at Kong, Apache APISIX, and Apigee.
Data
Database tools
gateway-db-mcp exposes MySQL, MariaDB, PostgreSQL, and SQL Server as MCP tools through the gateway, and ships no policy of its own.
Research
Bounded autonomy
A study of how far a multi-step agent can reach, which credentials it holds, and whether its writes can be unwound.
Community
Developer tools
Browser tools for API developers, each on its own hostname. Nothing in this line is published yet.