Your entire edge,
managed by AI.
API gateway, WAF, secure tunnels, static app hosting, and identity-aware access in one control plane — with Iris, built-in AI that drafts, audits, and tunes your rules. From localhost to production.
API gateway & secure tunneling — managed ingress.
No firewall changes, no open ports. Route, secure, and monitor every API and device from a single control plane.
Production Gateways
Secure egress-only connectivity into Kubernetes clusters. No inbound firewall changes, no open ports — just a single outbound tunnel.
- Private cluster access with mTLS
- Per-endpoint auth & policy
- Works through NAT and firewalls
Expose Localhost
One command to get a public HTTPS URL pointed at your dev server. Perfect for demos, webhook testing, and mobile device previews.
- Instant public URL on a custom domain
- Webhook capture & replay inspector
- Zero config TLS
AI Model Orchestration
Intelligently route inference calls across providers, redact PII at the edge, and fall back to local models when cloud APIs degrade.
- Multi-provider routing & fallback
- PII redaction before egress
- Semantic cache for repeated prompts
Global Edge
Built-in edge processing layers run before your origin sees a single byte — shield, verify, and shape traffic at the perimeter.
- WAF with managed rulesets
- JWT / OIDC validation
- Global rate limiting
Remote Device Access
Securely reach cameras, sensors, and gateways behind carrier-grade NAT. Stream telemetry and manage fleets without VPNs.
- Per-device identity & ACLs
- Real-time traffic stream monitoring
- Works over cellular & carrier NAT
Install & run in seconds.
Install the agent, authenticate once, and point it at a local port — you're live on the edge with TLS already terminated.
Install the agent
One egress-only binary for your OS — no daemon, no inbound ports.
brew install ngrisAuthenticate
Link the agent to your account, once.
ngris auth --browserRun a tunnel
Get a public HTTPS URL, then attach WAF, OAuth, and rate limits.
ngris http 3000$ brew install ngris $ ngris auth --browser ✓ Authentication successful $ ngris http 3000 --url myapp.ngris.io Status online Routing https://myapp.ngris.io → localhost:3000 Inspector https://dashboard.ngris.com/endpoints/myapp # other install targets curl -fsSL https://ngris.com/install.sh | sh winget install Ngris docker pull ghcr.io/ngris-edge/ngris
Deploy your app to the edge.
Push a repo or drop a folder — Ngris builds it, serves it over global HTTPS, and gives every deploy a shareable preview URL. No servers, no config, no agent. Built for the way AI writes code.
Push to deploy
Connect a GitHub or GitLab repo and every push auto-builds & ships. Or upload a build folder — either way you’re live in seconds.
Framework-aware builds
Vite, Next.js, Astro, SvelteKit, Nuxt, Gatsby, Angular, Hugo, Jekyll — auto-detected and built in an isolated sandbox, with live build logs you can tail.
A preview for every deploy
Each build gets its own unguessable preview URL to review before you promote — and rolling back to any version is an instant, atomic pointer flip.
Env vars & secrets
Per-app environment variables are injected into your build. Mark keys as secrets and they’re encrypted at rest — never shown again.
Edge policies included
Auth, firewall, rate limits, WAF, and a custom domain apply to your static app exactly like any other endpoint. One platform, one bill.
API-first deploys
One curl creates the app, uploads it, and returns a live URL — and Iris can drive the whole flow from chat. Read the guide →
Enterprise Edge Gateway & API Tunneling Platform
From development to production, across every environment. Everything others charge extra for is included.
Live Inspector & Replay
Tail requests in real-time, search payloads, redact secrets, and replay to any environment with overrides.
Identity-Aware Access
Per-endpoint RBAC with OAuth (Google, GitHub, Azure, Okta), API keys, SSO, and MFA — all built in.
Built-in WAF & Firewall
IP restrictions, rate limiting, JWT validation, circuit breakers, and AI-generated firewall rules.
AI in the dashboard
AI Generate buttons draft firewall, routing, traffic-policy, rate-limit, and error-template rules. Iris chat edits, disables, reorders, and audits your config. Learn more →
Multi-Region Edge
Deploy across regions with automatic route synchronization, cross-region proxying, and graceful region drain.
Teams & Accounts
Full org model with roles, SSO enforcement, resource quotas, audit logs, and per-org billing.
One API Gateway, Every Environment
From solo developers to infrastructure teams — secure tunneling and ingress for every workflow.
Webhook Development
Receive Stripe, GitHub, and Twilio events locally. Inspect payloads, debug signatures, and replay edge cases.
Kubernetes Ingress
Route external traffic into K8s clusters without exposing nodes. Egress-only agent model, zero inbound ports.
AI Gateway
Proxy LLM calls with PII redaction, caching, and automatic fallback across OpenAI, Anthropic, and local models.
Staging & Preview
Share secure links to in-progress work with SSO protection and short-lived URLs that expire automatically.
IoT & Edge
Connect remote devices and sensors through encrypted gateways with real-time traffic monitoring.
Static Egress IP
Route outbound traffic through a dedicated IP for third-party APIs that require allowlisting. Single-region or GeoDNS.
Debug in minutes, not days.
The Request Inspector captures inbound traffic with searchable payloads and lets you replay with overrides. Built-in redaction keeps secrets safe.
Full-text search
Search across headers and JSON bodies with regex support.
GDPR-friendly redaction
Automatic secret masking and retention controls (7–30 days).
Replay to dev/staging
Editable payloads and headers — replay to any environment.
Alerts to Slack/Teams
Get notified when requests fail or spike unexpectedly.
No paywall. No sales call.
A typical production setup elsewhere runs $50–200+/mo after add-ons. On Ngris, the same setup starts at $8/mo — everything included.
Simple, Transparent Pricing
Start free. Scale without surprise bills. Everything others charge extra for is included.
- 5 concurrent endpoints
- 10 tunnels
- 10 GB bandwidth / month
- 200K requests / month
- Unlimited custom domains
- SSO & RBAC included
- All protocols
- Community support
- 3-day log + audit retention
- 25 concurrent endpoints
- 100 tunnels
- 50 GB bandwidth / month
- 500K requests / month
- 5 custom domains + subdomains
- 5 dedicated TCP/UDP ports
- Up to 5 team members
- SSO & RBAC included
- Priority email support
- 15-day log retention
- Unlimited concurrent endpoints
- Unlimited tunnels
- Unlimited bandwidth
- Unlimited requests
- Unlimited custom domains
- 10 dedicated TCP/UDP ports
- Unlimited team members
- SSO & RBAC included
- All protocols
- Priority support (4h)
- 30-day log retention
Runs everywhere you deploy.
One egress-only agent for every OS and runtime, plus a REST API and OpenAPI spec to drive it from code.
brew install ngriscurl -fsSL https://ngris.com/install.sh | shwinget install Ngrisdocker pull ghcr.io/ngris-edge/ngrishelm install ngris ngris/agenthttps://api.ngris.comEnterprise-grade security, built in.
Every plan includes these security foundations — not as add-ons, but as defaults.
Everything else, answered.
Still stuck? The docs go deeper, or reach the team at sales@ngris.com.
Secure tunneling creates an encrypted connection between a local server and the Ngris edge, exposing your application via a public URL without opening firewall ports or configuring DNS. The Ngris agent establishes an outbound TLS connection to the edge, which routes inbound traffic to your local service. All traffic is encrypted end-to-end with automatic TLS termination.
Yes. Ngris hosts static sites and web apps on the edge with no server and no agent: upload a folder or connect a GitHub/GitLab repo, and Ngris auto-detects your framework (Vite, Next.js, Astro, SvelteKit, Hugo and more), builds it in an isolated sandbox, and serves it over global HTTPS. Every deploy gets a shareable preview URL, per-app environment variables and secrets, live build logs, and instant atomic rollback.
An API gateway is a reverse proxy between clients and backend services that handles routing, authentication, rate limiting, and observability. Ngris goes beyond traditional API gateways by adding live traffic inspection and replay, per-endpoint identity-aware access, a built-in WAF, static egress IPs, and AI-powered rule generation — all without managing infrastructure.
All agent-to-edge traffic is encrypted. Paid plans add SSO/OIDC, IP allowlists, per-endpoint policies, and audit logs. Redaction and retention controls keep captured data safe.
A real-time dashboard that captures every inbound request with full headers and body. You can search, filter, redact secrets, and replay requests to any environment.
Yes. Paid plans include custom subdomains and domains via automated DNS and ACME. Enterprise supports dedicated certificates and wildcard TLS.
A dedicated outbound IP address that all your outbound traffic routes through. This is useful when third-party APIs or services require IP allowlisting.
Yes. Ngris is designed for production workloads with multi-region redundancy, continuous monitoring, automatic TLS, and edge security. Run it as your primary ingress for APIs, webhooks, and microservices — or alongside your existing CDN and load balancer for layered observability. Enterprise plans include dedicated regions and priority support.
The Starter plan includes 5 concurrent endpoints, 100k requests per month, random subdomains, and a basic request inspector. No credit card required.
Ship faster with managed ingress.
Create an account and launch your first endpoint in under a minute. No config files, no credit card, no friction.