Akto Kong Plugins

Two Kong Gateway plugins for Akto API Security.

---

Plugins

api_plugin — akto-api-discovery

Passively mirrors API traffic to Akto for API discovery and inventory.

• Zero impact on request/response — all Akto I/O is async, fire-and-forget
• Captures request body, response body (capped at 256 KB), headers, method, path, status
• Fail-safe: any error in the plugin is silently discarded; client traffic is never affected
• Drops ingest gracefully when Akto is slow or unreachable (50-timer cap per worker)

agentic_plugin — akto-mcp-endpoint-shield

Active guardrails for agentic / MCP traffic. Supports two modes:

• async — mirrors traffic to Akto (non-blocking)
• blocked — validates requests and responses against Akto guardrails before proxying

---

Installation

1. Mount the plugin

Add to your docker-compose.yml or Helm values:

volumes:
  - ./api_plugin:/usr/local/share/lua/5.1/kong/plugins/akto-api-discovery:ro

environment:
  KONG_PLUGINS: bundled,akto-api-discovery

2. Enable on a route or service

curl -X POST http://localhost:8001/routes/{route-id}/plugins \
  -d "name=akto-api-discovery" \
  -d "config.service_url=http://<akto-host>:9091" \
  -d "config.timeout=5000" \
  -d "config.log_level=warn"

3. Configuration

Parameter	Default	Description
service_url	http://localhost:8080	Akto backend URL (plugin POSTs to <service_url>/api/ingestData)
timeout	30000	Timeout in ms for the async ingest call
log_level	warn	Log verbosity: debug, info, warn, error

---

Payload format

The plugin sends a POST to <service_url>/api/ingestData with:

{
  "batchData": [
    {
      "akto_account_id": "1000000",
      "akto_vxlan_id": "0",
      "ip": "<client-ip>",
      "is_pending": "false",
      "method": "POST",
      "path": "/api/orders",
      "requestHeaders": "{...}",
      "requestPayload": "{...}",
      "responseHeaders": "{...}",
      "responsePayload": "{...}",
      "source": "MIRRORING",
      "status": "Created",
      "statusCode": "201",
      "tag": "{\"source\":\"kong\"}",
      "time": "1780323839",
      "type": "HTTP/1.1"
    }
  ]
}

---

Priority

Plugin execution priority can be set at deploy time via environment variable:

AKTO_API_PLUGIN_PRIORITY=10   # api_plugin (default: 10)
AKTO_MCP_PLUGIN_PRIORITY=10   # agentic_plugin (default: 10)