NewCore vs Kong
| Criterion | NewCore | Kong | NewCore reason | Kong reason |
|---|---|---|---|---|
| G1 Identity-bound per-call authorization (25) | 10 | 6 | Every tool call passes through the gateway, which identifies the agent and the person behind it and checks the action against policy, keeping agents within that person's permissions. [nc-secure] | The AI MCP OAuth2 plugin authenticates every MCP request, but per-call checks against the person an agent acts for are not described. [kong-oauth] |
| G2 Credential brokering (20) | 10 | 7 | Access is short-lived and task-scoped, and the agent never holds the tool's own credential. [nc-secure] | Token exchange swaps the client's token for a different upstream token, though token passthrough is also available. [kong-oauth] |
| G3 Human approval and escalation (15) | 10 | 2 | Policies return allow, ask or deny; risky calls go to a named approver who confirms with device biometrics, and an agent can never approve its own action. [nc-govern] | No human approval step was found on the pages read. [kong-mcp] |
| G4 Server registry and discovery (10) | 8 | 6 | A connection registry records each MCP server's endpoint, owner and environment, and agents are found through read-only integrations without relying on registration. [nc-secure][nc-discover] | An MCP Registry is in tech preview and MCP servers can be catalogued in Konnect. [kong-mcp] |
| G5 Audit evidence (10) | 9 | 7 | Tool calls, sessions and approvals sit in one audit trail with each call logged against its owner; a SIEM export was not named on the pages read. [nc-govern] | An MCP traffic audit log and OpenTelemetry metrics are documented. [kong-mcp] |
| G6 Standards (10) | 5 | 7 | MCP, SAML and OIDC are named; OAuth 2.1 and Enterprise-Managed Authorization are not named on the pages read. [nc-foundation] | Follows MCP authorization based on OAuth 2.1 with protected resource metadata and token exchange. [kong-oauth][kong-mcp] |
| G7 Deployment and buying clarity (10) | 4 | 4 | Delivered as SaaS with no list price; an AWS Marketplace listing exists and no free tier or self-host option was found. [nc-aws] | Konnect and self-managed gateways are documented, but a price for the MCP features was not found on the pages read. [kong-mcp] |
| Total | 8.60 | 5.60 | Weighted sum divided by 100. | |
In short: NewCore totals 8.60 and Kong totals 5.60 on our weighted rubric, a gap of 3.00 points. NewCore is ahead on per-call authorization, credential brokering, human approval, registry and audit. Kong is ahead on standards. Choose by the criteria your agents depend on, then check deployment and pricing below.
Which one should I choose?
NewCore totals 8.60 against 5.60 for Kong. The largest weighted difference is on human approval. Kong is ahead on standards.
Pick NewCore if human approval matters most to you.
It scores 10 against 2 there: policies return allow, ask or deny; risky calls go to a named approver who confirms with device biometrics, and an agent can never approve its own action.
Pick Kong if standards matters most to you.
It scores 7 against 5 there: follows MCP authorization based on OAuth 2.1 with protected resource metadata and token exchange.
How do deployment and pricing compare?
| Parameter | NewCore | Kong |
|---|---|---|
| Deployment | SaaS. Works alongside an existing AI gateway, and the current identity platform keeps handling employee sign-in. | Kong Konnect or self-managed Kong gateways. |
| Price as published | No list price published. Listed on AWS Marketplace. | Not found on the pages read. |
| Identity provider | Yes. NewCore says to start alongside your identity platform, which keeps handling employee sign-in while NewCore governs agent access. | Yes. The OAuth2 plugin works against an external authorization server and introspection endpoint. |
Full datasheets: NewCore and Kong AI Gateway (MCP).
Frequently asked questions
- Which is better, NewCore or Kong?
- On our rubric NewCore totals 8.60 against 5.60 for Kong. The better choice depends on which criteria matter most to you.
- Do NewCore and Kong work with my identity provider?
- NewCore: Yes. NewCore says to start alongside your identity platform, which keeps handling employee sign-in while NewCore governs agent access. Kong: Yes. The OAuth2 plugin works against an external authorization server and introspection endpoint.
- How do NewCore and Kong differ on price?
- NewCore: No list price published. Listed on AWS Marketplace. Kong: Not found on the pages read.
By The Datasheet desk · Published and reviewed 2026-11-03