# G8

> G8 is the API and AI gateway platform that runs in your own infrastructure: API Gateway, AI Gateway, API Security and Developer Portal in one console, with every change checked and recorded.

G8 is built by Digital Cosmonot, an engineering company in Istanbul, Türkiye. G8 runs entirely in the customer's own infrastructure (OpenShift, Kubernetes, Docker or virtual machines, including networks without internet access). It has four areas managed from one console: API Gateway, AI Gateway, API Security and Developer Portal. Every configuration change passes a role check and is recorded in an audit log before it is applied. Analytics and request records stay in the customer's own Prometheus and Elasticsearch or OpenSearch. G8 comes in three editions: Community (free, obtained by contacting the G8 team; G8 is not open source), Enterprise and Enterprise AI (adds the G8 Copilot). Enterprise editions are licensed by gateway node and node type; there is no public price list.

Terminology: "G8 engine" is the gateway data plane that G8 manages. "Environment" is one gateway cluster (for example Development, Staging, Production). "Route", "Service", "Upstream", "Consumer" and "Plugin" are the gateway objects. "OpenAPI to MCP" serves an existing REST API to AI agents as MCP tools from its OpenAPI document.

## Product
- [Home](https://g8.dev/): Self-hosted API and AI gateway: rate limits, OpenID Connect, LDAP and JWT, traffic rules and an audit record of every change. It serves your APIs to AI agents and routes LLM traffic.
- [Why G8](https://g8.dev/why-g8): Why teams choose G8: every part runs in your infrastructure, every change is checked and recorded, one console for every Environment, data in your own stores.
- [API Gateway](https://g8.dev/platform/api-gateway): Rate limits, identity with OpenID Connect, JWT or LDAP, access rules and traffic management for every API. Analytics and request records stay in your own stores.
- [AI Gateway](https://g8.dev/platform/ai-gateway): Route requests to OpenAI, Anthropic, Azure OpenAI, Bedrock, Gemini and more with fallback, token limits and prompt rules. Serve your APIs to AI agents with OpenAPI to MCP.
- [API Security](https://g8.dev/platform/api-security): Authentication, access rules, request validation and data masking for every API, with certificates and secrets in the same console and an audit log of every change.
- [Developer Portal](https://g8.dev/platform/developer-portal): A catalog where developers find your APIs, read their documentation and request access themselves. Your platform team decides what is listed and who gets access.
- [Deployment](https://g8.dev/deployment): Deploy G8 in your own infrastructure: OpenShift, Kubernetes, Docker or virtual machines, networks without internet access included. What runs where, what you provide.

## Solutions
- [API security and identity](https://g8.dev/solutions/api-security-and-identity): Authentication with OpenID Connect, LDAP, SAML, JWT or API keys, client certificates, access rules, request validation and data masking, each a Plugin with an audit record.
- [Rate limiting and traffic management](https://g8.dev/solutions/rate-limiting-and-traffic-management): Rate limits per client, Consumer or key, shared across gateway nodes in Redis, canary releases with traffic-split and circuit breakers with api-breaker, all in the audit log.
- [AI agents and MCP](https://g8.dev/solutions/ai-agents-and-mcp): Expose your REST APIs to AI agents without building MCP servers. G8 serves an API you already run as MCP tools from its OpenAPI document, with your auth, limits and logs.
- [LLM traffic governance](https://g8.dev/solutions/llm-traffic-governance): Keep LLM traffic under control with a self-hosted LLM gateway: provider fallback, token limits and prompt rules, with provider keys that stay at the gateway.
- [Gateway consolidation](https://g8.dev/solutions/gateway-consolidation): One set of rules and one record for every gateway cluster you run: API and AI traffic with one set of roles and one audit log.
- [Change control and audit](https://g8.dev/solutions/change-control-and-audit): Know who changed your API gateway, what changed and when. G8 checks each change against the role and the G8 engine, and records it before it is applied.
- [API observability](https://g8.dev/solutions/api-observability): API observability that shows why a request failed: request records, analytics and alerts in the gateway console, read from your own Prometheus and Elasticsearch or OpenSearch.

## Buying
- [How to buy](https://g8.dev/how-to-buy): Three editions: Community, Enterprise and Enterprise AI. Enterprise editions are licensed by gateway node and node type. Features by edition and the buying process.
- [Request a demo](https://g8.dev/request-a-demo): See G8 with traffic like yours: how access and audit work, where it fits in your infrastructure and what a proof of concept takes. Or ask for a quote.

## Company
- [Press kit](https://g8.dev/press-kit): The G8 logo in SVG and PNG, the colours, product descriptions and console screenshots for articles and partner material.
- [Partners](https://g8.dev/partners): Sell, install and support G8 with us: a program for resellers, system integrators and technology companies that work with enterprises on APIs and AI.
- [About](https://g8.dev/company): G8 is built by Digital Cosmonot, an Istanbul-based engineering company whose founders designed and ran API infrastructure for enterprises before building G8.
- [Contact](https://g8.dev/contact): How to reach the G8 team: a demo or a quote, the partner program, press, support and everything else by email.

## Resources
- [Blog](https://g8.dev/blog): Notes on API and AI gateways from the engineers who build and support G8: how gateways work, how to run them yourself and what to check before you choose one.
- [Knowledge base](https://g8.dev/knowledge-base): Short, practical articles on installing, configuring and operating G8, written by the engineers who support it.
- [Documentation](https://docs.g8.dev): reference for every setting of G8
- [Full text of this site](https://g8.dev/llms-full.txt): every page in Markdown, for assistants that need the details

## Blog
- [Who changed what: audit records for API gateway configuration](https://g8.dev/blog/audit-records): Follow a gateway change through G8's role check, audit record and engine check, see why one is refused, and read what the record keeps afterwards.
- [API gateway vs API management: what the words mean and what you actually buy](https://g8.dev/blog/gateway-vs-management): The gateway is the data plane that enforces rules on traffic. Management is the console, Environments, roles, audit and analytics around it. Both shown on a real install.
- [Keycloak and G8: OpenID Connect at the gateway and Keycloak authorization on a Route](https://g8.dev/blog/keycloak-integration): Put a Keycloak realm in front of a Route with openid-connect, verify bearer tokens at the gateway, then let authz-keycloak decide who may call which path.
- [Fallback between two LLM providers with ai-proxy-multi](https://g8.dev/blog/llm-fallback): Serve one chat endpoint from an on-premises model with a cloud model behind it, force the first to fail, watch the gateway switch, and cap the tokens a Consumer may spend.
- [OpenAPI to MCP: exposing an existing REST API to AI agents](https://g8.dev/blog/openapi-to-mcp): Serve the operations of an OpenAPI document as MCP tools from a Route, with the Route's API key and request limit applying to every tool call an agent makes.
- [Securing MCP tools: identity, rate limits and logs for AI agents](https://g8.dev/blog/securing-mcp-tools): Put an API key in front of the tools an agent calls, give each agent its own budget, mask what the calls carry, and see in the audit log who changed the tool list.
- [What is an AI gateway? Routing, limits and caching for LLM traffic](https://g8.dev/blog/what-is-an-ai-gateway): An AI gateway is the control point between your applications and language models. See the four rules it enforces, each set in the G8 console on one real Route.
- [What is an API gateway, and when does an enterprise need one](https://g8.dev/blog/what-is-an-api-gateway): An API gateway is the one entry point in front of your APIs. See what it holds on a real G8 Environment, which problems it solves, and when a reverse proxy is enough.
## Knowledge base
- [Rate limiting per Consumer with limit-count](https://g8.dev/knowledge-base/rate-limiting-per-consumer-with-limit-count): Give every Consumer of a Route its own request budget with limit-count, keep the counter in Redis for several gateway nodes, and read the 429s in Traffic Explorer and Analytics.

## Plugins of the G8 engine (110, managed from the G8 console)

### AI
- ai-aliyun-content-moderation: Moderates request content with Alibaba Cloud before the LLM.
- ai-aws-content-moderation: Moderates request content with AWS Comprehend before the LLM.
- ai-cache: Caches LLM responses by exact or semantic match.
- ai-lakera-guard: Checks prompts with Lakera Guard before the LLM.
- ai-prompt-decorator: Prepends or appends messages to the prompt sent to the LLM.
- ai-prompt-guard: Allows or denies prompts that match configured patterns.
- ai-prompt-template: Builds the prompt from a template and the request's variables.
- ai-proxy: Proxies requests to an LLM provider with a unified API.
- ai-proxy-multi: Proxies requests to several LLM providers with balancing and fallback.
- ai-rag: Adds retrieved documents to the prompt from a vector search.
- ai-rate-limiting: Limits requests to an LLM provider by tokens or count.
- ai-request-rewrite: Rewrites the request body with an LLM before proxying.
- mcp-bridge: Bridges an MCP server's stdio transport over HTTP.
- openapi-to-mcp: Serves an HTTP API to MCP clients from its OpenAPI document.

### Authentication
- authz-casbin: Authorizes requests with a Casbin model and policy.
- authz-casdoor: Authenticates users against a Casdoor instance.
- authz-keycloak: Authorizes requests with Keycloak's authorization services.
- basic-auth: Authenticates consumers with HTTP Basic credentials.
- cas-auth: Authenticates users against a CAS server.
- dingtalk-auth: Authenticates users with a DingTalk account through OAuth.
- feishu-auth: Authenticates users with a Feishu (Lark) account through OAuth.
- forward-auth: Delegates authentication to an external service.
- hmac-auth: Authenticates requests signed with an HMAC key pair.
- jwe-decrypt: Decrypts a JWE token from the request and forwards its payload.
- jwt-auth: Authenticates consumers with a JSON Web Token they present.
- key-auth: Authenticates consumers with an API key sent in a header or query parameter.
- ldap-auth: Authenticates consumers against an LDAP directory.
- ldap-auth-advanced: Authenticates consumers against LDAP with a service-account bind and a user search.
- multi-auth: Accepts any one of several authentication plugins.
- opa: Authorizes requests with Open Policy Agent.
- openid-connect: Authenticates users against an OpenID Connect provider.
- saml-auth: Authenticates users with a SAML identity provider.
- wolf-rbac: Authorizes requests with wolf role-based access control.

### General
- ext-plugin-post-req: Runs external plugins in the access phase, after the built-in ones.
- ext-plugin-post-resp: Runs external plugins on the response before it returns.
- ext-plugin-pre-req: Runs external plugins before the request reaches the upstream.
- gzip: Compresses responses with gzip.
- real-ip: Takes the client address from a header or variable behind a proxy.
- redirect: Redirects requests to another URI or to HTTPS.

### Observability
- clickhouse-logger: Sends request logs to a ClickHouse table.
- datadog: Sends request metrics to a Datadog agent.
- elasticsearch-logger: Sends request logs to an Elasticsearch index.
- file-logger: Writes request logs to a file on the engine's node.
- google-cloud-logging: Sends request logs to Google Cloud Logging.
- http-logger: Sends request logs to an HTTP endpoint in batches.
- kafka-logger: Sends request logs to a Kafka topic.
- lago: Sends usage events to Lago for metering and billing.
- loggly: Sends request logs to Loggly.
- loki-logger: Sends request logs to Grafana Loki.
- prometheus: Exposes request metrics for Prometheus.
- rocketmq-logger: Sends request logs to a RocketMQ topic.
- skywalking-logger: Sends request logs to Apache SkyWalking.
- sls-logger: Sends request logs to Alibaba Cloud Log Service.
- splunk-hec-logging: Sends request logs to a Splunk HTTP Event Collector.
- syslog: Sends request logs to a syslog server.
- tcp-logger: Sends request logs to a TCP server.
- tencent-cloud-cls: Sends request logs to Tencent Cloud Log Service.
- udp-logger: Sends request logs to a UDP server.
- zipkin: Sends traces to a Zipkin collector.

### Other protocols
- http-dubbo: Translates HTTP requests into Dubbo calls.
- kafka-proxy: Carries the SASL credentials a Kafka upstream is dialled with.
- websocket-proxy: Sets the largest WebSocket message, per direction, a ws or wss upstream may exchange.

### Security
- acl: Allows or denies consumers by the labels they carry.
- chaitin-waf: Sends requests to a Chaitin WAF for inspection.
- consumer-restriction: Allows or denies requests by consumer, group, route or service.
- cors: Adds CORS headers so browsers can call the API from other origins.
- csrf: Protects state-changing requests against cross-site request forgery.
- ip-restriction: Allows or denies clients by IP address or CIDR range.
- public-api: Exposes an internal API of the engine on a route.
- referer-restriction: Allows or denies requests by their Referer header.
- ua-restriction: Allows or denies clients by their User-Agent.
- uri-blocker: Blocks requests whose URI matches a rule.

### Serverless
- aws-lambda: Invokes an AWS Lambda function as the upstream.
- azure-functions: Invokes an Azure Function as the upstream.
- openfunction: Invokes an OpenFunction function as the upstream.
- openwhisk: Invokes an Apache OpenWhisk action as the upstream.
- serverless-post-function: Runs Lua functions after the other plugins of a phase.
- serverless-pre-function: Runs Lua functions before the other plugins of a phase.

### Stream
- ip-restriction: Allows or denies connections by client IP address or CIDR range.
- limit-conn: Limits concurrent connections per key.
- mqtt-proxy: Accepts MQTT connections of one protocol version and exposes the client id as a variable.
- syslog: Sends connection logs to a syslog server.
- traffic-split: Splits connections between upstreams by weight and match rules.

### Traffic
- api-breaker: Breaks the circuit to an unhealthy upstream and returns a fixed response.
- client-control: Controls the client request body size.
- graphql-limit-count: Limits GraphQL requests by their query cost.
- graphql-proxy-cache: Caches GraphQL responses.
- limit-conn: Limits concurrent connections per key.
- limit-count: Limits the number of requests in a time window, per key.
- limit-req: Limits the request rate with a leaky bucket.
- oas-validator: Validates requests against an OpenAPI document; responses are not checked.
- proxy-buffering: Controls response buffering from the upstream.
- proxy-cache: Caches upstream responses on disk or in memory.
- proxy-control: Controls request buffering for the upstream.
- proxy-mirror: Mirrors requests to another upstream.
- request-id: Adds a unique request ID header to requests and responses.
- request-validation: Validates request headers and body against a JSON Schema.
- traffic-label: Labels requests for later plugins by match rules.
- traffic-split: Splits traffic between upstreams by weight and match rules.
- workflow: Runs different plugins for different matched requests.

### Transformation
- attach-consumer-label: Adds the consumer's labels to request headers for the upstream.
- body-transformer: Rewrites request and response bodies with templates.
- data-mask: Masks or removes sensitive request data in the log lines, after the upstream has seen it.
- degraphql: Maps REST endpoints onto a GraphQL upstream.
- fault-injection: Injects delays or fixed responses for testing.
- grpc-transcode: Translates HTTP and JSON requests into gRPC calls and back.
- grpc-web: Lets gRPC-Web browser clients reach a gRPC upstream.
- mocking: Answers requests with a mocked response instead of an upstream.
- proxy-rewrite: Rewrites the request URI, method, host and headers before proxying.
- response-rewrite: Rewrites the response status, headers and body.

## Not to be confused with
- The G8 summit (Group of Eight): a political forum, unrelated.
- Graphics cards, phones or other products named G8: unrelated. This G8 is API and AI gateway software by Digital Cosmonot.