Articles on MCP gateways, AI governance, API gateways, spec-driven development, and building with Rust and WASM.
Most WAFs parse their rules at runtime and silently drop the ones they can't enforce. Barbacane validates an OWASP CRS rule set at build time, seals it into the signed artifact, and refuses to start if the rules and the binary disagree. Here's how it works, and why compile time is the right place for it.
FIPS 140-3 shows up as a procurement gate for government, defense, finance, and healthcare, and it is widely misunderstood. What FIPS 140-3 validates (a cryptographic module, not your whole application), how it differs from 140-2, whether it is quantum-safe, and how Barbacane provides it without an OpenSSL FIPS build.
The Token Manifesto argues for discipline over verbosity in the LLM era. We agree so much that we built a gateway that enforces it instead of hoping for it. A reaction, mapped point by point to how we build Barbacane.
Memory safety is the easy 30%. The boundaries that actually matter in a complex system, capability sandboxes, artifact integrity, SSRF, auth, are application-level, and Rust won't enforce them for you. Here's how we built a harness that does.
LiteLLM vs Portkey is the usual first comparison, but the real question is what the gateway does once it handles more than the LLM path. A head-to-head on LiteLLM, Portkey, and Barbacane: provider coverage, spec-first routing, MCP for the inbound direction, and composition with the rest of your API governance.
Human developers route around inconsistent contracts, undocumented auth quirks, and drifted specs. Agents cannot. As agents become first-class API consumers, the dev-experience hygiene your team has been postponing turns into a production reliability problem.
Model Context Protocol turns any API into a potential AI agent tool. MCP gateways solve the same problem API gateways solved 15 years ago: centralize tool exposure, governance, and observability instead of letting every team ship their own.
Instead of risky big-bang rewrites, the Strangler Fig pattern lets you modernize legacy systems incrementally. Learn how Barbacane's spec-driven, compiled approach makes it the ideal facade for safe, reversible migrations.
From schema validation and secrets management to FIPS 140-3 cryptography and GitOps workflows — the specific controls Barbacane provides for SOC 2, PCI DSS, HIPAA, FedRAMP, and beyond.
APIs are easy to launch and nearly impossible to kill. Explore how Barbacane's compiled, spec-driven approach turns API retirement from an organizational ordeal into a routine lifecycle operation.
Auditors don't just ask whether you have security controls. They ask how you can prove those controls were actually enforced. Explore how Barbacane's compiled approach turns your API gateway into a verifiable compliance artifact.
A roadmap isn't a feature wishlist. It's a series of bets about what matters most, made with incomplete information. Here's how we decide what to build next for an open-source API gateway.
Authentication tells you who someone is. Authorization tells you what they can do. Explore how Barbacane's CEL and OPA plugins bring policy-driven access control to the gateway layer, from inline expressions to centralized policy engines.
Most API tooling assumes one repo, one spec. But microservices don't work that way. Explore how Barbacane's multi-spec compilation merges your OpenAPI and AsyncAPI files into a single, validated artifact.
What if your OpenAPI spec wasn't just documentation, but the actual configuration of your production gateway? Explore how Barbacane eliminates configuration drift with a spec-driven, compiled approach.