Ngris vs ngrok
Looking for a more capable ngrok alternative? Ngris is a hosted edge — sign up, run ngris http 3000, and your service is live through our global edge with the CLI workflow you already know — plus a per-endpoint policy engine, dedicated ports and IPs, a Kubernetes operator, and an AI operator (Iris) that writes your rules. This is an honest, feature-by-feature comparison; ngrok is a great tool, and we only claim what our code ships today.
Ngris pricing at a glance
What Ngris adds on top of the tunnel
ngrok pioneered the “one command, public URL” workflow. Ngris keeps it and builds a policy-enforcing edge around it.
Per-endpoint policy engine
17+ traffic-policy rule types — rate limits, CIDR/geo restrictions, JWT + CEL, API keys, CORS, JA3 bot management, WAF/OWASP, circuit breaker, URL/body rewrite, webhook verification — applied per endpoint, not one global config.
Dedicated ports & IPs
Reserve dedicated TCP/UDP ports and dedicated egress IPs so partners and firewalls can allowlist a stable address. (Dedicated-IP enforcement is still being hardened — see the notes below.)
Kubernetes operator
A native operator with 9 CRDs (Tunnel, NgrisEndpoint, Domain, Certificate, ClientCA, TrafficPolicy, AuthPolicy, RoutingRule, TunnelMatrix), Ingress-class and Gateway-API support, and auto agent deployment with token rotation.
Iris, the AI operator
Ask in plain English; Iris generates firewall, rate-limit, traffic-policy, routing-rule, and error-template rules, explains requests, and can act with a confirmation card + blast-radius dry-run. Opt-in autonomy is firewall-only with auto-revert.
Edge authentication
Protect any endpoint with HTTP basic auth, mutual TLS (client CAs), or an OAuth2 + PKCE portal — enforced at the edge, before traffic reaches your service.
Inspect & replay
Live request inspection plus server-side capture and replay — re-fire a captured request against your backend to reproduce a bug without waiting for it to happen again.
Ngris vs ngrok, feature by feature
“Yes” means the capability ships in Ngris today. For ngrok we mark only widely-known facts; where a capability isn’t a built-in core feature we say so plainly rather than guess.
| Feature | Ngris | ngrok |
|---|---|---|
| Protocols & tunneling | ||
| HTTP/1.1 & HTTP/2 | ||
| HTTP/3 / QUIC | Yes (experimental) | Not a built-in feature |
| TCP tunneling | ||
| UDP tunneling | Neutral / check plan | |
| WebSocket | ||
| Reserved / custom domains | ||
| Policy & security at the edge | ||
| Per-endpoint policy engine (17+ rule types) | Built-in | Traffic policy available |
| Rate limiting | ||
| IP / CIDR & geo restrictions | ||
| WAF / OWASP rules | Built-in | Neutral / check plan |
| JA3 bot management | Neutral / check plan | |
| JWT + CEL request validation | Neutral / check plan | |
| Circuit breaker | Neutral / check plan | |
| Identity & access | ||
| Edge basic auth | ||
| Mutual TLS (client CAs) | ||
| OAuth2 + PKCE portal | OAuth available | |
| Dedicated resources | ||
| Dedicated TCP/UDP ports | Neutral / check plan | |
| Dedicated / static egress IPs | Built-in | Neutral / check plan |
| Traffic tooling | ||
| Live request inspector | ||
| Server-side capture & replay | Built-in | Neutral / check plan |
| AI rule generation (firewall, rate-limit, policy) | Built-in (Iris) | Not a built-in feature |
| Opt-in firewall autonomy (auto-revert) | Built-in (Iris) | Not a built-in feature |
| Platform | ||
| Kubernetes operator (CRDs + Gateway API) | 9 CRDs | Ingress controller available |
| Auto ACME / Let’s Encrypt | ||
| Agentless static hosting (deploy .zip / git push) | Not a built-in feature | |
| Python SDK | ||
ngrok’s feature set and pricing change over time and vary by plan — check ngrok.com for their current tiers. “Neutral / check plan” means we aren’t asserting a yes or a no; verify against your plan.
Where Ngris is still maturing
Honesty first — the flags we ship with today.
HTTP/3 is experimental
HTTP/3 / QUIC works but is not yet marked production-stable. HTTP/1.1 and HTTP/2 are the default paths.
Autonomy is firewall-only
Iris can act autonomously only on firewall rules, and auto-reverts. Every other change is gated behind an explicit confirmation card with a dry-run.
Dedicated-IP enforcement is being hardened
Dedicated ports and IPs are built; full end-to-end enforcement of dedicated IPs is still being tightened. Talk to us before you depend on it in production.
Switch in 60 seconds
Install Ngris
One egress-only binary — no daemon, no inbound ports.
curl -fsSL https://ngris.com/install.sh | shThe command you already know
Point the agent at a local port and you’re live on the edge.
ngris http 3000Add policy, auth & inspection
Attach a traffic policy, turn on edge auth, or ask Iris to write a rule — all per endpoint.
A policy-first ngrok alternative. Free to start.
Developer is $0, Team is $10/mo, Enterprise is $25/mo. No credit card to get going.