Higress
AI-native cloud-native API gateway on Envoy, the Wasm-based successor to Nginx Ingress.
About
Higress is an AI-native, high-performance API gateway built on Envoy and Istio that unifies the traffic gateway, microservices gateway, and AI gateway in one control plane. It treats LLM traffic as first-class: native multi-provider LLM proxying, token-bucket rate limiting (limiting cost, not just QPS), multi-model fallback, RAG integration, and MCP server hosting through Wasm plugins written in Go, Rust, or JavaScript.
Born inside Alibaba to solve gateway-reload disruption and weak gRPC/Dubbo load balancing, it passed the CNCF TOC vote to join as a Sandbox project and is now vendor-neutral. With Nginx Ingress heading for retirement, Higress positions itself as the secure drop-in successor, claiming 80-90% compatibility with Nginx Ingress annotations while replacing the vulnerable config-injection model with a structured xDS control plane and Wasm sandbox. Alibaba Cloud builds its commercial cloud-native API gateway product on Higress.
What it can do
- Envoy+Istio data plane with Wasm plugin extensibility
- AI-native: token-bucket rate limiting, multi-model fallback
- MCP server hosting and OpenAPI-to-MCP conversion
- Nginx Ingress annotation compatibility for migration
- Full Kubernetes Gateway API support
- Out-of-the-box console with plugin hub
Setup
docker run the higress all-in-one image (console on port 8001), or install via Helm on Kubernetes.
Prerequisites
Docker or Kubernetes; familiarity with Envoy concepts helps.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (verified tier, metrics-v1). Evidence: CNCF Sandbox acceptance documented by Alibaba Cloud and the CNCF sandbox issue; star count and Apache 2.0 license read from GitHub. Strengths: battle-tested at Alibaba scale, genuinely AI-native gateway design, strong Wasm extensibility story, well-timed Nginx Ingress successor. Docked for: (1) still a young CNCF Sandbox project with governance maturing; (2) ecosystem and docs skew toward the Chinese community in places; (3) annotation-compatibility and performance claims are provider-reported. License: Apache-2.0.
★ 9,572 GitHub stars
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 7.0/10
- Maintenance · recency, releases, issue load
- 9.0/10
- Openness · license + docs
- 10.0/10
- Manual review · sanity read + red-flag check
- 7.0/10
- · 9,572 GitHub stars on higress-group/higress (verified via GitHub API)
- · Born at Alibaba; passed CNCF TOC vote to join as Sandbox project
- · Envoy+Istio with Wasm plugins; AI-native: token-bucket rate limiting, MCP hosting
- · manual review: docs/community skew Chinese in places; compatibility claims provider-reported
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.